"
+ }
+}
+
+// pluralForm indicates how we want to pluralize a given initialism.
+//
+// Besides configured invariant forms (like HTTP and HTTPS),
+// an initialism is normally pluralized by adding a single 's', like in IDs.
+//
+// Initialisms ending with an 'S' or an 's' are configured as invariant (we don't
+// support plural forms like CSSes or DNSes, however the mechanism could be extended to
+// do just that).
+func (m *indexOfInitialisms) pluralForm(key string) pluralForm {
+ if _, ok := m.index[key]; !ok {
+ return notPlural
+ }
+
+ if strings.HasSuffix(strings.ToUpper(key), "S") {
+ return invariantPlural
+ }
+
+ if _, ok := m.index[key+"s"]; ok {
+ return invariantPlural
+ }
+
+ if _, ok := m.index[key+"S"]; ok {
+ return invariantPlural
+ }
+
+ return simplePlural
+}
+
+type byInitialism []string
+
+func (s byInitialism) Len() int {
+ return len(s)
+}
+func (s byInitialism) Swap(i, j int) {
+ s[i], s[j] = s[j], s[i]
+}
+
+// Less specifies the order in which initialisms are prioritized:
+// 1. match longest first
+// 2. when equal length, match in reverse lexicographical order, lower case match comes first
+func (s byInitialism) Less(i, j int) bool {
+ if len(s[i]) != len(s[j]) {
+ return len(s[i]) < len(s[j])
+ }
+
+ return s[i] < s[j]
+}
+
+func asRunes(in []string) [][]rune {
+ out := make([][]rune, len(in))
+ for i, initialism := range in {
+ out[i] = []rune(initialism)
+ }
+
+ return out
+}
+
+func asUpperCased(in []string) [][]rune {
+ out := make([][]rune, len(in))
+
+ for i, initialism := range in {
+ out[i] = []rune(upper(trim(initialism)))
+ }
+
+ return out
+}
+
+// asPluralForms bakes an index of pluralization support.
+func asPluralForms(in []string, pluralFunc func(string) pluralForm) []pluralForm {
+ out := make([]pluralForm, len(in))
+ for i, initialism := range in {
+ out[i] = pluralFunc(initialism)
+ }
+
+ return out
+}
diff --git a/vendor/github.com/go-openapi/swag/mangling/name_lexem.go b/vendor/github.com/go-openapi/swag/mangling/name_lexem.go
new file mode 100644
index 000000000..bc837e3b9
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/mangling/name_lexem.go
@@ -0,0 +1,186 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package mangling
+
+import (
+ "bytes"
+ "strings"
+ "unicode"
+ "unicode/utf8"
+)
+
+type (
+ lexemKind uint8
+
+ nameLexem struct {
+ original string
+ matchedInitialism string
+ kind lexemKind
+ }
+)
+
+const (
+ lexemKindCasualName lexemKind = iota
+ lexemKindInitialismName
+)
+
+func newInitialismNameLexem(original, matchedInitialism string) nameLexem {
+ return nameLexem{
+ kind: lexemKindInitialismName,
+ original: original,
+ matchedInitialism: matchedInitialism,
+ }
+}
+
+func newCasualNameLexem(original string) nameLexem {
+ return nameLexem{
+ kind: lexemKindCasualName,
+ original: trim(original), // TODO: save on calls to trim
+ }
+}
+
+// WriteTitleized writes the titleized lexeme to a bytes.Buffer.
+//
+// If the first letter cannot be capitalized, it doesn't write anything and return false,
+// so the caller may attempt some workaround strategy.
+func (l nameLexem) WriteTitleized(w *bytes.Buffer, alwaysUpper bool) bool {
+ if l.kind == lexemKindInitialismName {
+ w.WriteString(l.matchedInitialism)
+
+ return true
+ }
+
+ if len(l.original) == 0 {
+ return true
+ }
+
+ if len(l.original) == 1 {
+ // identifier is too short: casing will depend on the context
+ firstByte := l.original[0]
+ switch {
+ case 'A' <= firstByte && firstByte <= 'Z':
+ // safe
+ w.WriteByte(firstByte)
+
+ return true
+ case alwaysUpper && 'a' <= firstByte && firstByte <= 'z':
+ w.WriteByte(firstByte - 'a' + 'A')
+
+ return true
+ default:
+
+ // not a letter: skip and let the caller decide
+ return false
+ }
+ }
+
+ if firstByte := l.original[0]; firstByte < utf8.RuneSelf {
+ // ASCII
+ switch {
+ case 'A' <= firstByte && firstByte <= 'Z':
+ // already an upper case letter
+ w.WriteString(l.original)
+
+ return true
+ case 'a' <= firstByte && firstByte <= 'z':
+ w.WriteByte(firstByte - 'a' + 'A')
+ w.WriteString(l.original[1:])
+
+ return true
+ default:
+ // not a good candidate: doesn't start with a letter
+ return false
+ }
+ }
+
+ // unicode
+ firstRune, idx := utf8.DecodeRuneInString(l.original)
+ if !unicode.IsLetter(firstRune) || !unicode.IsUpper(unicode.ToUpper(firstRune)) {
+ // not a good candidate: doesn't start with a letter
+ // or a rune for which case doesn't make sense (e.g. East-Asian runes etc)
+ return false
+ }
+
+ rest := l.original[idx:]
+ w.WriteRune(unicode.ToUpper(firstRune))
+ w.WriteString(strings.ToLower(rest))
+
+ return true
+}
+
+// WriteLower is like write titleized but it writes a lower-case version of the lexeme.
+//
+// Similarly, there is no writing if the casing of the first rune doesn't make sense.
+func (l nameLexem) WriteLower(w *bytes.Buffer, alwaysLower bool) bool {
+ if l.kind == lexemKindInitialismName {
+ w.WriteString(lower(l.matchedInitialism))
+
+ return true
+ }
+
+ if len(l.original) == 0 {
+ return true
+ }
+
+ if len(l.original) == 1 {
+ // identifier is too short: casing will depend on the context
+ firstByte := l.original[0]
+ switch {
+ case 'a' <= firstByte && firstByte <= 'z':
+ // safe
+ w.WriteByte(firstByte)
+
+ return true
+ case alwaysLower && 'A' <= firstByte && firstByte <= 'Z':
+ w.WriteByte(firstByte - 'A' + 'a')
+
+ return true
+ default:
+
+ // not a letter: skip and let the caller decide
+ return false
+ }
+ }
+
+ if firstByte := l.original[0]; firstByte < utf8.RuneSelf {
+ // ASCII
+ switch {
+ case 'a' <= firstByte && firstByte <= 'z':
+ // already a lower case letter
+ w.WriteString(l.original)
+
+ return true
+ case 'A' <= firstByte && firstByte <= 'Z':
+ w.WriteByte(firstByte - 'A' + 'a')
+ w.WriteString(l.original[1:])
+
+ return true
+ default:
+ // not a good candidate: doesn't start with a letter
+ return false
+ }
+ }
+
+ // unicode
+ firstRune, idx := utf8.DecodeRuneInString(l.original)
+ if !unicode.IsLetter(firstRune) || !unicode.IsLower(unicode.ToLower(firstRune)) {
+ // not a good candidate: doesn't start with a letter
+ // or a rune for which case doesn't make sense (e.g. East-Asian runes etc)
+ return false
+ }
+
+ rest := l.original[idx:]
+ w.WriteRune(unicode.ToLower(firstRune))
+ w.WriteString(rest)
+
+ return true
+}
+
+func (l nameLexem) GetOriginal() string {
+ return l.original
+}
+
+func (l nameLexem) IsInitialism() bool {
+ return l.kind == lexemKindInitialismName
+}
diff --git a/vendor/github.com/go-openapi/swag/mangling/name_mangler.go b/vendor/github.com/go-openapi/swag/mangling/name_mangler.go
new file mode 100644
index 000000000..da685681d
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/mangling/name_mangler.go
@@ -0,0 +1,370 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package mangling
+
+import (
+ "strings"
+ "unicode"
+)
+
+// NameMangler knows how to transform sentences or words into
+// identifiers that are a better fit in contexts such as:
+//
+// - unexported or exported go variable identifiers
+// - file names
+// - camel cased identifiers
+// - ...
+//
+// The [NameMangler] is safe for concurrent use, save for its [NameMangler.AddInitialisms] method,
+// which is not.
+//
+// # Known limitations
+//
+// At this moment, the [NameMangler] doesn't play well with "all caps" text:
+//
+// unless every single upper-cased word is declared as an initialism, capitalized words would generally
+// not be transformed with the expected result, e.g.
+//
+// ToFileName("THIS_IS_ALL_CAPS")
+//
+// yields the weird outcome
+//
+// "t_h_i_s_i_s_a_l_l_c_a_p_s"
+type NameMangler struct {
+ options
+
+ index *indexOfInitialisms
+
+ splitter splitter
+ splitterWithPostSplit splitter
+
+ _ struct{}
+}
+
+// NewNameMangler builds a name mangler ready to convert strings.
+//
+// The default name mangler is configured with default common initialisms and all default options.
+func NewNameMangler(opts ...Option) NameMangler {
+ m := NameMangler{
+ options: optionsWithDefaults(opts),
+ index: newIndexOfInitialisms(),
+ }
+ m.addInitialisms(m.commonInitialisms...)
+
+ // a splitter that returns matches lexemes as ready-to-assemble strings:
+ // details of the lexemes are redeemed.
+ m.splitter = newSplitter(
+ withInitialismsCache(&m.index.initialismsCache),
+ withReplaceFunc(m.replaceFunc),
+ )
+
+ // a splitter that returns matches lexemes ready for post-processing
+ m.splitterWithPostSplit = newSplitter(
+ withInitialismsCache(&m.index.initialismsCache),
+ withReplaceFunc(m.replaceFunc),
+ withPostSplitInitialismCheck,
+ )
+
+ return m
+}
+
+// AddInitialisms declares extra initialisms to the mangler.
+//
+// It declares extra words as "initialisms" (i.e. words that won't be camel cased or titled cased),
+// on top of the existing list of common initialisms (such as ID, HTTP...).
+//
+// Added words must start with a (unicode) letter. If some don't, they are ignored.
+// Added words are either fully capitalized or mixed-cased. Lower-case only words are considered capitalized.
+//
+// It is typically used just after initializing the [NameMangler].
+//
+// When all initialisms are known at the time the mangler is initialized, it is preferable to
+// use [NewNameMangler] with the option [WithAdditionalInitialisms].
+//
+// Adding initialisms mutates the mangler and should not be carried out concurrently with other calls to the mangler.
+func (m *NameMangler) AddInitialisms(words ...string) {
+ m.addInitialisms(words...)
+}
+
+// Initialisms renders the list of initialisms supported by this mangler.
+func (m *NameMangler) Initialisms() []string {
+ return m.index.initialisms
+}
+
+// Camelize a single word.
+//
+// Example:
+//
+// - "HELLO" and "hello" become "Hello".
+func (m NameMangler) Camelize(word string) string {
+ ru := []rune(word)
+
+ switch len(ru) {
+ case 0:
+ return ""
+ case 1:
+ return string(unicode.ToUpper(ru[0]))
+ default:
+ camelized := poolOfBuffers.BorrowBuffer(len(word))
+ camelized.Grow(len(word))
+ defer func() {
+ poolOfBuffers.RedeemBuffer(camelized)
+ }()
+
+ camelized.WriteRune(unicode.ToUpper(ru[0]))
+ for _, ru := range ru[1:] {
+ camelized.WriteRune(unicode.ToLower(ru))
+ }
+
+ return camelized.String()
+ }
+}
+
+// ToFileName generates a suitable snake-case file name from a sentence.
+//
+// It lower-cases everything with underscore (_) as a word separator.
+//
+// Examples:
+//
+// - "Hello, Swagger" becomes "hello_swagger"
+// - "HelloSwagger" becomes "hello_swagger"
+func (m NameMangler) ToFileName(name string) string {
+ inptr := m.split(name)
+ in := *inptr
+ out := make([]string, 0, len(in))
+
+ for _, w := range in {
+ out = append(out, lower(w))
+ }
+ poolOfStrings.RedeemStrings(inptr)
+
+ return strings.Join(out, "_")
+}
+
+// ToCommandName generates a suitable CLI command name from a sentence.
+//
+// It lower-cases everything with dash (-) as a word separator.
+//
+// Examples:
+//
+// - "Hello, Swagger" becomes "hello-swagger"
+// - "HelloSwagger" becomes "hello-swagger"
+func (m NameMangler) ToCommandName(name string) string {
+ inptr := m.split(name)
+ in := *inptr
+ out := make([]string, 0, len(in))
+
+ for _, w := range in {
+ out = append(out, lower(w))
+ }
+ poolOfStrings.RedeemStrings(inptr)
+
+ return strings.Join(out, "-")
+}
+
+// ToHumanNameLower represents a code name as a human-readable series of words.
+//
+// It lower-cases everything with blank space as a word separator.
+//
+// NOTE: parts recognized as initialisms just keep their original casing.
+//
+// Examples:
+//
+// - "Hello, Swagger" becomes "hello swagger"
+// - "HelloSwagger" or "Hello-Swagger" become "hello swagger"
+func (m NameMangler) ToHumanNameLower(name string) string {
+ s := m.splitterWithPostSplit
+ in := s.split(name)
+ out := make([]string, 0, len(*in))
+
+ for _, w := range *in {
+ if !w.IsInitialism() {
+ out = append(out, lower(w.GetOriginal()))
+ } else {
+ out = append(out, trim(w.GetOriginal()))
+ }
+ }
+
+ poolOfLexems.RedeemLexems(in)
+
+ return strings.Join(out, " ")
+}
+
+// ToHumanNameTitle represents a code name as a human-readable series of titleized words.
+//
+// It titleizes every word with blank space as a word separator.
+//
+// Examples:
+//
+// - "hello, Swagger" becomes "Hello Swagger"
+// - "helloSwagger" becomes "Hello Swagger"
+func (m NameMangler) ToHumanNameTitle(name string) string {
+ s := m.splitterWithPostSplit
+ in := s.split(name)
+
+ out := make([]string, 0, len(*in))
+ for _, w := range *in {
+ original := trim(w.GetOriginal())
+ if !w.IsInitialism() {
+ out = append(out, m.Camelize(original))
+ } else {
+ out = append(out, original)
+ }
+ }
+ poolOfLexems.RedeemLexems(in)
+
+ return strings.Join(out, " ")
+}
+
+// ToJSONName generates a camelized single-word version of a sentence.
+//
+// The output assembles every camelized word, but for the first word, which
+// is lower-cased.
+//
+// Example:
+//
+// - "Hello_swagger" becomes "helloSwagger"
+func (m NameMangler) ToJSONName(name string) string {
+ inptr := m.split(name)
+ in := *inptr
+ out := make([]string, 0, len(in))
+
+ for i, w := range in {
+ if i == 0 {
+ out = append(out, lower(w))
+ continue
+ }
+ out = append(out, m.Camelize(trim(w)))
+ }
+
+ poolOfStrings.RedeemStrings(inptr)
+
+ return strings.Join(out, "")
+}
+
+// ToVarName generates a legit unexported go variable name from a sentence.
+//
+// The generated name plays well with linters (see also [NameMangler.ToGoName]).
+//
+// Examples:
+//
+// - "Hello_swagger" becomes "helloSwagger"
+// - "Http_server" becomes "httpServer"
+//
+// This name applies the same rules as [NameMangler.ToGoName] (legit exported variable), save the
+// capitalization of the initial rune.
+//
+// Special case: when the initial part is a recognized as an initialism (like in the example above),
+// the full part is lower-cased.
+func (m NameMangler) ToVarName(name string) string {
+ return m.goIdentifier(name, false)
+}
+
+// ToGoName generates a legit exported go variable name from a sentence.
+//
+// The generated name plays well with most linters.
+//
+// ToGoName abides by the go "exported" symbol rule starting with an upper-case letter.
+//
+// Examples:
+//
+// - "hello_swagger" becomes "HelloSwagger"
+// - "Http_server" becomes "HTTPServer"
+//
+// # Edge cases
+//
+// Whenever the first rune is not eligible to upper case, a special prefix is prepended to the resulting name.
+// By default this is simply "X" and you may customize this behavior using the [WithGoNamePrefixFunc] option.
+//
+// This happens when the first rune is not a letter, e.g. a digit, or a symbol that has no word transliteration
+// (see also [WithReplaceFunc] about symbol transliterations),
+// as well as for most East Asian or Devanagari runes, for which there is no such concept as upper-case.
+//
+// # Linting
+//
+// [revive], the successor of golint is the reference linter.
+//
+// This means that [NameMangler.ToGoName] supports the initialisms that revive checks (see also [DefaultInitialisms]).
+//
+// At this moment, there is no attempt to transliterate unicode into ascii, meaning that some linters
+// (e.g. asciicheck, gosmopolitan) may croak on go identifiers generated from unicode input.
+//
+// [revive]: https://github.com/mgechev/revive
+func (m NameMangler) ToGoName(name string) string {
+ return m.goIdentifier(name, true)
+}
+
+func (m NameMangler) goIdentifier(name string, exported bool) string {
+ s := m.splitterWithPostSplit
+ lexems := s.split(name)
+ defer func() {
+ poolOfLexems.RedeemLexems(lexems)
+ }()
+ lexemes := *lexems
+
+ if len(lexemes) == 0 {
+ return ""
+ }
+
+ result := poolOfBuffers.BorrowBuffer(len(name))
+ defer func() {
+ poolOfBuffers.RedeemBuffer(result)
+ }()
+
+ firstPart := lexemes[0]
+ if !exported {
+ if ok := firstPart.WriteLower(result, true); !ok {
+ // NOTE: an initialism as the first part is lower-cased: no longer generates stuff like hTTPxyz.
+ //
+ // same prefixing rule applied to unexported variable as to an exported one, so that we have consistent
+ // names, whether the generated identifier is exported or not.
+ result.WriteString(strings.ToLower(m.prefixFunc()(name)))
+ result.WriteString(lexemes[0].GetOriginal())
+ }
+ } else {
+ if ok := firstPart.WriteTitleized(result, true); !ok {
+ // "repairs" a lexeme that doesn't start with a letter to become
+ // the start a legit go name. The current strategy is very crude and simply adds a fixed prefix,
+ // e.g. "X".
+ // For instance "1_sesame_street" would be split into lexemes ["1", "sesame", "street"] and
+ // the first one ("1") would result in something like "X1" (with the default prefix function).
+ //
+ // NOTE: no longer forcing the first part to be fully upper-cased
+ result.WriteString(m.prefixFunc()(name))
+ result.WriteString(lexemes[0].GetOriginal())
+ }
+ }
+
+ for _, lexem := range lexemes[1:] {
+ // NOTE: no longer forcing initialism parts to be fully upper-cased:
+ // * pluralized initialism preserve their trailing "s"
+ // * mixed-cased initialisms, such as IPv4, are preserved
+ if ok := lexem.WriteTitleized(result, false); !ok {
+ // it's not titleized: perhaps it's too short, perhaps the first rune is not a letter.
+ // write anyway
+ result.WriteString(lexem.GetOriginal())
+ }
+ }
+
+ return result.String()
+}
+
+func (m *NameMangler) addInitialisms(words ...string) {
+ m.index.add(words...)
+ m.index.buildCache()
+}
+
+// split calls the inner splitter.
+func (m NameMangler) split(str string) *[]string {
+ s := m.splitter
+ lexems := s.split(str)
+ result := poolOfStrings.BorrowStrings()
+
+ for _, lexem := range *lexems {
+ *result = append(*result, lexem.GetOriginal())
+ }
+ poolOfLexems.RedeemLexems(lexems)
+
+ return result
+}
diff --git a/vendor/github.com/go-openapi/swag/mangling/options.go b/vendor/github.com/go-openapi/swag/mangling/options.go
new file mode 100644
index 000000000..3c92b2f18
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/mangling/options.go
@@ -0,0 +1,150 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package mangling
+
+type (
+ // PrefixFunc defines a safeguard rule (that may depend on the input string), to prefix
+ // a generated go name (in [NameMangler.ToGoName] and [NameMangler.ToVarName]).
+ //
+ // See [NameMangler.ToGoName] for more about which edge cases the prefix function covers.
+ PrefixFunc func(string) string
+
+ // ReplaceFunc is a transliteration function to replace special runes by a word.
+ ReplaceFunc func(r rune) (string, bool)
+
+ // Option to configure a [NameMangler].
+ Option func(*options)
+
+ options struct {
+ commonInitialisms []string
+
+ goNamePrefixFunc PrefixFunc
+ goNamePrefixFuncPtr *PrefixFunc
+ replaceFunc func(r rune) (string, bool)
+ }
+)
+
+func (o *options) prefixFunc() PrefixFunc {
+ if o.goNamePrefixFuncPtr != nil && *o.goNamePrefixFuncPtr != nil {
+ return *o.goNamePrefixFuncPtr
+ }
+
+ return o.goNamePrefixFunc
+}
+
+// WithGoNamePrefixFunc overrides the default prefix rule to safeguard generated go names.
+//
+// Example:
+//
+// This helps convert "123" into "{prefix}123" (a very crude strategy indeed, but it works).
+//
+// See [github.com/go-swagger/go-swagger/generator.DefaultFuncMap] for an example.
+//
+// The prefix function is assumed to return a string that starts with an upper case letter.
+//
+// The default is to prefix with "X".
+//
+// See [NameMangler.ToGoName] for more about which edge cases the prefix function covers.
+func WithGoNamePrefixFunc(fn PrefixFunc) Option {
+ return func(o *options) {
+ o.goNamePrefixFunc = fn
+ }
+}
+
+// WithGoNamePrefixFuncPtr is like [WithGoNamePrefixFunc] but it specifies a pointer to a function.
+//
+// [WithGoNamePrefixFunc] should be preferred in most situations. This option should only serve the
+// purpose of handling special situations where the prefix function is not an internal variable
+// (e.g. an exported package global).
+//
+// [WithGoNamePrefixFuncPtr] supersedes [WithGoNamePrefixFunc] if it also specified.
+//
+// If the provided pointer is nil or points to a nil value, this option has no effect.
+//
+// The caller should ensure that no undesirable concurrent changes are applied to the function pointed to.
+func WithGoNamePrefixFuncPtr(ptr *PrefixFunc) Option {
+ return func(o *options) {
+ o.goNamePrefixFuncPtr = ptr
+ }
+}
+
+// WithInitialisms declares the initialisms this mangler supports.
+//
+// This supersedes any pre-loaded defaults (see [DefaultInitialisms] for more about what initialisms are).
+//
+// It declares words to be recognized as "initialisms" (i.e. words that won't be camel cased or titled cased).
+//
+// Words must start with a (unicode) letter. If some don't, they are ignored.
+// Words are either fully capitalized or mixed-cased. Lower-case only words are considered capitalized.
+func WithInitialisms(words ...string) Option {
+ return func(o *options) {
+ o.commonInitialisms = words
+ }
+}
+
+// WithAdditionalInitialisms adds new initialisms to the currently supported list (see [DefaultInitialisms]).
+//
+// The same sanitization rules apply as those described for [WithInitialisms].
+func WithAdditionalInitialisms(words ...string) Option {
+ return func(o *options) {
+ o.commonInitialisms = append(o.commonInitialisms, words...)
+ }
+}
+
+// WithReplaceFunc specifies a custom transliteration function instead of the default.
+//
+// The default translates the following characters into words as follows:
+//
+// - '@' -> 'At'
+// - '&' -> 'And'
+// - '|' -> 'Pipe'
+// - '$' -> 'Dollar'
+// - '!' -> 'Bang'
+//
+// Notice that the outcome of a transliteration should always be titleized.
+func WithReplaceFunc(fn ReplaceFunc) Option {
+ return func(o *options) {
+ o.replaceFunc = fn
+ }
+}
+
+func defaultPrefixFunc(_ string) string {
+ return "X"
+}
+
+// defaultReplaceTable finds a word representation for special characters.
+func defaultReplaceTable(r rune) (string, bool) {
+ switch r {
+ case '@':
+ return "At ", true
+ case '&':
+ return "And ", true
+ case '|':
+ return "Pipe ", true
+ case '$':
+ return "Dollar ", true
+ case '!':
+ return "Bang ", true
+ case '-':
+ return "", true
+ case '_':
+ return "", true
+ default:
+ return "", false
+ }
+}
+
+func optionsWithDefaults(opts []Option) options {
+ o := options{
+ commonInitialisms: DefaultInitialisms(),
+ goNamePrefixFunc: defaultPrefixFunc,
+ replaceFunc: defaultReplaceTable,
+ }
+
+ for _, apply := range opts {
+ apply(&o)
+ }
+
+ return o
+}
diff --git a/vendor/github.com/go-openapi/swag/mangling/pools.go b/vendor/github.com/go-openapi/swag/mangling/pools.go
new file mode 100644
index 000000000..f81043514
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/mangling/pools.go
@@ -0,0 +1,123 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package mangling
+
+import (
+ "bytes"
+ "sync"
+)
+
+const maxAllocMatches = 8
+
+type (
+ // memory pools of temporary objects.
+ //
+ // These are used to recycle temporarily allocated objects
+ // and relieve the GC from undue pressure.
+
+ matchesPool struct {
+ *sync.Pool
+ }
+
+ buffersPool struct {
+ *sync.Pool
+ }
+
+ lexemsPool struct {
+ *sync.Pool
+ }
+
+ stringsPool struct {
+ *sync.Pool
+ }
+)
+
+var (
+ // poolOfMatches holds temporary slices for recycling during the initialism match process
+ poolOfMatches = matchesPool{
+ Pool: &sync.Pool{
+ New: func() any {
+ s := make(initialismMatches, 0, maxAllocMatches)
+
+ return &s
+ },
+ },
+ }
+
+ poolOfBuffers = buffersPool{
+ Pool: &sync.Pool{
+ New: func() any {
+ return new(bytes.Buffer)
+ },
+ },
+ }
+
+ poolOfLexems = lexemsPool{
+ Pool: &sync.Pool{
+ New: func() any {
+ s := make([]nameLexem, 0, maxAllocMatches)
+
+ return &s
+ },
+ },
+ }
+
+ poolOfStrings = stringsPool{
+ Pool: &sync.Pool{
+ New: func() any {
+ s := make([]string, 0, maxAllocMatches)
+
+ return &s
+ },
+ },
+ }
+)
+
+func (p matchesPool) BorrowMatches() *initialismMatches {
+ s := p.Get().(*initialismMatches)
+ *s = (*s)[:0] // reset slice, keep allocated capacity
+
+ return s
+}
+
+func (p buffersPool) BorrowBuffer(size int) *bytes.Buffer {
+ s := p.Get().(*bytes.Buffer)
+ s.Reset()
+
+ if s.Cap() < size {
+ s.Grow(size)
+ }
+
+ return s
+}
+
+func (p lexemsPool) BorrowLexems() *[]nameLexem {
+ s := p.Get().(*[]nameLexem)
+ *s = (*s)[:0] // reset slice, keep allocated capacity
+
+ return s
+}
+
+func (p stringsPool) BorrowStrings() *[]string {
+ s := p.Get().(*[]string)
+ *s = (*s)[:0] // reset slice, keep allocated capacity
+
+ return s
+}
+
+func (p matchesPool) RedeemMatches(s *initialismMatches) {
+ p.Put(s)
+}
+
+func (p buffersPool) RedeemBuffer(s *bytes.Buffer) {
+ p.Put(s)
+}
+
+func (p lexemsPool) RedeemLexems(s *[]nameLexem) {
+ p.Put(s)
+}
+
+func (p stringsPool) RedeemStrings(s *[]string) {
+ p.Put(s)
+}
diff --git a/vendor/github.com/go-openapi/swag/mangling/split.go b/vendor/github.com/go-openapi/swag/mangling/split.go
new file mode 100644
index 000000000..ed12ea256
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/mangling/split.go
@@ -0,0 +1,341 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package mangling
+
+import (
+ "fmt"
+ "unicode"
+)
+
+type splitterOption func(*splitter)
+
+// withPostSplitInitialismCheck allows to catch initialisms after main split process
+func withPostSplitInitialismCheck(s *splitter) {
+ s.postSplitInitialismCheck = true
+}
+
+func withReplaceFunc(fn ReplaceFunc) func(*splitter) {
+ return func(s *splitter) {
+ s.replaceFunc = fn
+ }
+}
+
+func withInitialismsCache(c *initialismsCache) splitterOption {
+ return func(s *splitter) {
+ s.initialismsCache = c
+ }
+}
+
+type (
+ initialismMatch struct {
+ body []rune
+ start, end int
+ complete bool
+ hasPlural pluralForm
+ }
+ initialismMatches []initialismMatch
+)
+
+// String representation of a match, e.g. for debugging.
+func (m initialismMatch) String() string {
+ return fmt.Sprintf("{body: %s (%d), start: %d, end; %d, complete: %t, hasPlural: %v}",
+ string(m.body), len(m.body), m.start, m.end, m.complete, m.hasPlural,
+ )
+}
+
+func (m initialismMatch) isZero() bool {
+ return m.start == 0 && m.end == 0
+}
+
+type splitter struct {
+ *initialismsCache
+
+ postSplitInitialismCheck bool
+ replaceFunc ReplaceFunc
+}
+
+func newSplitter(options ...splitterOption) splitter {
+ var s splitter
+
+ for _, option := range options {
+ option(&s)
+ }
+
+ if s.replaceFunc == nil {
+ s.replaceFunc = defaultReplaceTable
+ }
+
+ return s
+}
+
+func (s splitter) split(name string) *[]nameLexem {
+ nameRunes := []rune(name)
+ matches := s.gatherInitialismMatches(nameRunes)
+ if matches == nil {
+ return poolOfLexems.BorrowLexems()
+ }
+
+ return s.mapMatchesToNameLexems(nameRunes, matches)
+}
+
+func (s splitter) gatherInitialismMatches(nameRunes []rune) *initialismMatches {
+ matches := poolOfMatches.BorrowMatches()
+ const minLenInitialism = 1
+ if len(nameRunes) < minLenInitialism+1 {
+ // can't match initialism with 0 or 1 rune
+ return matches
+ }
+
+ // first iteration
+ s.findMatches(matches, nameRunes, nameRunes[0], 0)
+
+ for i, currentRune := range nameRunes[1:] {
+ currentRunePosition := i + 1
+ // recycle allocations as we loop over runes
+ // with such recycling, only 2 slices should be allocated per call
+ // instead of o(n).
+ //
+ // BorrowMatches always yields slices with zero length (with some capacity)
+ newMatches := poolOfMatches.BorrowMatches()
+
+ // check current initialism matches
+ for _, match := range *matches {
+ if keepCompleteMatch := match.complete; keepCompleteMatch {
+ // the match is already complete: keep it then move on to the next match
+ *newMatches = append(*newMatches, match)
+ continue
+ }
+
+ if currentRunePosition-match.start == len(match.body) {
+ // unmatched: skip
+ continue
+ }
+
+ // 1. by construction of the matches, we can't have currentRunePosition - match.start < 0
+ // because matches have been computed with their start <= currentRunePosition in the previous
+ // iterations.
+ // 2. by construction of the matches, we can't have currentRunePosition - match.start >= len(match.body)
+
+ currentMatchRune := match.body[currentRunePosition-match.start]
+ if currentMatchRune != currentRune {
+ // failed match, discard it then move on to the next match
+ continue
+ }
+
+ // try to complete the current match
+ if currentRunePosition-match.start == len(match.body)-1 {
+ // we are close: the next step is to check the symbol ahead
+ // if it is a lowercase letter, then it is not the end of match
+ // but the beginning of the next word.
+ //
+ // NOTE(fredbi): this heuristic sometimes leads to counterintuitive splits and
+ // perhaps (not sure yet) we should check against case _alternance_.
+ //
+ // Example:
+ //
+ // In the current version, in the sentence "IDS initialism", "ID" is recognized as an initialism,
+ // leading to a split like "id_s_initialism" (or IDSInitialism),
+ // whereas in the sentence "IDx initialism", it is not and produces something like
+ // "i_d_x_initialism" (or IDxInitialism). The generated file name is not great.
+ //
+ // Both go identifiers are tolerated by linters.
+ //
+ // Notice that the slightly different input "IDs initialism" is correctly detected
+ // as a pluralized initialism and produces something like "ids_initialism" (or IDsInitialism).
+
+ if currentRunePosition < len(nameRunes)-1 { // when before the last rune
+ nextRune := nameRunes[currentRunePosition+1]
+
+ // recognize a plural form for this initialism (only simple english pluralization is supported).
+ if nextRune == 's' && match.hasPlural == simplePlural {
+ // detected a pluralized initialism
+ match.body = append(match.body, nextRune)
+ lookAhead := currentRunePosition + 1
+ if lookAhead < len(nameRunes)-1 {
+ nextRune = nameRunes[lookAhead+1]
+ if newWord := unicode.IsLower(nextRune); newWord {
+ // it is the start of a new word.
+ // Match is only partial and the initialism is not recognized:
+ // move on to the next match, but do not advance the rune position
+ continue
+ }
+ }
+
+ // this is a pluralized match: keep it
+ currentRunePosition++
+ match.complete = true
+ match.hasPlural = simplePlural
+ match.end = currentRunePosition
+ *newMatches = append(*newMatches, match)
+
+ // match is complete: keep it then move on to the next match
+ continue
+ }
+
+ // other cases
+ // example: invariant plural such as "TLS"
+ if newWord := unicode.IsLower(nextRune); newWord {
+ // it is the start of a new word
+ // Match is only partial and the initialism is not recognized : move on
+ continue
+ }
+ }
+
+ match.complete = true
+ match.end = currentRunePosition
+ }
+
+ // append the ongoing matching attempt: it is not necessarily complete, but was successful so far.
+ // Let's see if it still matches on the next rune.
+ *newMatches = append(*newMatches, match)
+ }
+
+ s.findMatches(newMatches, nameRunes, currentRune, currentRunePosition)
+
+ poolOfMatches.RedeemMatches(matches)
+ matches = newMatches
+ }
+
+ // it is up to the caller to redeem this last slice
+ return matches
+}
+
+func (s splitter) findMatches(newMatches *initialismMatches, nameRunes []rune, currentRune rune, currentRunePosition int) {
+ // check for new initialism matches, based on the first character
+ for i, r := range s.initialismsRunes {
+ if r[0] != currentRune {
+ continue
+ }
+
+ if currentRunePosition+len(r) > len(nameRunes) {
+ continue // not eligible: would spilll over the initial string
+ }
+
+ // possible matches: all initialisms starting with the current rune and that can fit the given string (nameRunes)
+ *newMatches = append(*newMatches, initialismMatch{
+ start: currentRunePosition,
+ body: r,
+ complete: false,
+ hasPlural: s.initialismsPluralForm[i],
+ })
+ }
+}
+
+func (s splitter) mapMatchesToNameLexems(nameRunes []rune, matches *initialismMatches) *[]nameLexem {
+ nameLexems := poolOfLexems.BorrowLexems()
+
+ var lastAcceptedMatch initialismMatch
+ for _, match := range *matches {
+ if !match.complete {
+ continue
+ }
+
+ if firstMatch := lastAcceptedMatch.isZero(); firstMatch {
+ s.appendBrokenDownCasualString(nameLexems, nameRunes[:match.start])
+ *nameLexems = append(*nameLexems, s.breakInitialism(string(match.body)))
+
+ lastAcceptedMatch = match
+
+ continue
+ }
+
+ if overlappedMatch := match.start <= lastAcceptedMatch.end; overlappedMatch {
+ continue
+ }
+
+ middle := nameRunes[lastAcceptedMatch.end+1 : match.start]
+ s.appendBrokenDownCasualString(nameLexems, middle)
+ *nameLexems = append(*nameLexems, s.breakInitialism(string(match.body)))
+
+ lastAcceptedMatch = match
+ }
+
+ // we have not found any accepted matches
+ if lastAcceptedMatch.isZero() {
+ *nameLexems = (*nameLexems)[:0]
+ s.appendBrokenDownCasualString(nameLexems, nameRunes)
+ } else if lastAcceptedMatch.end+1 != len(nameRunes) {
+ rest := nameRunes[lastAcceptedMatch.end+1:]
+ s.appendBrokenDownCasualString(nameLexems, rest)
+ }
+
+ poolOfMatches.RedeemMatches(matches)
+
+ return nameLexems
+}
+
+func (s splitter) breakInitialism(original string) nameLexem {
+ return newInitialismNameLexem(original, original)
+}
+
+func (s splitter) appendBrokenDownCasualString(segments *[]nameLexem, str []rune) {
+ currentSegment := poolOfBuffers.BorrowBuffer(len(str)) // unlike strings.Builder, bytes.Buffer initial storage can reused
+ defer func() {
+ poolOfBuffers.RedeemBuffer(currentSegment)
+ }()
+
+ addCasualNameLexem := func(original string) {
+ *segments = append(*segments, newCasualNameLexem(original))
+ }
+
+ addInitialismNameLexem := func(original, match string) {
+ *segments = append(*segments, newInitialismNameLexem(original, match))
+ }
+
+ var addNameLexem func(string)
+ if s.postSplitInitialismCheck {
+ addNameLexem = func(original string) {
+ for i := range s.initialisms {
+ if isEqualFoldIgnoreSpace(s.initialismsUpperCased[i], original) {
+ addInitialismNameLexem(original, s.initialisms[i])
+
+ return
+ }
+ }
+
+ addCasualNameLexem(original)
+ }
+ } else {
+ addNameLexem = addCasualNameLexem
+ }
+
+ // NOTE: (performance). The few remaining non-amortized allocations
+ // lay in the code below: using String() forces
+ for _, rn := range str {
+ if replace, found := s.replaceFunc(rn); found {
+ if currentSegment.Len() > 0 {
+ addNameLexem(currentSegment.String())
+ currentSegment.Reset()
+ }
+
+ if replace != "" {
+ addNameLexem(replace)
+ }
+
+ continue
+ }
+
+ if !unicode.In(rn, unicode.L, unicode.M, unicode.N, unicode.Pc) {
+ if currentSegment.Len() > 0 {
+ addNameLexem(currentSegment.String())
+ currentSegment.Reset()
+ }
+
+ continue
+ }
+
+ if unicode.IsUpper(rn) {
+ if currentSegment.Len() > 0 {
+ addNameLexem(currentSegment.String())
+ }
+ currentSegment.Reset()
+ }
+
+ currentSegment.WriteRune(rn)
+ }
+
+ if currentSegment.Len() > 0 {
+ addNameLexem(currentSegment.String())
+ }
+}
diff --git a/vendor/github.com/go-openapi/swag/mangling/string_bytes.go b/vendor/github.com/go-openapi/swag/mangling/string_bytes.go
new file mode 100644
index 000000000..28daaf72b
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/mangling/string_bytes.go
@@ -0,0 +1,11 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package mangling
+
+import "unsafe"
+
+// hackStringBytes returns the (unsafe) underlying bytes slice of a string.
+func hackStringBytes(str string) []byte {
+ return unsafe.Slice(unsafe.StringData(str), len(str))
+}
diff --git a/vendor/github.com/go-openapi/swag/mangling/util.go b/vendor/github.com/go-openapi/swag/mangling/util.go
new file mode 100644
index 000000000..0636417e3
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/mangling/util.go
@@ -0,0 +1,118 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package mangling
+
+import (
+ "strings"
+ "unicode"
+ "unicode/utf8"
+)
+
+// Removes leading whitespaces
+func trim(str string) string { return strings.TrimSpace(str) }
+
+// upper is strings.ToUpper() combined with trim
+func upper(str string) string {
+ return strings.ToUpper(trim(str))
+}
+
+// lower is strings.ToLower() combined with trim
+func lower(str string) string {
+ return strings.ToLower(trim(str))
+}
+
+// isEqualFoldIgnoreSpace is the same as strings.EqualFold, but
+// it ignores leading and trailing blank spaces in the compared
+// string.
+//
+// base is assumed to be composed of upper-cased runes, and be already
+// trimmed.
+//
+// This code is heavily inspired from strings.EqualFold.
+func isEqualFoldIgnoreSpace(base []rune, str string) bool {
+ var i, baseIndex int
+ // equivalent to b := []byte(str), but without data copy
+ b := hackStringBytes(str)
+
+ for i < len(b) {
+ if c := b[i]; c < utf8.RuneSelf {
+ // fast path for ASCII
+ if c != ' ' && c != '\t' {
+ break
+ }
+ i++
+
+ continue
+ }
+
+ // unicode case
+ r, size := utf8.DecodeRune(b[i:])
+ if !unicode.IsSpace(r) {
+ break
+ }
+ i += size
+ }
+
+ if i >= len(b) {
+ return len(base) == 0
+ }
+
+ for _, baseRune := range base {
+ if i >= len(b) {
+ break
+ }
+
+ if c := b[i]; c < utf8.RuneSelf {
+ // single byte rune case (ASCII)
+ if baseRune >= utf8.RuneSelf {
+ return false
+ }
+
+ baseChar := byte(baseRune)
+ if c != baseChar && ((c < 'a') || (c > 'z') || (c-'a'+'A' != baseChar)) {
+ return false
+ }
+
+ baseIndex++
+ i++
+
+ continue
+ }
+
+ // unicode case
+ r, size := utf8.DecodeRune(b[i:])
+ if unicode.ToUpper(r) != baseRune {
+ return false
+ }
+ baseIndex++
+ i += size
+ }
+
+ if baseIndex != len(base) {
+ return false
+ }
+
+ // all passed: now we should only have blanks
+ for i < len(b) {
+ if c := b[i]; c < utf8.RuneSelf {
+ // fast path for ASCII
+ if c != ' ' && c != '\t' {
+ return false
+ }
+ i++
+
+ continue
+ }
+
+ // unicode case
+ r, size := utf8.DecodeRune(b[i:])
+ if !unicode.IsSpace(r) {
+ return false
+ }
+
+ i += size
+ }
+
+ return true
+}
diff --git a/vendor/github.com/go-openapi/swag/mangling_iface.go b/vendor/github.com/go-openapi/swag/mangling_iface.go
new file mode 100644
index 000000000..98b9a9992
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/mangling_iface.go
@@ -0,0 +1,69 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package swag
+
+import "github.com/go-openapi/swag/mangling"
+
+// GoNamePrefixFunc sets an optional rule to prefix go names
+// which do not start with a letter.
+//
+// GoNamePrefixFunc should not be written to while concurrently using the other mangling functions of this package.
+//
+// Deprecated: use [mangling.WithGoNamePrefixFunc] instead.
+var GoNamePrefixFunc mangling.PrefixFunc
+
+// swagNameMangler is a global instance of the name mangler specifically alloted
+// to support deprecated functions.
+var swagNameMangler = mangling.NewNameMangler(
+ mangling.WithGoNamePrefixFuncPtr(&GoNamePrefixFunc),
+)
+
+// AddInitialisms adds additional initialisms to the default list (see [mangling.DefaultInitialisms]).
+//
+// AddInitialisms is not safe to be called concurrently.
+//
+// Deprecated: use [mangling.WithAdditionalInitialisms] instead.
+func AddInitialisms(words ...string) {
+ swagNameMangler.AddInitialisms(words...)
+}
+
+// Camelize a single word.
+//
+// Deprecated: use [mangling.NameMangler.Camelize] instead.
+func Camelize(word string) string { return swagNameMangler.Camelize(word) }
+
+// ToFileName lowercases and underscores a go type name.
+//
+// Deprecated: use [mangling.NameMangler.ToFileName] instead.
+func ToFileName(name string) string { return swagNameMangler.ToFileName(name) }
+
+// ToCommandName lowercases and underscores a go type name.
+//
+// Deprecated: use [mangling.NameMangler.ToCommandName] instead.
+func ToCommandName(name string) string { return swagNameMangler.ToCommandName(name) }
+
+// ToHumanNameLower represents a code name as a human series of words.
+//
+// Deprecated: use [mangling.NameMangler.ToHumanNameLower] instead.
+func ToHumanNameLower(name string) string { return swagNameMangler.ToHumanNameLower(name) }
+
+// ToHumanNameTitle represents a code name as a human series of words with the first letters titleized.
+//
+// Deprecated: use [mangling.NameMangler.ToHumanNameTitle] instead.
+func ToHumanNameTitle(name string) string { return swagNameMangler.ToHumanNameTitle(name) }
+
+// ToJSONName camel-cases a name which can be underscored or pascal-cased.
+//
+// Deprecated: use [mangling.NameMangler.ToJSONName] instead.
+func ToJSONName(name string) string { return swagNameMangler.ToJSONName(name) }
+
+// ToVarName camel-cases a name which can be underscored or pascal-cased.
+//
+// Deprecated: use [mangling.NameMangler.ToVarName] instead.
+func ToVarName(name string) string { return swagNameMangler.ToVarName(name) }
+
+// ToGoName translates a swagger name which can be underscored or camel cased to a name that golint likes.
+//
+// Deprecated: use [mangling.NameMangler.ToGoName] instead.
+func ToGoName(name string) string { return swagNameMangler.ToGoName(name) }
diff --git a/vendor/github.com/go-openapi/swag/name_lexem.go b/vendor/github.com/go-openapi/swag/name_lexem.go
deleted file mode 100644
index 8bb64ac32..000000000
--- a/vendor/github.com/go-openapi/swag/name_lexem.go
+++ /dev/null
@@ -1,93 +0,0 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package swag
-
-import (
- "unicode"
- "unicode/utf8"
-)
-
-type (
- lexemKind uint8
-
- nameLexem struct {
- original string
- matchedInitialism string
- kind lexemKind
- }
-)
-
-const (
- lexemKindCasualName lexemKind = iota
- lexemKindInitialismName
-)
-
-func newInitialismNameLexem(original, matchedInitialism string) nameLexem {
- return nameLexem{
- kind: lexemKindInitialismName,
- original: original,
- matchedInitialism: matchedInitialism,
- }
-}
-
-func newCasualNameLexem(original string) nameLexem {
- return nameLexem{
- kind: lexemKindCasualName,
- original: original,
- }
-}
-
-func (l nameLexem) GetUnsafeGoName() string {
- if l.kind == lexemKindInitialismName {
- return l.matchedInitialism
- }
-
- var (
- first rune
- rest string
- )
-
- for i, orig := range l.original {
- if i == 0 {
- first = orig
- continue
- }
-
- if i > 0 {
- rest = l.original[i:]
- break
- }
- }
-
- if len(l.original) > 1 {
- b := poolOfBuffers.BorrowBuffer(utf8.UTFMax + len(rest))
- defer func() {
- poolOfBuffers.RedeemBuffer(b)
- }()
- b.WriteRune(unicode.ToUpper(first))
- b.WriteString(lower(rest))
- return b.String()
- }
-
- return l.original
-}
-
-func (l nameLexem) GetOriginal() string {
- return l.original
-}
-
-func (l nameLexem) IsInitialism() bool {
- return l.kind == lexemKindInitialismName
-}
diff --git a/vendor/github.com/go-openapi/swag/net.go b/vendor/github.com/go-openapi/swag/net.go
deleted file mode 100644
index 821235f84..000000000
--- a/vendor/github.com/go-openapi/swag/net.go
+++ /dev/null
@@ -1,38 +0,0 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package swag
-
-import (
- "net"
- "strconv"
-)
-
-// SplitHostPort splits a network address into a host and a port.
-// The port is -1 when there is no port to be found
-func SplitHostPort(addr string) (host string, port int, err error) {
- h, p, err := net.SplitHostPort(addr)
- if err != nil {
- return "", -1, err
- }
- if p == "" {
- return "", -1, &net.AddrError{Err: "missing port in address", Addr: addr}
- }
-
- pi, err := strconv.Atoi(p)
- if err != nil {
- return "", -1, err
- }
- return h, pi, nil
-}
diff --git a/vendor/github.com/go-openapi/swag/netutils/LICENSE b/vendor/github.com/go-openapi/swag/netutils/LICENSE
new file mode 100644
index 000000000..d64569567
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/netutils/LICENSE
@@ -0,0 +1,202 @@
+
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright [yyyy] [name of copyright owner]
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
diff --git a/vendor/github.com/go-openapi/swag/netutils/doc.go b/vendor/github.com/go-openapi/swag/netutils/doc.go
new file mode 100644
index 000000000..74282f8e5
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/netutils/doc.go
@@ -0,0 +1,5 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+// Package netutils provides helpers for network-related tasks.
+package netutils
diff --git a/vendor/github.com/go-openapi/swag/netutils/net.go b/vendor/github.com/go-openapi/swag/netutils/net.go
new file mode 100644
index 000000000..82a1544af
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/netutils/net.go
@@ -0,0 +1,31 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package netutils
+
+import (
+ "net"
+ "strconv"
+)
+
+// SplitHostPort splits a network address into a host and a port.
+//
+// The difference with the standard net.SplitHostPort is that the port is converted to an int.
+//
+// The port is -1 when there is no port to be found.
+func SplitHostPort(addr string) (host string, port int, err error) {
+ h, p, err := net.SplitHostPort(addr)
+ if err != nil {
+ return "", -1, err
+ }
+ if p == "" {
+ return "", -1, &net.AddrError{Err: "missing port in address", Addr: addr}
+ }
+
+ pi, err := strconv.Atoi(p)
+ if err != nil {
+ return "", -1, err
+ }
+
+ return h, pi, nil
+}
diff --git a/vendor/github.com/go-openapi/swag/netutils_iface.go b/vendor/github.com/go-openapi/swag/netutils_iface.go
new file mode 100644
index 000000000..d658de25b
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/netutils_iface.go
@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package swag
+
+import "github.com/go-openapi/swag/netutils"
+
+// SplitHostPort splits a network address into a host and a port.
+//
+// Deprecated: use [netutils.SplitHostPort] instead.
+func SplitHostPort(addr string) (host string, port int, err error) {
+ return netutils.SplitHostPort(addr)
+}
diff --git a/vendor/github.com/go-openapi/swag/path.go b/vendor/github.com/go-openapi/swag/path.go
deleted file mode 100644
index 941bd0176..000000000
--- a/vendor/github.com/go-openapi/swag/path.go
+++ /dev/null
@@ -1,59 +0,0 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package swag
-
-import (
- "os"
- "path/filepath"
- "runtime"
- "strings"
-)
-
-const (
- // GOPATHKey represents the env key for gopath
- GOPATHKey = "GOPATH"
-)
-
-// FindInSearchPath finds a package in a provided lists of paths
-func FindInSearchPath(searchPath, pkg string) string {
- pathsList := filepath.SplitList(searchPath)
- for _, path := range pathsList {
- if evaluatedPath, err := filepath.EvalSymlinks(filepath.Join(path, "src", pkg)); err == nil {
- if _, err := os.Stat(evaluatedPath); err == nil {
- return evaluatedPath
- }
- }
- }
- return ""
-}
-
-// FindInGoSearchPath finds a package in the $GOPATH:$GOROOT
-func FindInGoSearchPath(pkg string) string {
- return FindInSearchPath(FullGoSearchPath(), pkg)
-}
-
-// FullGoSearchPath gets the search paths for finding packages
-func FullGoSearchPath() string {
- allPaths := os.Getenv(GOPATHKey)
- if allPaths == "" {
- allPaths = filepath.Join(os.Getenv("HOME"), "go")
- }
- if allPaths != "" {
- allPaths = strings.Join([]string{allPaths, runtime.GOROOT()}, ":")
- } else {
- allPaths = runtime.GOROOT()
- }
- return allPaths
-}
diff --git a/vendor/github.com/go-openapi/swag/split.go b/vendor/github.com/go-openapi/swag/split.go
deleted file mode 100644
index 274727a86..000000000
--- a/vendor/github.com/go-openapi/swag/split.go
+++ /dev/null
@@ -1,508 +0,0 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package swag
-
-import (
- "bytes"
- "sync"
- "unicode"
- "unicode/utf8"
-)
-
-type (
- splitter struct {
- initialisms []string
- initialismsRunes [][]rune
- initialismsUpperCased [][]rune // initialisms cached in their trimmed, upper-cased version
- postSplitInitialismCheck bool
- }
-
- splitterOption func(*splitter)
-
- initialismMatch struct {
- body []rune
- start, end int
- complete bool
- }
- initialismMatches []initialismMatch
-)
-
-type (
- // memory pools of temporary objects.
- //
- // These are used to recycle temporarily allocated objects
- // and relieve the GC from undue pressure.
-
- matchesPool struct {
- *sync.Pool
- }
-
- buffersPool struct {
- *sync.Pool
- }
-
- lexemsPool struct {
- *sync.Pool
- }
-
- splittersPool struct {
- *sync.Pool
- }
-)
-
-var (
- // poolOfMatches holds temporary slices for recycling during the initialism match process
- poolOfMatches = matchesPool{
- Pool: &sync.Pool{
- New: func() any {
- s := make(initialismMatches, 0, maxAllocMatches)
-
- return &s
- },
- },
- }
-
- poolOfBuffers = buffersPool{
- Pool: &sync.Pool{
- New: func() any {
- return new(bytes.Buffer)
- },
- },
- }
-
- poolOfLexems = lexemsPool{
- Pool: &sync.Pool{
- New: func() any {
- s := make([]nameLexem, 0, maxAllocMatches)
-
- return &s
- },
- },
- }
-
- poolOfSplitters = splittersPool{
- Pool: &sync.Pool{
- New: func() any {
- s := newSplitter()
-
- return &s
- },
- },
- }
-)
-
-// nameReplaceTable finds a word representation for special characters.
-func nameReplaceTable(r rune) (string, bool) {
- switch r {
- case '@':
- return "At ", true
- case '&':
- return "And ", true
- case '|':
- return "Pipe ", true
- case '$':
- return "Dollar ", true
- case '!':
- return "Bang ", true
- case '-':
- return "", true
- case '_':
- return "", true
- default:
- return "", false
- }
-}
-
-// split calls the splitter.
-//
-// Use newSplitter for more control and options
-func split(str string) []string {
- s := poolOfSplitters.BorrowSplitter()
- lexems := s.split(str)
- result := make([]string, 0, len(*lexems))
-
- for _, lexem := range *lexems {
- result = append(result, lexem.GetOriginal())
- }
- poolOfLexems.RedeemLexems(lexems)
- poolOfSplitters.RedeemSplitter(s)
-
- return result
-
-}
-
-func newSplitter(options ...splitterOption) splitter {
- s := splitter{
- postSplitInitialismCheck: false,
- initialisms: initialisms,
- initialismsRunes: initialismsRunes,
- initialismsUpperCased: initialismsUpperCased,
- }
-
- for _, option := range options {
- option(&s)
- }
-
- return s
-}
-
-// withPostSplitInitialismCheck allows to catch initialisms after main split process
-func withPostSplitInitialismCheck(s *splitter) {
- s.postSplitInitialismCheck = true
-}
-
-func (p matchesPool) BorrowMatches() *initialismMatches {
- s := p.Get().(*initialismMatches)
- *s = (*s)[:0] // reset slice, keep allocated capacity
-
- return s
-}
-
-func (p buffersPool) BorrowBuffer(size int) *bytes.Buffer {
- s := p.Get().(*bytes.Buffer)
- s.Reset()
-
- if s.Cap() < size {
- s.Grow(size)
- }
-
- return s
-}
-
-func (p lexemsPool) BorrowLexems() *[]nameLexem {
- s := p.Get().(*[]nameLexem)
- *s = (*s)[:0] // reset slice, keep allocated capacity
-
- return s
-}
-
-func (p splittersPool) BorrowSplitter(options ...splitterOption) *splitter {
- s := p.Get().(*splitter)
- s.postSplitInitialismCheck = false // reset options
- for _, apply := range options {
- apply(s)
- }
-
- return s
-}
-
-func (p matchesPool) RedeemMatches(s *initialismMatches) {
- p.Put(s)
-}
-
-func (p buffersPool) RedeemBuffer(s *bytes.Buffer) {
- p.Put(s)
-}
-
-func (p lexemsPool) RedeemLexems(s *[]nameLexem) {
- p.Put(s)
-}
-
-func (p splittersPool) RedeemSplitter(s *splitter) {
- p.Put(s)
-}
-
-func (m initialismMatch) isZero() bool {
- return m.start == 0 && m.end == 0
-}
-
-func (s splitter) split(name string) *[]nameLexem {
- nameRunes := []rune(name)
- matches := s.gatherInitialismMatches(nameRunes)
- if matches == nil {
- return poolOfLexems.BorrowLexems()
- }
-
- return s.mapMatchesToNameLexems(nameRunes, matches)
-}
-
-func (s splitter) gatherInitialismMatches(nameRunes []rune) *initialismMatches {
- var matches *initialismMatches
-
- for currentRunePosition, currentRune := range nameRunes {
- // recycle these allocations as we loop over runes
- // with such recycling, only 2 slices should be allocated per call
- // instead of o(n).
- newMatches := poolOfMatches.BorrowMatches()
-
- // check current initialism matches
- if matches != nil { // skip first iteration
- for _, match := range *matches {
- if keepCompleteMatch := match.complete; keepCompleteMatch {
- *newMatches = append(*newMatches, match)
- continue
- }
-
- // drop failed match
- currentMatchRune := match.body[currentRunePosition-match.start]
- if currentMatchRune != currentRune {
- continue
- }
-
- // try to complete ongoing match
- if currentRunePosition-match.start == len(match.body)-1 {
- // we are close; the next step is to check the symbol ahead
- // if it is a small letter, then it is not the end of match
- // but beginning of the next word
-
- if currentRunePosition < len(nameRunes)-1 {
- nextRune := nameRunes[currentRunePosition+1]
- if newWord := unicode.IsLower(nextRune); newWord {
- // oh ok, it was the start of a new word
- continue
- }
- }
-
- match.complete = true
- match.end = currentRunePosition
- }
-
- *newMatches = append(*newMatches, match)
- }
- }
-
- // check for new initialism matches
- for i := range s.initialisms {
- initialismRunes := s.initialismsRunes[i]
- if initialismRunes[0] == currentRune {
- *newMatches = append(*newMatches, initialismMatch{
- start: currentRunePosition,
- body: initialismRunes,
- complete: false,
- })
- }
- }
-
- if matches != nil {
- poolOfMatches.RedeemMatches(matches)
- }
- matches = newMatches
- }
-
- // up to the caller to redeem this last slice
- return matches
-}
-
-func (s splitter) mapMatchesToNameLexems(nameRunes []rune, matches *initialismMatches) *[]nameLexem {
- nameLexems := poolOfLexems.BorrowLexems()
-
- var lastAcceptedMatch initialismMatch
- for _, match := range *matches {
- if !match.complete {
- continue
- }
-
- if firstMatch := lastAcceptedMatch.isZero(); firstMatch {
- s.appendBrokenDownCasualString(nameLexems, nameRunes[:match.start])
- *nameLexems = append(*nameLexems, s.breakInitialism(string(match.body)))
-
- lastAcceptedMatch = match
-
- continue
- }
-
- if overlappedMatch := match.start <= lastAcceptedMatch.end; overlappedMatch {
- continue
- }
-
- middle := nameRunes[lastAcceptedMatch.end+1 : match.start]
- s.appendBrokenDownCasualString(nameLexems, middle)
- *nameLexems = append(*nameLexems, s.breakInitialism(string(match.body)))
-
- lastAcceptedMatch = match
- }
-
- // we have not found any accepted matches
- if lastAcceptedMatch.isZero() {
- *nameLexems = (*nameLexems)[:0]
- s.appendBrokenDownCasualString(nameLexems, nameRunes)
- } else if lastAcceptedMatch.end+1 != len(nameRunes) {
- rest := nameRunes[lastAcceptedMatch.end+1:]
- s.appendBrokenDownCasualString(nameLexems, rest)
- }
-
- poolOfMatches.RedeemMatches(matches)
-
- return nameLexems
-}
-
-func (s splitter) breakInitialism(original string) nameLexem {
- return newInitialismNameLexem(original, original)
-}
-
-func (s splitter) appendBrokenDownCasualString(segments *[]nameLexem, str []rune) {
- currentSegment := poolOfBuffers.BorrowBuffer(len(str)) // unlike strings.Builder, bytes.Buffer initial storage can reused
- defer func() {
- poolOfBuffers.RedeemBuffer(currentSegment)
- }()
-
- addCasualNameLexem := func(original string) {
- *segments = append(*segments, newCasualNameLexem(original))
- }
-
- addInitialismNameLexem := func(original, match string) {
- *segments = append(*segments, newInitialismNameLexem(original, match))
- }
-
- var addNameLexem func(string)
- if s.postSplitInitialismCheck {
- addNameLexem = func(original string) {
- for i := range s.initialisms {
- if isEqualFoldIgnoreSpace(s.initialismsUpperCased[i], original) {
- addInitialismNameLexem(original, s.initialisms[i])
-
- return
- }
- }
-
- addCasualNameLexem(original)
- }
- } else {
- addNameLexem = addCasualNameLexem
- }
-
- for _, rn := range str {
- if replace, found := nameReplaceTable(rn); found {
- if currentSegment.Len() > 0 {
- addNameLexem(currentSegment.String())
- currentSegment.Reset()
- }
-
- if replace != "" {
- addNameLexem(replace)
- }
-
- continue
- }
-
- if !unicode.In(rn, unicode.L, unicode.M, unicode.N, unicode.Pc) {
- if currentSegment.Len() > 0 {
- addNameLexem(currentSegment.String())
- currentSegment.Reset()
- }
-
- continue
- }
-
- if unicode.IsUpper(rn) {
- if currentSegment.Len() > 0 {
- addNameLexem(currentSegment.String())
- }
- currentSegment.Reset()
- }
-
- currentSegment.WriteRune(rn)
- }
-
- if currentSegment.Len() > 0 {
- addNameLexem(currentSegment.String())
- }
-}
-
-// isEqualFoldIgnoreSpace is the same as strings.EqualFold, but
-// it ignores leading and trailing blank spaces in the compared
-// string.
-//
-// base is assumed to be composed of upper-cased runes, and be already
-// trimmed.
-//
-// This code is heavily inspired from strings.EqualFold.
-func isEqualFoldIgnoreSpace(base []rune, str string) bool {
- var i, baseIndex int
- // equivalent to b := []byte(str), but without data copy
- b := hackStringBytes(str)
-
- for i < len(b) {
- if c := b[i]; c < utf8.RuneSelf {
- // fast path for ASCII
- if c != ' ' && c != '\t' {
- break
- }
- i++
-
- continue
- }
-
- // unicode case
- r, size := utf8.DecodeRune(b[i:])
- if !unicode.IsSpace(r) {
- break
- }
- i += size
- }
-
- if i >= len(b) {
- return len(base) == 0
- }
-
- for _, baseRune := range base {
- if i >= len(b) {
- break
- }
-
- if c := b[i]; c < utf8.RuneSelf {
- // single byte rune case (ASCII)
- if baseRune >= utf8.RuneSelf {
- return false
- }
-
- baseChar := byte(baseRune)
- if c != baseChar &&
- !('a' <= c && c <= 'z' && c-'a'+'A' == baseChar) {
- return false
- }
-
- baseIndex++
- i++
-
- continue
- }
-
- // unicode case
- r, size := utf8.DecodeRune(b[i:])
- if unicode.ToUpper(r) != baseRune {
- return false
- }
- baseIndex++
- i += size
- }
-
- if baseIndex != len(base) {
- return false
- }
-
- // all passed: now we should only have blanks
- for i < len(b) {
- if c := b[i]; c < utf8.RuneSelf {
- // fast path for ASCII
- if c != ' ' && c != '\t' {
- return false
- }
- i++
-
- continue
- }
-
- // unicode case
- r, size := utf8.DecodeRune(b[i:])
- if !unicode.IsSpace(r) {
- return false
- }
-
- i += size
- }
-
- return true
-}
diff --git a/vendor/github.com/go-openapi/swag/string_bytes.go b/vendor/github.com/go-openapi/swag/string_bytes.go
deleted file mode 100644
index 90745d5ca..000000000
--- a/vendor/github.com/go-openapi/swag/string_bytes.go
+++ /dev/null
@@ -1,8 +0,0 @@
-package swag
-
-import "unsafe"
-
-// hackStringBytes returns the (unsafe) underlying bytes slice of a string.
-func hackStringBytes(str string) []byte {
- return unsafe.Slice(unsafe.StringData(str), len(str))
-}
diff --git a/vendor/github.com/go-openapi/swag/stringutils/LICENSE b/vendor/github.com/go-openapi/swag/stringutils/LICENSE
new file mode 100644
index 000000000..d64569567
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/stringutils/LICENSE
@@ -0,0 +1,202 @@
+
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright [yyyy] [name of copyright owner]
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
diff --git a/vendor/github.com/go-openapi/swag/stringutils/collection_formats.go b/vendor/github.com/go-openapi/swag/stringutils/collection_formats.go
new file mode 100644
index 000000000..28056ad25
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/stringutils/collection_formats.go
@@ -0,0 +1,74 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package stringutils
+
+import "strings"
+
+const (
+ // collectionFormatComma = "csv"
+ collectionFormatSpace = "ssv"
+ collectionFormatTab = "tsv"
+ collectionFormatPipe = "pipes"
+ collectionFormatMulti = "multi"
+
+ collectionFormatDefaultSep = ","
+)
+
+// JoinByFormat joins a string array by a known format (e.g. swagger's collectionFormat attribute):
+//
+// ssv: space separated value
+// tsv: tab separated value
+// pipes: pipe (|) separated value
+// csv: comma separated value (default)
+func JoinByFormat(data []string, format string) []string {
+ if len(data) == 0 {
+ return data
+ }
+ var sep string
+ switch format {
+ case collectionFormatSpace:
+ sep = " "
+ case collectionFormatTab:
+ sep = "\t"
+ case collectionFormatPipe:
+ sep = "|"
+ case collectionFormatMulti:
+ return data
+ default:
+ sep = collectionFormatDefaultSep
+ }
+ return []string{strings.Join(data, sep)}
+}
+
+// SplitByFormat splits a string by a known format:
+//
+// ssv: space separated value
+// tsv: tab separated value
+// pipes: pipe (|) separated value
+// csv: comma separated value (default)
+func SplitByFormat(data, format string) []string {
+ if data == "" {
+ return nil
+ }
+ var sep string
+ switch format {
+ case collectionFormatSpace:
+ sep = " "
+ case collectionFormatTab:
+ sep = "\t"
+ case collectionFormatPipe:
+ sep = "|"
+ case collectionFormatMulti:
+ return nil
+ default:
+ sep = collectionFormatDefaultSep
+ }
+ var result []string
+ for _, s := range strings.Split(data, sep) {
+ if ts := strings.TrimSpace(s); ts != "" {
+ result = append(result, ts)
+ }
+ }
+ return result
+}
diff --git a/vendor/github.com/go-openapi/swag/stringutils/doc.go b/vendor/github.com/go-openapi/swag/stringutils/doc.go
new file mode 100644
index 000000000..c6d17a116
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/stringutils/doc.go
@@ -0,0 +1,5 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+// Package stringutils exposes helpers to search and process strings.
+package stringutils
diff --git a/vendor/github.com/go-openapi/swag/stringutils/strings.go b/vendor/github.com/go-openapi/swag/stringutils/strings.go
new file mode 100644
index 000000000..cd792b7d0
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/stringutils/strings.go
@@ -0,0 +1,23 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package stringutils
+
+import (
+ "slices"
+ "strings"
+)
+
+// ContainsStrings searches a slice of strings for a case-sensitive match
+//
+// Now equivalent to the standard library [slice.Contains].
+func ContainsStrings(coll []string, item string) bool {
+ return slices.Contains(coll, item)
+}
+
+// ContainsStringsCI searches a slice of strings for a case-insensitive match
+func ContainsStringsCI(coll []string, item string) bool {
+ return slices.ContainsFunc(coll, func(e string) bool {
+ return strings.EqualFold(e, item)
+ })
+}
diff --git a/vendor/github.com/go-openapi/swag/stringutils_iface.go b/vendor/github.com/go-openapi/swag/stringutils_iface.go
new file mode 100644
index 000000000..dbfa48484
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/stringutils_iface.go
@@ -0,0 +1,34 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package swag
+
+import "github.com/go-openapi/swag/stringutils"
+
+// ContainsStrings searches a slice of strings for a case-sensitive match.
+//
+// Deprecated: use [slices.Contains] or [stringutils.ContainsStrings] instead.
+func ContainsStrings(coll []string, item string) bool {
+ return stringutils.ContainsStrings(coll, item)
+}
+
+// ContainsStringsCI searches a slice of strings for a case-insensitive match.
+//
+// Deprecated: use [stringutils.ContainsStringsCI] instead.
+func ContainsStringsCI(coll []string, item string) bool {
+ return stringutils.ContainsStringsCI(coll, item)
+}
+
+// JoinByFormat joins a string array by a known format (e.g. swagger's collectionFormat attribute).
+//
+// Deprecated: use [stringutils.JoinByFormat] instead.
+func JoinByFormat(data []string, format string) []string {
+ return stringutils.JoinByFormat(data, format)
+}
+
+// SplitByFormat splits a string by a known format.
+//
+// Deprecated: use [stringutils.SplitByFormat] instead.
+func SplitByFormat(data, format string) []string {
+ return stringutils.SplitByFormat(data, format)
+}
diff --git a/vendor/github.com/go-openapi/swag/typeutils/LICENSE b/vendor/github.com/go-openapi/swag/typeutils/LICENSE
new file mode 100644
index 000000000..d64569567
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/typeutils/LICENSE
@@ -0,0 +1,202 @@
+
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright [yyyy] [name of copyright owner]
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
diff --git a/vendor/github.com/go-openapi/swag/typeutils/doc.go b/vendor/github.com/go-openapi/swag/typeutils/doc.go
new file mode 100644
index 000000000..66bed20df
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/typeutils/doc.go
@@ -0,0 +1,5 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+// Package typeutils exposes utilities to inspect generic types.
+package typeutils
diff --git a/vendor/github.com/go-openapi/swag/typeutils/types.go b/vendor/github.com/go-openapi/swag/typeutils/types.go
new file mode 100644
index 000000000..55487a673
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/typeutils/types.go
@@ -0,0 +1,80 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package typeutils
+
+import "reflect"
+
+type zeroable interface {
+ IsZero() bool
+}
+
+// IsZero returns true when the value passed into the function is a zero value.
+// This allows for safer checking of interface values.
+func IsZero(data any) bool {
+ v := reflect.ValueOf(data)
+ // check for nil data
+ switch v.Kind() { //nolint:exhaustive
+ case
+ reflect.Interface,
+ reflect.Func,
+ reflect.Chan,
+ reflect.Pointer,
+ reflect.UnsafePointer,
+ reflect.Map,
+ reflect.Slice:
+ if v.IsNil() {
+ return true
+ }
+ }
+
+ // check for things that have an IsZero method instead
+ if vv, ok := data.(zeroable); ok {
+ return vv.IsZero()
+ }
+
+ // continue with slightly more complex reflection
+ switch v.Kind() { //nolint:exhaustive
+ case reflect.String:
+ return v.Len() == 0
+ case reflect.Bool:
+ return !v.Bool()
+ case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+ return v.Int() == 0
+ case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+ return v.Uint() == 0
+ case reflect.Float32, reflect.Float64:
+ return v.Float() == 0
+ case reflect.Struct, reflect.Array:
+ return reflect.DeepEqual(data, reflect.Zero(v.Type()).Interface())
+ case reflect.Invalid:
+ return true
+ default:
+ return false
+ }
+}
+
+// IsNil checks if input is nil.
+//
+// For types chan, func, interface, map, pointer, or slice it returns true if its argument is nil.
+//
+// See [reflect.Value.IsNil].
+func IsNil(input any) bool {
+ if input == nil {
+ return true
+ }
+
+ kind := reflect.TypeOf(input).Kind()
+ switch kind { //nolint:exhaustive
+ case reflect.Pointer,
+ reflect.UnsafePointer,
+ reflect.Map,
+ reflect.Slice,
+ reflect.Chan,
+ reflect.Interface,
+ reflect.Func:
+ return reflect.ValueOf(input).IsNil()
+ default:
+ return false
+ }
+}
diff --git a/vendor/github.com/go-openapi/swag/typeutils_iface.go b/vendor/github.com/go-openapi/swag/typeutils_iface.go
new file mode 100644
index 000000000..b63813ea4
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/typeutils_iface.go
@@ -0,0 +1,12 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package swag
+
+import "github.com/go-openapi/swag/typeutils"
+
+// IsZero returns true when the value passed into the function is a zero value.
+// This allows for safer checking of interface values.
+//
+// Deprecated: use [typeutils.IsZero] instead.
+func IsZero(data any) bool { return typeutils.IsZero(data) }
diff --git a/vendor/github.com/go-openapi/swag/util.go b/vendor/github.com/go-openapi/swag/util.go
deleted file mode 100644
index 5051401c4..000000000
--- a/vendor/github.com/go-openapi/swag/util.go
+++ /dev/null
@@ -1,364 +0,0 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package swag
-
-import (
- "reflect"
- "strings"
- "unicode"
- "unicode/utf8"
-)
-
-// GoNamePrefixFunc sets an optional rule to prefix go names
-// which do not start with a letter.
-//
-// The prefix function is assumed to return a string that starts with an upper case letter.
-//
-// e.g. to help convert "123" into "{prefix}123"
-//
-// The default is to prefix with "X"
-var GoNamePrefixFunc func(string) string
-
-func prefixFunc(name, in string) string {
- if GoNamePrefixFunc == nil {
- return "X" + in
- }
-
- return GoNamePrefixFunc(name) + in
-}
-
-const (
- // collectionFormatComma = "csv"
- collectionFormatSpace = "ssv"
- collectionFormatTab = "tsv"
- collectionFormatPipe = "pipes"
- collectionFormatMulti = "multi"
-)
-
-// JoinByFormat joins a string array by a known format (e.g. swagger's collectionFormat attribute):
-//
-// ssv: space separated value
-// tsv: tab separated value
-// pipes: pipe (|) separated value
-// csv: comma separated value (default)
-func JoinByFormat(data []string, format string) []string {
- if len(data) == 0 {
- return data
- }
- var sep string
- switch format {
- case collectionFormatSpace:
- sep = " "
- case collectionFormatTab:
- sep = "\t"
- case collectionFormatPipe:
- sep = "|"
- case collectionFormatMulti:
- return data
- default:
- sep = ","
- }
- return []string{strings.Join(data, sep)}
-}
-
-// SplitByFormat splits a string by a known format:
-//
-// ssv: space separated value
-// tsv: tab separated value
-// pipes: pipe (|) separated value
-// csv: comma separated value (default)
-func SplitByFormat(data, format string) []string {
- if data == "" {
- return nil
- }
- var sep string
- switch format {
- case collectionFormatSpace:
- sep = " "
- case collectionFormatTab:
- sep = "\t"
- case collectionFormatPipe:
- sep = "|"
- case collectionFormatMulti:
- return nil
- default:
- sep = ","
- }
- var result []string
- for _, s := range strings.Split(data, sep) {
- if ts := strings.TrimSpace(s); ts != "" {
- result = append(result, ts)
- }
- }
- return result
-}
-
-// Removes leading whitespaces
-func trim(str string) string {
- return strings.TrimSpace(str)
-}
-
-// Shortcut to strings.ToUpper()
-func upper(str string) string {
- return strings.ToUpper(trim(str))
-}
-
-// Shortcut to strings.ToLower()
-func lower(str string) string {
- return strings.ToLower(trim(str))
-}
-
-// Camelize an uppercased word
-func Camelize(word string) string {
- camelized := poolOfBuffers.BorrowBuffer(len(word))
- defer func() {
- poolOfBuffers.RedeemBuffer(camelized)
- }()
-
- for pos, ru := range []rune(word) {
- if pos > 0 {
- camelized.WriteRune(unicode.ToLower(ru))
- } else {
- camelized.WriteRune(unicode.ToUpper(ru))
- }
- }
- return camelized.String()
-}
-
-// ToFileName lowercases and underscores a go type name
-func ToFileName(name string) string {
- in := split(name)
- out := make([]string, 0, len(in))
-
- for _, w := range in {
- out = append(out, lower(w))
- }
-
- return strings.Join(out, "_")
-}
-
-// ToCommandName lowercases and underscores a go type name
-func ToCommandName(name string) string {
- in := split(name)
- out := make([]string, 0, len(in))
-
- for _, w := range in {
- out = append(out, lower(w))
- }
- return strings.Join(out, "-")
-}
-
-// ToHumanNameLower represents a code name as a human series of words
-func ToHumanNameLower(name string) string {
- s := poolOfSplitters.BorrowSplitter(withPostSplitInitialismCheck)
- in := s.split(name)
- poolOfSplitters.RedeemSplitter(s)
- out := make([]string, 0, len(*in))
-
- for _, w := range *in {
- if !w.IsInitialism() {
- out = append(out, lower(w.GetOriginal()))
- } else {
- out = append(out, trim(w.GetOriginal()))
- }
- }
- poolOfLexems.RedeemLexems(in)
-
- return strings.Join(out, " ")
-}
-
-// ToHumanNameTitle represents a code name as a human series of words with the first letters titleized
-func ToHumanNameTitle(name string) string {
- s := poolOfSplitters.BorrowSplitter(withPostSplitInitialismCheck)
- in := s.split(name)
- poolOfSplitters.RedeemSplitter(s)
-
- out := make([]string, 0, len(*in))
- for _, w := range *in {
- original := trim(w.GetOriginal())
- if !w.IsInitialism() {
- out = append(out, Camelize(original))
- } else {
- out = append(out, original)
- }
- }
- poolOfLexems.RedeemLexems(in)
-
- return strings.Join(out, " ")
-}
-
-// ToJSONName camelcases a name which can be underscored or pascal cased
-func ToJSONName(name string) string {
- in := split(name)
- out := make([]string, 0, len(in))
-
- for i, w := range in {
- if i == 0 {
- out = append(out, lower(w))
- continue
- }
- out = append(out, Camelize(trim(w)))
- }
- return strings.Join(out, "")
-}
-
-// ToVarName camelcases a name which can be underscored or pascal cased
-func ToVarName(name string) string {
- res := ToGoName(name)
- if isInitialism(res) {
- return lower(res)
- }
- if len(res) <= 1 {
- return lower(res)
- }
- return lower(res[:1]) + res[1:]
-}
-
-// ToGoName translates a swagger name which can be underscored or camel cased to a name that golint likes
-func ToGoName(name string) string {
- s := poolOfSplitters.BorrowSplitter(withPostSplitInitialismCheck)
- lexems := s.split(name)
- poolOfSplitters.RedeemSplitter(s)
- defer func() {
- poolOfLexems.RedeemLexems(lexems)
- }()
- lexemes := *lexems
-
- if len(lexemes) == 0 {
- return ""
- }
-
- result := poolOfBuffers.BorrowBuffer(len(name))
- defer func() {
- poolOfBuffers.RedeemBuffer(result)
- }()
-
- // check if not starting with a letter, upper case
- firstPart := lexemes[0].GetUnsafeGoName()
- if lexemes[0].IsInitialism() {
- firstPart = upper(firstPart)
- }
-
- if c := firstPart[0]; c < utf8.RuneSelf {
- // ASCII
- switch {
- case 'A' <= c && c <= 'Z':
- result.WriteString(firstPart)
- case 'a' <= c && c <= 'z':
- result.WriteByte(c - 'a' + 'A')
- result.WriteString(firstPart[1:])
- default:
- result.WriteString(prefixFunc(name, firstPart))
- // NOTE: no longer check if prefixFunc returns a string that starts with uppercase:
- // assume this is always the case
- }
- } else {
- // unicode
- firstRune, _ := utf8.DecodeRuneInString(firstPart)
- switch {
- case !unicode.IsLetter(firstRune):
- result.WriteString(prefixFunc(name, firstPart))
- case !unicode.IsUpper(firstRune):
- result.WriteString(prefixFunc(name, firstPart))
- /*
- result.WriteRune(unicode.ToUpper(firstRune))
- result.WriteString(firstPart[offset:])
- */
- default:
- result.WriteString(firstPart)
- }
- }
-
- for _, lexem := range lexemes[1:] {
- goName := lexem.GetUnsafeGoName()
-
- // to support old behavior
- if lexem.IsInitialism() {
- goName = upper(goName)
- }
- result.WriteString(goName)
- }
-
- return result.String()
-}
-
-// ContainsStrings searches a slice of strings for a case-sensitive match
-func ContainsStrings(coll []string, item string) bool {
- for _, a := range coll {
- if a == item {
- return true
- }
- }
- return false
-}
-
-// ContainsStringsCI searches a slice of strings for a case-insensitive match
-func ContainsStringsCI(coll []string, item string) bool {
- for _, a := range coll {
- if strings.EqualFold(a, item) {
- return true
- }
- }
- return false
-}
-
-type zeroable interface {
- IsZero() bool
-}
-
-// IsZero returns true when the value passed into the function is a zero value.
-// This allows for safer checking of interface values.
-func IsZero(data interface{}) bool {
- v := reflect.ValueOf(data)
- // check for nil data
- switch v.Kind() { //nolint:exhaustive
- case reflect.Interface, reflect.Map, reflect.Ptr, reflect.Slice:
- if v.IsNil() {
- return true
- }
- }
-
- // check for things that have an IsZero method instead
- if vv, ok := data.(zeroable); ok {
- return vv.IsZero()
- }
-
- // continue with slightly more complex reflection
- switch v.Kind() { //nolint:exhaustive
- case reflect.String:
- return v.Len() == 0
- case reflect.Bool:
- return !v.Bool()
- case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
- return v.Int() == 0
- case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
- return v.Uint() == 0
- case reflect.Float32, reflect.Float64:
- return v.Float() == 0
- case reflect.Struct, reflect.Array:
- return reflect.DeepEqual(data, reflect.Zero(v.Type()).Interface())
- case reflect.Invalid:
- return true
- default:
- return false
- }
-}
-
-// CommandLineOptionsGroup represents a group of user-defined command line options
-type CommandLineOptionsGroup struct {
- ShortDescription string
- LongDescription string
- Options interface{}
-}
diff --git a/vendor/github.com/go-openapi/swag/yaml.go b/vendor/github.com/go-openapi/swag/yaml.go
deleted file mode 100644
index f59e02593..000000000
--- a/vendor/github.com/go-openapi/swag/yaml.go
+++ /dev/null
@@ -1,481 +0,0 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package swag
-
-import (
- "encoding/json"
- "errors"
- "fmt"
- "path/filepath"
- "reflect"
- "sort"
- "strconv"
-
- "github.com/mailru/easyjson/jlexer"
- "github.com/mailru/easyjson/jwriter"
- yaml "gopkg.in/yaml.v3"
-)
-
-// YAMLMatcher matches yaml
-func YAMLMatcher(path string) bool {
- ext := filepath.Ext(path)
- return ext == ".yaml" || ext == ".yml"
-}
-
-// YAMLToJSON converts YAML unmarshaled data into json compatible data
-func YAMLToJSON(data interface{}) (json.RawMessage, error) {
- jm, err := transformData(data)
- if err != nil {
- return nil, err
- }
- b, err := WriteJSON(jm)
- return json.RawMessage(b), err
-}
-
-// BytesToYAMLDoc converts a byte slice into a YAML document
-func BytesToYAMLDoc(data []byte) (interface{}, error) {
- var document yaml.Node // preserve order that is present in the document
- if err := yaml.Unmarshal(data, &document); err != nil {
- return nil, err
- }
- if document.Kind != yaml.DocumentNode || len(document.Content) != 1 || document.Content[0].Kind != yaml.MappingNode {
- return nil, errors.New("only YAML documents that are objects are supported")
- }
- return &document, nil
-}
-
-func yamlNode(root *yaml.Node) (interface{}, error) {
- switch root.Kind {
- case yaml.DocumentNode:
- return yamlDocument(root)
- case yaml.SequenceNode:
- return yamlSequence(root)
- case yaml.MappingNode:
- return yamlMapping(root)
- case yaml.ScalarNode:
- return yamlScalar(root)
- case yaml.AliasNode:
- return yamlNode(root.Alias)
- default:
- return nil, fmt.Errorf("unsupported YAML node type: %v", root.Kind)
- }
-}
-
-func yamlDocument(node *yaml.Node) (interface{}, error) {
- if len(node.Content) != 1 {
- return nil, fmt.Errorf("unexpected YAML Document node content length: %d", len(node.Content))
- }
- return yamlNode(node.Content[0])
-}
-
-func yamlMapping(node *yaml.Node) (interface{}, error) {
- m := make(JSONMapSlice, len(node.Content)/2)
-
- var j int
- for i := 0; i < len(node.Content); i += 2 {
- var nmi JSONMapItem
- k, err := yamlStringScalarC(node.Content[i])
- if err != nil {
- return nil, fmt.Errorf("unable to decode YAML map key: %w", err)
- }
- nmi.Key = k
- v, err := yamlNode(node.Content[i+1])
- if err != nil {
- return nil, fmt.Errorf("unable to process YAML map value for key %q: %w", k, err)
- }
- nmi.Value = v
- m[j] = nmi
- j++
- }
- return m, nil
-}
-
-func yamlSequence(node *yaml.Node) (interface{}, error) {
- s := make([]interface{}, 0)
-
- for i := 0; i < len(node.Content); i++ {
-
- v, err := yamlNode(node.Content[i])
- if err != nil {
- return nil, fmt.Errorf("unable to decode YAML sequence value: %w", err)
- }
- s = append(s, v)
- }
- return s, nil
-}
-
-const ( // See https://yaml.org/type/
- yamlStringScalar = "tag:yaml.org,2002:str"
- yamlIntScalar = "tag:yaml.org,2002:int"
- yamlBoolScalar = "tag:yaml.org,2002:bool"
- yamlFloatScalar = "tag:yaml.org,2002:float"
- yamlTimestamp = "tag:yaml.org,2002:timestamp"
- yamlNull = "tag:yaml.org,2002:null"
-)
-
-func yamlScalar(node *yaml.Node) (interface{}, error) {
- switch node.LongTag() {
- case yamlStringScalar:
- return node.Value, nil
- case yamlBoolScalar:
- b, err := strconv.ParseBool(node.Value)
- if err != nil {
- return nil, fmt.Errorf("unable to process scalar node. Got %q. Expecting bool content: %w", node.Value, err)
- }
- return b, nil
- case yamlIntScalar:
- i, err := strconv.ParseInt(node.Value, 10, 64)
- if err != nil {
- return nil, fmt.Errorf("unable to process scalar node. Got %q. Expecting integer content: %w", node.Value, err)
- }
- return i, nil
- case yamlFloatScalar:
- f, err := strconv.ParseFloat(node.Value, 64)
- if err != nil {
- return nil, fmt.Errorf("unable to process scalar node. Got %q. Expecting float content: %w", node.Value, err)
- }
- return f, nil
- case yamlTimestamp:
- return node.Value, nil
- case yamlNull:
- return nil, nil //nolint:nilnil
- default:
- return nil, fmt.Errorf("YAML tag %q is not supported", node.LongTag())
- }
-}
-
-func yamlStringScalarC(node *yaml.Node) (string, error) {
- if node.Kind != yaml.ScalarNode {
- return "", fmt.Errorf("expecting a string scalar but got %q", node.Kind)
- }
- switch node.LongTag() {
- case yamlStringScalar, yamlIntScalar, yamlFloatScalar:
- return node.Value, nil
- default:
- return "", fmt.Errorf("YAML tag %q is not supported as map key", node.LongTag())
- }
-}
-
-// JSONMapSlice represent a JSON object, with the order of keys maintained
-type JSONMapSlice []JSONMapItem
-
-// MarshalJSON renders a JSONMapSlice as JSON
-func (s JSONMapSlice) MarshalJSON() ([]byte, error) {
- w := &jwriter.Writer{Flags: jwriter.NilMapAsEmpty | jwriter.NilSliceAsEmpty}
- s.MarshalEasyJSON(w)
- return w.BuildBytes()
-}
-
-// MarshalEasyJSON renders a JSONMapSlice as JSON, using easyJSON
-func (s JSONMapSlice) MarshalEasyJSON(w *jwriter.Writer) {
- w.RawByte('{')
-
- ln := len(s)
- last := ln - 1
- for i := 0; i < ln; i++ {
- s[i].MarshalEasyJSON(w)
- if i != last { // last item
- w.RawByte(',')
- }
- }
-
- w.RawByte('}')
-}
-
-// UnmarshalJSON makes a JSONMapSlice from JSON
-func (s *JSONMapSlice) UnmarshalJSON(data []byte) error {
- l := jlexer.Lexer{Data: data}
- s.UnmarshalEasyJSON(&l)
- return l.Error()
-}
-
-// UnmarshalEasyJSON makes a JSONMapSlice from JSON, using easyJSON
-func (s *JSONMapSlice) UnmarshalEasyJSON(in *jlexer.Lexer) {
- if in.IsNull() {
- in.Skip()
- return
- }
-
- var result JSONMapSlice
- in.Delim('{')
- for !in.IsDelim('}') {
- var mi JSONMapItem
- mi.UnmarshalEasyJSON(in)
- result = append(result, mi)
- }
- *s = result
-}
-
-func (s JSONMapSlice) MarshalYAML() (interface{}, error) {
- var n yaml.Node
- n.Kind = yaml.DocumentNode
- var nodes []*yaml.Node
- for _, item := range s {
- nn, err := json2yaml(item.Value)
- if err != nil {
- return nil, err
- }
- ns := []*yaml.Node{
- {
- Kind: yaml.ScalarNode,
- Tag: yamlStringScalar,
- Value: item.Key,
- },
- nn,
- }
- nodes = append(nodes, ns...)
- }
-
- n.Content = []*yaml.Node{
- {
- Kind: yaml.MappingNode,
- Content: nodes,
- },
- }
-
- return yaml.Marshal(&n)
-}
-
-func isNil(input interface{}) bool {
- if input == nil {
- return true
- }
- kind := reflect.TypeOf(input).Kind()
- switch kind { //nolint:exhaustive
- case reflect.Ptr, reflect.Map, reflect.Slice, reflect.Chan:
- return reflect.ValueOf(input).IsNil()
- default:
- return false
- }
-}
-
-func json2yaml(item interface{}) (*yaml.Node, error) {
- if isNil(item) {
- return &yaml.Node{
- Kind: yaml.ScalarNode,
- Value: "null",
- }, nil
- }
-
- switch val := item.(type) {
- case JSONMapSlice:
- var n yaml.Node
- n.Kind = yaml.MappingNode
- for i := range val {
- childNode, err := json2yaml(&val[i].Value)
- if err != nil {
- return nil, err
- }
- n.Content = append(n.Content, &yaml.Node{
- Kind: yaml.ScalarNode,
- Tag: yamlStringScalar,
- Value: val[i].Key,
- }, childNode)
- }
- return &n, nil
- case map[string]interface{}:
- var n yaml.Node
- n.Kind = yaml.MappingNode
- keys := make([]string, 0, len(val))
- for k := range val {
- keys = append(keys, k)
- }
- sort.Strings(keys)
-
- for _, k := range keys {
- v := val[k]
- childNode, err := json2yaml(v)
- if err != nil {
- return nil, err
- }
- n.Content = append(n.Content, &yaml.Node{
- Kind: yaml.ScalarNode,
- Tag: yamlStringScalar,
- Value: k,
- }, childNode)
- }
- return &n, nil
- case []interface{}:
- var n yaml.Node
- n.Kind = yaml.SequenceNode
- for i := range val {
- childNode, err := json2yaml(val[i])
- if err != nil {
- return nil, err
- }
- n.Content = append(n.Content, childNode)
- }
- return &n, nil
- case string:
- return &yaml.Node{
- Kind: yaml.ScalarNode,
- Tag: yamlStringScalar,
- Value: val,
- }, nil
- case float64:
- return &yaml.Node{
- Kind: yaml.ScalarNode,
- Tag: yamlFloatScalar,
- Value: strconv.FormatFloat(val, 'f', -1, 64),
- }, nil
- case int64:
- return &yaml.Node{
- Kind: yaml.ScalarNode,
- Tag: yamlIntScalar,
- Value: strconv.FormatInt(val, 10),
- }, nil
- case uint64:
- return &yaml.Node{
- Kind: yaml.ScalarNode,
- Tag: yamlIntScalar,
- Value: strconv.FormatUint(val, 10),
- }, nil
- case bool:
- return &yaml.Node{
- Kind: yaml.ScalarNode,
- Tag: yamlBoolScalar,
- Value: strconv.FormatBool(val),
- }, nil
- default:
- return nil, fmt.Errorf("unhandled type: %T", val)
- }
-}
-
-// JSONMapItem represents the value of a key in a JSON object held by JSONMapSlice
-type JSONMapItem struct {
- Key string
- Value interface{}
-}
-
-// MarshalJSON renders a JSONMapItem as JSON
-func (s JSONMapItem) MarshalJSON() ([]byte, error) {
- w := &jwriter.Writer{Flags: jwriter.NilMapAsEmpty | jwriter.NilSliceAsEmpty}
- s.MarshalEasyJSON(w)
- return w.BuildBytes()
-}
-
-// MarshalEasyJSON renders a JSONMapItem as JSON, using easyJSON
-func (s JSONMapItem) MarshalEasyJSON(w *jwriter.Writer) {
- w.String(s.Key)
- w.RawByte(':')
- w.Raw(WriteJSON(s.Value))
-}
-
-// UnmarshalJSON makes a JSONMapItem from JSON
-func (s *JSONMapItem) UnmarshalJSON(data []byte) error {
- l := jlexer.Lexer{Data: data}
- s.UnmarshalEasyJSON(&l)
- return l.Error()
-}
-
-// UnmarshalEasyJSON makes a JSONMapItem from JSON, using easyJSON
-func (s *JSONMapItem) UnmarshalEasyJSON(in *jlexer.Lexer) {
- key := in.UnsafeString()
- in.WantColon()
- value := in.Interface()
- in.WantComma()
- s.Key = key
- s.Value = value
-}
-
-func transformData(input interface{}) (out interface{}, err error) {
- format := func(t interface{}) (string, error) {
- switch k := t.(type) {
- case string:
- return k, nil
- case uint:
- return strconv.FormatUint(uint64(k), 10), nil
- case uint8:
- return strconv.FormatUint(uint64(k), 10), nil
- case uint16:
- return strconv.FormatUint(uint64(k), 10), nil
- case uint32:
- return strconv.FormatUint(uint64(k), 10), nil
- case uint64:
- return strconv.FormatUint(k, 10), nil
- case int:
- return strconv.Itoa(k), nil
- case int8:
- return strconv.FormatInt(int64(k), 10), nil
- case int16:
- return strconv.FormatInt(int64(k), 10), nil
- case int32:
- return strconv.FormatInt(int64(k), 10), nil
- case int64:
- return strconv.FormatInt(k, 10), nil
- default:
- return "", fmt.Errorf("unexpected map key type, got: %T", k)
- }
- }
-
- switch in := input.(type) {
- case yaml.Node:
- return yamlNode(&in)
- case *yaml.Node:
- return yamlNode(in)
- case map[interface{}]interface{}:
- o := make(JSONMapSlice, 0, len(in))
- for ke, va := range in {
- var nmi JSONMapItem
- if nmi.Key, err = format(ke); err != nil {
- return nil, err
- }
-
- v, ert := transformData(va)
- if ert != nil {
- return nil, ert
- }
- nmi.Value = v
- o = append(o, nmi)
- }
- return o, nil
- case []interface{}:
- len1 := len(in)
- o := make([]interface{}, len1)
- for i := 0; i < len1; i++ {
- o[i], err = transformData(in[i])
- if err != nil {
- return nil, err
- }
- }
- return o, nil
- }
- return input, nil
-}
-
-// YAMLDoc loads a yaml document from either http or a file and converts it to json
-func YAMLDoc(path string) (json.RawMessage, error) {
- yamlDoc, err := YAMLData(path)
- if err != nil {
- return nil, err
- }
-
- data, err := YAMLToJSON(yamlDoc)
- if err != nil {
- return nil, err
- }
-
- return data, nil
-}
-
-// YAMLData loads a yaml document from either http or a file
-func YAMLData(path string) (interface{}, error) {
- data, err := LoadFromFileOrHTTP(path)
- if err != nil {
- return nil, err
- }
-
- return BytesToYAMLDoc(data)
-}
diff --git a/vendor/github.com/go-openapi/swag/yamlutils/LICENSE b/vendor/github.com/go-openapi/swag/yamlutils/LICENSE
new file mode 100644
index 000000000..d64569567
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/yamlutils/LICENSE
@@ -0,0 +1,202 @@
+
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright [yyyy] [name of copyright owner]
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
diff --git a/vendor/github.com/go-openapi/swag/yamlutils/doc.go b/vendor/github.com/go-openapi/swag/yamlutils/doc.go
new file mode 100644
index 000000000..7bb92a82f
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/yamlutils/doc.go
@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+// Package yamlutils provides utilities to work with YAML documents.
+//
+// - [BytesToYAMLDoc] to construct a [yaml.Node] document
+// - [YAMLToJSON] to convert a [yaml.Node] document to JSON bytes
+// - [YAMLMapSlice] to serialize and deserialize YAML with the order of keys maintained
+package yamlutils
+
+import (
+ _ "go.yaml.in/yaml/v3" // for documentation purpose only
+)
diff --git a/vendor/github.com/go-openapi/swag/yamlutils/errors.go b/vendor/github.com/go-openapi/swag/yamlutils/errors.go
new file mode 100644
index 000000000..e87bc5e8b
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/yamlutils/errors.go
@@ -0,0 +1,15 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package yamlutils
+
+type yamlError string
+
+const (
+ // ErrYAML is an error raised by YAML utilities
+ ErrYAML yamlError = "yaml error"
+)
+
+func (e yamlError) Error() string {
+ return string(e)
+}
diff --git a/vendor/github.com/go-openapi/swag/yamlutils/ordered_map.go b/vendor/github.com/go-openapi/swag/yamlutils/ordered_map.go
new file mode 100644
index 000000000..3daf68dbb
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/yamlutils/ordered_map.go
@@ -0,0 +1,316 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package yamlutils
+
+import (
+ "fmt"
+ "iter"
+ "slices"
+ "sort"
+ "strconv"
+
+ "github.com/go-openapi/swag/conv"
+ "github.com/go-openapi/swag/jsonutils"
+ "github.com/go-openapi/swag/jsonutils/adapters/ifaces"
+ "github.com/go-openapi/swag/typeutils"
+ yaml "go.yaml.in/yaml/v3"
+)
+
+var (
+ _ yaml.Marshaler = YAMLMapSlice{}
+ _ yaml.Unmarshaler = &YAMLMapSlice{}
+)
+
+// YAMLMapSlice represents a YAML object, with the order of keys maintained.
+//
+// It is similar to [jsonutils.JSONMapSlice] and also knows how to marshal and unmarshal YAML.
+//
+// It behaves like an ordered map, but keys can't be accessed in constant time.
+type YAMLMapSlice []YAMLMapItem
+
+// YAMLMapItem represents the value of a key in a YAML object held by [YAMLMapSlice].
+//
+// It is entirely equivalent to [jsonutils.JSONMapItem], with the same limitation that
+// you should not Marshal or Unmarshal directly this type, outside of a [YAMLMapSlice].
+type YAMLMapItem = jsonutils.JSONMapItem
+
+func (s YAMLMapSlice) OrderedItems() iter.Seq2[string, any] {
+ return func(yield func(string, any) bool) {
+ for _, item := range s {
+ if !yield(item.Key, item.Value) {
+ return
+ }
+ }
+ }
+}
+
+// SetOrderedItems implements [ifaces.SetOrdered]: it merges keys passed by the iterator argument
+// into the [YAMLMapSlice].
+func (s *YAMLMapSlice) SetOrderedItems(items iter.Seq2[string, any]) {
+ if items == nil {
+ // force receiver to be a nil slice
+ *s = nil
+
+ return
+ }
+
+ m := *s
+ if len(m) > 0 {
+ // update mode: short-circuited when unmarshaling fresh data structures
+ idx := make(map[string]int, len(m))
+
+ for i, item := range m {
+ idx[item.Key] = i
+ }
+
+ for k, v := range items {
+ idx, ok := idx[k]
+ if ok {
+ m[idx].Value = v
+
+ continue
+ }
+
+ m = append(m, YAMLMapItem{Key: k, Value: v})
+ }
+
+ *s = m
+
+ return
+ }
+
+ for k, v := range items {
+ m = append(m, YAMLMapItem{Key: k, Value: v})
+ }
+
+ *s = m
+}
+
+// MarshalJSON renders this YAML object as JSON bytes.
+//
+// The difference with standard JSON marshaling is that the order of keys is maintained.
+func (s YAMLMapSlice) MarshalJSON() ([]byte, error) {
+ return jsonutils.JSONMapSlice(s).MarshalJSON()
+}
+
+// UnmarshalJSON builds this YAML object from JSON bytes.
+//
+// The difference with standard JSON marshaling is that the order of keys is maintained.
+func (s *YAMLMapSlice) UnmarshalJSON(data []byte) error {
+ js := jsonutils.JSONMapSlice(*s)
+
+ if err := js.UnmarshalJSON(data); err != nil {
+ return err
+ }
+
+ *s = YAMLMapSlice(js)
+
+ return nil
+}
+
+// MarshalYAML produces a YAML document as bytes
+//
+// The difference with standard YAML marshaling is that the order of keys is maintained.
+//
+// It implements [yaml.Marshaler].
+func (s YAMLMapSlice) MarshalYAML() (any, error) {
+ if typeutils.IsNil(s) {
+ return []byte("null\n"), nil
+ }
+ var n yaml.Node
+ n.Kind = yaml.DocumentNode
+ var nodes []*yaml.Node
+
+ for _, item := range s {
+ nn, err := json2yaml(item.Value)
+ if err != nil {
+ return nil, err
+ }
+
+ ns := []*yaml.Node{
+ {
+ Kind: yaml.ScalarNode,
+ Tag: yamlStringScalar,
+ Value: item.Key,
+ },
+ nn,
+ }
+ nodes = append(nodes, ns...)
+ }
+
+ n.Content = []*yaml.Node{
+ {
+ Kind: yaml.MappingNode,
+ Content: nodes,
+ },
+ }
+
+ return yaml.Marshal(&n)
+}
+
+// UnmarshalYAML builds a YAMLMapSlice object from a YAML document [yaml.Node].
+//
+// It implements [yaml.Unmarshaler].
+func (s *YAMLMapSlice) UnmarshalYAML(node *yaml.Node) error {
+ if typeutils.IsNil(*s) {
+ // allow to unmarshal with a simple var declaration (nil slice)
+ *s = YAMLMapSlice{}
+ }
+ if node == nil {
+ *s = nil
+ return nil
+ }
+
+ const sensibleAllocDivider = 2
+ m := slices.Grow(*s, len(node.Content)/sensibleAllocDivider)
+ m = m[:0]
+
+ for i := 0; i < len(node.Content); i += 2 {
+ var nmi YAMLMapItem
+ k, err := yamlStringScalarC(node.Content[i])
+ if err != nil {
+ return fmt.Errorf("unable to decode YAML map key: %w: %w", err, ErrYAML)
+ }
+ nmi.Key = k
+ v, err := yamlNode(node.Content[i+1])
+ if err != nil {
+ return fmt.Errorf("unable to process YAML map value for key %q: %w: %w", k, err, ErrYAML)
+ }
+ nmi.Value = v
+ m = append(m, nmi)
+ }
+
+ *s = m
+
+ return nil
+}
+
+func json2yaml(item any) (*yaml.Node, error) {
+ if typeutils.IsNil(item) {
+ return &yaml.Node{
+ Kind: yaml.ScalarNode,
+ Value: "null",
+ }, nil
+ }
+
+ switch val := item.(type) {
+ case ifaces.Ordered:
+ return orderedYAML(val)
+
+ case map[string]any:
+ var n yaml.Node
+ n.Kind = yaml.MappingNode
+ keys := make([]string, 0, len(val))
+ for k := range val {
+ keys = append(keys, k)
+ }
+ sort.Strings(keys)
+
+ for _, k := range keys {
+ v := val[k]
+ childNode, err := json2yaml(v)
+ if err != nil {
+ return nil, err
+ }
+ n.Content = append(n.Content, &yaml.Node{
+ Kind: yaml.ScalarNode,
+ Tag: yamlStringScalar,
+ Value: k,
+ }, childNode)
+ }
+ return &n, nil
+
+ case []any:
+ var n yaml.Node
+ n.Kind = yaml.SequenceNode
+ for i := range val {
+ childNode, err := json2yaml(val[i])
+ if err != nil {
+ return nil, err
+ }
+ n.Content = append(n.Content, childNode)
+ }
+ return &n, nil
+ case string:
+ return &yaml.Node{
+ Kind: yaml.ScalarNode,
+ Tag: yamlStringScalar,
+ Value: val,
+ }, nil
+ case float32:
+ return floatNode(val)
+ case float64:
+ return floatNode(val)
+ case int:
+ return integerNode(val)
+ case int8:
+ return integerNode(val)
+ case int16:
+ return integerNode(val)
+ case int32:
+ return integerNode(val)
+ case int64:
+ return integerNode(val)
+ case uint:
+ return uintegerNode(val)
+ case uint8:
+ return uintegerNode(val)
+ case uint16:
+ return uintegerNode(val)
+ case uint32:
+ return uintegerNode(val)
+ case uint64:
+ return uintegerNode(val)
+ case bool:
+ return &yaml.Node{
+ Kind: yaml.ScalarNode,
+ Tag: yamlBoolScalar,
+ Value: strconv.FormatBool(val),
+ }, nil
+ default:
+ return nil, fmt.Errorf("unhandled type: %T: %w", val, ErrYAML)
+ }
+}
+
+func floatNode[T conv.Float](val T) (*yaml.Node, error) {
+ return &yaml.Node{
+ Kind: yaml.ScalarNode,
+ Tag: yamlFloatScalar,
+ Value: conv.FormatFloat(val),
+ }, nil
+}
+
+func integerNode[T conv.Signed](val T) (*yaml.Node, error) {
+ return &yaml.Node{
+ Kind: yaml.ScalarNode,
+ Tag: yamlIntScalar,
+ Value: conv.FormatInteger(val),
+ }, nil
+}
+
+func uintegerNode[T conv.Unsigned](val T) (*yaml.Node, error) {
+ return &yaml.Node{
+ Kind: yaml.ScalarNode,
+ Tag: yamlIntScalar,
+ Value: conv.FormatUinteger(val),
+ }, nil
+}
+
+func orderedYAML[T ifaces.Ordered](val T) (*yaml.Node, error) {
+ var n yaml.Node
+ n.Kind = yaml.MappingNode
+ for key, value := range val.OrderedItems() {
+ childNode, err := json2yaml(value)
+ if err != nil {
+ return nil, err
+ }
+
+ n.Content = append(n.Content, &yaml.Node{
+ Kind: yaml.ScalarNode,
+ Tag: yamlStringScalar,
+ Value: key,
+ }, childNode)
+ }
+ return &n, nil
+}
diff --git a/vendor/github.com/go-openapi/swag/yamlutils/yaml.go b/vendor/github.com/go-openapi/swag/yamlutils/yaml.go
new file mode 100644
index 000000000..e3aff3c2f
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/yamlutils/yaml.go
@@ -0,0 +1,211 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package yamlutils
+
+import (
+ json "encoding/json"
+ "fmt"
+ "strconv"
+
+ "github.com/go-openapi/swag/jsonutils"
+ yaml "go.yaml.in/yaml/v3"
+)
+
+// YAMLToJSON converts a YAML document into JSON bytes.
+//
+// Note: a YAML document is the output from a [yaml.Marshaler], e.g a pointer to a [yaml.Node].
+//
+// [YAMLToJSON] is typically called after [BytesToYAMLDoc].
+func YAMLToJSON(value any) (json.RawMessage, error) {
+ jm, err := transformData(value)
+ if err != nil {
+ return nil, err
+ }
+
+ b, err := jsonutils.WriteJSON(jm)
+
+ return json.RawMessage(b), err
+}
+
+// BytesToYAMLDoc converts a byte slice into a YAML document.
+//
+// This function only supports root documents that are objects.
+//
+// A YAML document is a pointer to a [yaml.Node].
+func BytesToYAMLDoc(data []byte) (any, error) {
+ var document yaml.Node // preserve order that is present in the document
+ if err := yaml.Unmarshal(data, &document); err != nil {
+ return nil, err
+ }
+ if document.Kind != yaml.DocumentNode || len(document.Content) != 1 || document.Content[0].Kind != yaml.MappingNode {
+ return nil, fmt.Errorf("only YAML documents that are objects are supported: %w", ErrYAML)
+ }
+ return &document, nil
+}
+
+func yamlNode(root *yaml.Node) (any, error) {
+ switch root.Kind {
+ case yaml.DocumentNode:
+ return yamlDocument(root)
+ case yaml.SequenceNode:
+ return yamlSequence(root)
+ case yaml.MappingNode:
+ return yamlMapping(root)
+ case yaml.ScalarNode:
+ return yamlScalar(root)
+ case yaml.AliasNode:
+ return yamlNode(root.Alias)
+ default:
+ return nil, fmt.Errorf("unsupported YAML node type: %v: %w", root.Kind, ErrYAML)
+ }
+}
+
+func yamlDocument(node *yaml.Node) (any, error) {
+ if len(node.Content) != 1 {
+ return nil, fmt.Errorf("unexpected YAML Document node content length: %d: %w", len(node.Content), ErrYAML)
+ }
+ return yamlNode(node.Content[0])
+}
+
+func yamlMapping(node *yaml.Node) (any, error) {
+ const sensibleAllocDivider = 2 // nodes concatenate (key,value) sequences
+ m := make(YAMLMapSlice, len(node.Content)/sensibleAllocDivider)
+
+ if err := m.UnmarshalYAML(node); err != nil {
+ return nil, err
+ }
+
+ return m, nil
+}
+
+func yamlSequence(node *yaml.Node) (any, error) {
+ s := make([]any, 0)
+
+ for i := range len(node.Content) {
+ v, err := yamlNode(node.Content[i])
+ if err != nil {
+ return nil, fmt.Errorf("unable to decode YAML sequence value: %w: %w", err, ErrYAML)
+ }
+ s = append(s, v)
+ }
+ return s, nil
+}
+
+const ( // See https://yaml.org/type/
+ yamlStringScalar = "tag:yaml.org,2002:str"
+ yamlIntScalar = "tag:yaml.org,2002:int"
+ yamlBoolScalar = "tag:yaml.org,2002:bool"
+ yamlFloatScalar = "tag:yaml.org,2002:float"
+ yamlTimestamp = "tag:yaml.org,2002:timestamp"
+ yamlNull = "tag:yaml.org,2002:null"
+)
+
+func yamlScalar(node *yaml.Node) (any, error) {
+ switch node.LongTag() {
+ case yamlStringScalar:
+ return node.Value, nil
+ case yamlBoolScalar:
+ b, err := strconv.ParseBool(node.Value)
+ if err != nil {
+ return nil, fmt.Errorf("unable to process scalar node. Got %q. Expecting bool content: %w: %w", node.Value, err, ErrYAML)
+ }
+ return b, nil
+ case yamlIntScalar:
+ i, err := strconv.ParseInt(node.Value, 10, 64)
+ if err != nil {
+ return nil, fmt.Errorf("unable to process scalar node. Got %q. Expecting integer content: %w: %w", node.Value, err, ErrYAML)
+ }
+ return i, nil
+ case yamlFloatScalar:
+ f, err := strconv.ParseFloat(node.Value, 64)
+ if err != nil {
+ return nil, fmt.Errorf("unable to process scalar node. Got %q. Expecting float content: %w: %w", node.Value, err, ErrYAML)
+ }
+ return f, nil
+ case yamlTimestamp:
+ // YAML timestamp is marshaled as string, not time
+ return node.Value, nil
+ case yamlNull:
+ return nil, nil //nolint:nilnil
+ default:
+ return nil, fmt.Errorf("YAML tag %q is not supported: %w", node.LongTag(), ErrYAML)
+ }
+}
+
+func yamlStringScalarC(node *yaml.Node) (string, error) {
+ if node.Kind != yaml.ScalarNode {
+ return "", fmt.Errorf("expecting a string scalar but got %q: %w", node.Kind, ErrYAML)
+ }
+ switch node.LongTag() {
+ case yamlStringScalar, yamlIntScalar, yamlFloatScalar:
+ return node.Value, nil
+ default:
+ return "", fmt.Errorf("YAML tag %q is not supported as map key: %w", node.LongTag(), ErrYAML)
+ }
+}
+
+func format(t any) (string, error) {
+ switch k := t.(type) {
+ case string:
+ return k, nil
+ case uint:
+ return strconv.FormatUint(uint64(k), 10), nil
+ case uint8:
+ return strconv.FormatUint(uint64(k), 10), nil
+ case uint16:
+ return strconv.FormatUint(uint64(k), 10), nil
+ case uint32:
+ return strconv.FormatUint(uint64(k), 10), nil
+ case uint64:
+ return strconv.FormatUint(k, 10), nil
+ case int:
+ return strconv.Itoa(k), nil
+ case int8:
+ return strconv.FormatInt(int64(k), 10), nil
+ case int16:
+ return strconv.FormatInt(int64(k), 10), nil
+ case int32:
+ return strconv.FormatInt(int64(k), 10), nil
+ case int64:
+ return strconv.FormatInt(k, 10), nil
+ default:
+ return "", fmt.Errorf("unexpected map key type, got: %T: %w", k, ErrYAML)
+ }
+}
+
+func transformData(input any) (out any, err error) {
+ switch in := input.(type) {
+ case yaml.Node:
+ return yamlNode(&in)
+ case *yaml.Node:
+ return yamlNode(in)
+ case map[any]any:
+ o := make(YAMLMapSlice, 0, len(in))
+ for ke, va := range in {
+ var nmi YAMLMapItem
+ if nmi.Key, err = format(ke); err != nil {
+ return nil, err
+ }
+
+ v, ert := transformData(va)
+ if ert != nil {
+ return nil, ert
+ }
+ nmi.Value = v
+ o = append(o, nmi)
+ }
+ return o, nil
+ case []any:
+ len1 := len(in)
+ o := make([]any, len1)
+ for i := range len1 {
+ o[i], err = transformData(in[i])
+ if err != nil {
+ return nil, err
+ }
+ }
+ return o, nil
+ }
+ return input, nil
+}
diff --git a/vendor/github.com/go-openapi/swag/yamlutils_iface.go b/vendor/github.com/go-openapi/swag/yamlutils_iface.go
new file mode 100644
index 000000000..57767efc5
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/yamlutils_iface.go
@@ -0,0 +1,20 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package swag
+
+import (
+ "encoding/json"
+
+ "github.com/go-openapi/swag/yamlutils"
+)
+
+// YAMLToJSON converts YAML unmarshaled data into json compatible data
+//
+// Deprecated: use [yamlutils.YAMLToJSON] instead.
+func YAMLToJSON(data any) (json.RawMessage, error) { return yamlutils.YAMLToJSON(data) }
+
+// BytesToYAMLDoc converts a byte slice into a YAML document
+//
+// Deprecated: use [yamlutils.BytesToYAMLDoc] instead.
+func BytesToYAMLDoc(data []byte) (any, error) { return yamlutils.BytesToYAMLDoc(data) }
diff --git a/vendor/github.com/google/btree/README.md b/vendor/github.com/google/btree/README.md
deleted file mode 100644
index eab5dbf7b..000000000
--- a/vendor/github.com/google/btree/README.md
+++ /dev/null
@@ -1,10 +0,0 @@
-# BTree implementation for Go
-
-This package provides an in-memory B-Tree implementation for Go, useful as
-an ordered, mutable data structure.
-
-The API is based off of the wonderful
-http://godoc.org/github.com/petar/GoLLRB/llrb, and is meant to allow btree to
-act as a drop-in replacement for gollrb trees.
-
-See http://godoc.org/github.com/google/btree for documentation.
diff --git a/vendor/github.com/google/btree/btree.go b/vendor/github.com/google/btree/btree.go
deleted file mode 100644
index 6f5184fef..000000000
--- a/vendor/github.com/google/btree/btree.go
+++ /dev/null
@@ -1,893 +0,0 @@
-// Copyright 2014 Google Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build !go1.18
-// +build !go1.18
-
-// Package btree implements in-memory B-Trees of arbitrary degree.
-//
-// btree implements an in-memory B-Tree for use as an ordered data structure.
-// It is not meant for persistent storage solutions.
-//
-// It has a flatter structure than an equivalent red-black or other binary tree,
-// which in some cases yields better memory usage and/or performance.
-// See some discussion on the matter here:
-// http://google-opensource.blogspot.com/2013/01/c-containers-that-save-memory-and-time.html
-// Note, though, that this project is in no way related to the C++ B-Tree
-// implementation written about there.
-//
-// Within this tree, each node contains a slice of items and a (possibly nil)
-// slice of children. For basic numeric values or raw structs, this can cause
-// efficiency differences when compared to equivalent C++ template code that
-// stores values in arrays within the node:
-// * Due to the overhead of storing values as interfaces (each
-// value needs to be stored as the value itself, then 2 words for the
-// interface pointing to that value and its type), resulting in higher
-// memory use.
-// * Since interfaces can point to values anywhere in memory, values are
-// most likely not stored in contiguous blocks, resulting in a higher
-// number of cache misses.
-// These issues don't tend to matter, though, when working with strings or other
-// heap-allocated structures, since C++-equivalent structures also must store
-// pointers and also distribute their values across the heap.
-//
-// This implementation is designed to be a drop-in replacement to gollrb.LLRB
-// trees, (http://github.com/petar/gollrb), an excellent and probably the most
-// widely used ordered tree implementation in the Go ecosystem currently.
-// Its functions, therefore, exactly mirror those of
-// llrb.LLRB where possible. Unlike gollrb, though, we currently don't
-// support storing multiple equivalent values.
-package btree
-
-import (
- "fmt"
- "io"
- "sort"
- "strings"
- "sync"
-)
-
-// Item represents a single object in the tree.
-type Item interface {
- // Less tests whether the current item is less than the given argument.
- //
- // This must provide a strict weak ordering.
- // If !a.Less(b) && !b.Less(a), we treat this to mean a == b (i.e. we can only
- // hold one of either a or b in the tree).
- Less(than Item) bool
-}
-
-const (
- DefaultFreeListSize = 32
-)
-
-var (
- nilItems = make(items, 16)
- nilChildren = make(children, 16)
-)
-
-// FreeList represents a free list of btree nodes. By default each
-// BTree has its own FreeList, but multiple BTrees can share the same
-// FreeList.
-// Two Btrees using the same freelist are safe for concurrent write access.
-type FreeList struct {
- mu sync.Mutex
- freelist []*node
-}
-
-// NewFreeList creates a new free list.
-// size is the maximum size of the returned free list.
-func NewFreeList(size int) *FreeList {
- return &FreeList{freelist: make([]*node, 0, size)}
-}
-
-func (f *FreeList) newNode() (n *node) {
- f.mu.Lock()
- index := len(f.freelist) - 1
- if index < 0 {
- f.mu.Unlock()
- return new(node)
- }
- n = f.freelist[index]
- f.freelist[index] = nil
- f.freelist = f.freelist[:index]
- f.mu.Unlock()
- return
-}
-
-// freeNode adds the given node to the list, returning true if it was added
-// and false if it was discarded.
-func (f *FreeList) freeNode(n *node) (out bool) {
- f.mu.Lock()
- if len(f.freelist) < cap(f.freelist) {
- f.freelist = append(f.freelist, n)
- out = true
- }
- f.mu.Unlock()
- return
-}
-
-// ItemIterator allows callers of Ascend* to iterate in-order over portions of
-// the tree. When this function returns false, iteration will stop and the
-// associated Ascend* function will immediately return.
-type ItemIterator func(i Item) bool
-
-// New creates a new B-Tree with the given degree.
-//
-// New(2), for example, will create a 2-3-4 tree (each node contains 1-3 items
-// and 2-4 children).
-func New(degree int) *BTree {
- return NewWithFreeList(degree, NewFreeList(DefaultFreeListSize))
-}
-
-// NewWithFreeList creates a new B-Tree that uses the given node free list.
-func NewWithFreeList(degree int, f *FreeList) *BTree {
- if degree <= 1 {
- panic("bad degree")
- }
- return &BTree{
- degree: degree,
- cow: ©OnWriteContext{freelist: f},
- }
-}
-
-// items stores items in a node.
-type items []Item
-
-// insertAt inserts a value into the given index, pushing all subsequent values
-// forward.
-func (s *items) insertAt(index int, item Item) {
- *s = append(*s, nil)
- if index < len(*s) {
- copy((*s)[index+1:], (*s)[index:])
- }
- (*s)[index] = item
-}
-
-// removeAt removes a value at a given index, pulling all subsequent values
-// back.
-func (s *items) removeAt(index int) Item {
- item := (*s)[index]
- copy((*s)[index:], (*s)[index+1:])
- (*s)[len(*s)-1] = nil
- *s = (*s)[:len(*s)-1]
- return item
-}
-
-// pop removes and returns the last element in the list.
-func (s *items) pop() (out Item) {
- index := len(*s) - 1
- out = (*s)[index]
- (*s)[index] = nil
- *s = (*s)[:index]
- return
-}
-
-// truncate truncates this instance at index so that it contains only the
-// first index items. index must be less than or equal to length.
-func (s *items) truncate(index int) {
- var toClear items
- *s, toClear = (*s)[:index], (*s)[index:]
- for len(toClear) > 0 {
- toClear = toClear[copy(toClear, nilItems):]
- }
-}
-
-// find returns the index where the given item should be inserted into this
-// list. 'found' is true if the item already exists in the list at the given
-// index.
-func (s items) find(item Item) (index int, found bool) {
- i := sort.Search(len(s), func(i int) bool {
- return item.Less(s[i])
- })
- if i > 0 && !s[i-1].Less(item) {
- return i - 1, true
- }
- return i, false
-}
-
-// children stores child nodes in a node.
-type children []*node
-
-// insertAt inserts a value into the given index, pushing all subsequent values
-// forward.
-func (s *children) insertAt(index int, n *node) {
- *s = append(*s, nil)
- if index < len(*s) {
- copy((*s)[index+1:], (*s)[index:])
- }
- (*s)[index] = n
-}
-
-// removeAt removes a value at a given index, pulling all subsequent values
-// back.
-func (s *children) removeAt(index int) *node {
- n := (*s)[index]
- copy((*s)[index:], (*s)[index+1:])
- (*s)[len(*s)-1] = nil
- *s = (*s)[:len(*s)-1]
- return n
-}
-
-// pop removes and returns the last element in the list.
-func (s *children) pop() (out *node) {
- index := len(*s) - 1
- out = (*s)[index]
- (*s)[index] = nil
- *s = (*s)[:index]
- return
-}
-
-// truncate truncates this instance at index so that it contains only the
-// first index children. index must be less than or equal to length.
-func (s *children) truncate(index int) {
- var toClear children
- *s, toClear = (*s)[:index], (*s)[index:]
- for len(toClear) > 0 {
- toClear = toClear[copy(toClear, nilChildren):]
- }
-}
-
-// node is an internal node in a tree.
-//
-// It must at all times maintain the invariant that either
-// * len(children) == 0, len(items) unconstrained
-// * len(children) == len(items) + 1
-type node struct {
- items items
- children children
- cow *copyOnWriteContext
-}
-
-func (n *node) mutableFor(cow *copyOnWriteContext) *node {
- if n.cow == cow {
- return n
- }
- out := cow.newNode()
- if cap(out.items) >= len(n.items) {
- out.items = out.items[:len(n.items)]
- } else {
- out.items = make(items, len(n.items), cap(n.items))
- }
- copy(out.items, n.items)
- // Copy children
- if cap(out.children) >= len(n.children) {
- out.children = out.children[:len(n.children)]
- } else {
- out.children = make(children, len(n.children), cap(n.children))
- }
- copy(out.children, n.children)
- return out
-}
-
-func (n *node) mutableChild(i int) *node {
- c := n.children[i].mutableFor(n.cow)
- n.children[i] = c
- return c
-}
-
-// split splits the given node at the given index. The current node shrinks,
-// and this function returns the item that existed at that index and a new node
-// containing all items/children after it.
-func (n *node) split(i int) (Item, *node) {
- item := n.items[i]
- next := n.cow.newNode()
- next.items = append(next.items, n.items[i+1:]...)
- n.items.truncate(i)
- if len(n.children) > 0 {
- next.children = append(next.children, n.children[i+1:]...)
- n.children.truncate(i + 1)
- }
- return item, next
-}
-
-// maybeSplitChild checks if a child should be split, and if so splits it.
-// Returns whether or not a split occurred.
-func (n *node) maybeSplitChild(i, maxItems int) bool {
- if len(n.children[i].items) < maxItems {
- return false
- }
- first := n.mutableChild(i)
- item, second := first.split(maxItems / 2)
- n.items.insertAt(i, item)
- n.children.insertAt(i+1, second)
- return true
-}
-
-// insert inserts an item into the subtree rooted at this node, making sure
-// no nodes in the subtree exceed maxItems items. Should an equivalent item be
-// be found/replaced by insert, it will be returned.
-func (n *node) insert(item Item, maxItems int) Item {
- i, found := n.items.find(item)
- if found {
- out := n.items[i]
- n.items[i] = item
- return out
- }
- if len(n.children) == 0 {
- n.items.insertAt(i, item)
- return nil
- }
- if n.maybeSplitChild(i, maxItems) {
- inTree := n.items[i]
- switch {
- case item.Less(inTree):
- // no change, we want first split node
- case inTree.Less(item):
- i++ // we want second split node
- default:
- out := n.items[i]
- n.items[i] = item
- return out
- }
- }
- return n.mutableChild(i).insert(item, maxItems)
-}
-
-// get finds the given key in the subtree and returns it.
-func (n *node) get(key Item) Item {
- i, found := n.items.find(key)
- if found {
- return n.items[i]
- } else if len(n.children) > 0 {
- return n.children[i].get(key)
- }
- return nil
-}
-
-// min returns the first item in the subtree.
-func min(n *node) Item {
- if n == nil {
- return nil
- }
- for len(n.children) > 0 {
- n = n.children[0]
- }
- if len(n.items) == 0 {
- return nil
- }
- return n.items[0]
-}
-
-// max returns the last item in the subtree.
-func max(n *node) Item {
- if n == nil {
- return nil
- }
- for len(n.children) > 0 {
- n = n.children[len(n.children)-1]
- }
- if len(n.items) == 0 {
- return nil
- }
- return n.items[len(n.items)-1]
-}
-
-// toRemove details what item to remove in a node.remove call.
-type toRemove int
-
-const (
- removeItem toRemove = iota // removes the given item
- removeMin // removes smallest item in the subtree
- removeMax // removes largest item in the subtree
-)
-
-// remove removes an item from the subtree rooted at this node.
-func (n *node) remove(item Item, minItems int, typ toRemove) Item {
- var i int
- var found bool
- switch typ {
- case removeMax:
- if len(n.children) == 0 {
- return n.items.pop()
- }
- i = len(n.items)
- case removeMin:
- if len(n.children) == 0 {
- return n.items.removeAt(0)
- }
- i = 0
- case removeItem:
- i, found = n.items.find(item)
- if len(n.children) == 0 {
- if found {
- return n.items.removeAt(i)
- }
- return nil
- }
- default:
- panic("invalid type")
- }
- // If we get to here, we have children.
- if len(n.children[i].items) <= minItems {
- return n.growChildAndRemove(i, item, minItems, typ)
- }
- child := n.mutableChild(i)
- // Either we had enough items to begin with, or we've done some
- // merging/stealing, because we've got enough now and we're ready to return
- // stuff.
- if found {
- // The item exists at index 'i', and the child we've selected can give us a
- // predecessor, since if we've gotten here it's got > minItems items in it.
- out := n.items[i]
- // We use our special-case 'remove' call with typ=maxItem to pull the
- // predecessor of item i (the rightmost leaf of our immediate left child)
- // and set it into where we pulled the item from.
- n.items[i] = child.remove(nil, minItems, removeMax)
- return out
- }
- // Final recursive call. Once we're here, we know that the item isn't in this
- // node and that the child is big enough to remove from.
- return child.remove(item, minItems, typ)
-}
-
-// growChildAndRemove grows child 'i' to make sure it's possible to remove an
-// item from it while keeping it at minItems, then calls remove to actually
-// remove it.
-//
-// Most documentation says we have to do two sets of special casing:
-// 1) item is in this node
-// 2) item is in child
-// In both cases, we need to handle the two subcases:
-// A) node has enough values that it can spare one
-// B) node doesn't have enough values
-// For the latter, we have to check:
-// a) left sibling has node to spare
-// b) right sibling has node to spare
-// c) we must merge
-// To simplify our code here, we handle cases #1 and #2 the same:
-// If a node doesn't have enough items, we make sure it does (using a,b,c).
-// We then simply redo our remove call, and the second time (regardless of
-// whether we're in case 1 or 2), we'll have enough items and can guarantee
-// that we hit case A.
-func (n *node) growChildAndRemove(i int, item Item, minItems int, typ toRemove) Item {
- if i > 0 && len(n.children[i-1].items) > minItems {
- // Steal from left child
- child := n.mutableChild(i)
- stealFrom := n.mutableChild(i - 1)
- stolenItem := stealFrom.items.pop()
- child.items.insertAt(0, n.items[i-1])
- n.items[i-1] = stolenItem
- if len(stealFrom.children) > 0 {
- child.children.insertAt(0, stealFrom.children.pop())
- }
- } else if i < len(n.items) && len(n.children[i+1].items) > minItems {
- // steal from right child
- child := n.mutableChild(i)
- stealFrom := n.mutableChild(i + 1)
- stolenItem := stealFrom.items.removeAt(0)
- child.items = append(child.items, n.items[i])
- n.items[i] = stolenItem
- if len(stealFrom.children) > 0 {
- child.children = append(child.children, stealFrom.children.removeAt(0))
- }
- } else {
- if i >= len(n.items) {
- i--
- }
- child := n.mutableChild(i)
- // merge with right child
- mergeItem := n.items.removeAt(i)
- mergeChild := n.children.removeAt(i + 1).mutableFor(n.cow)
- child.items = append(child.items, mergeItem)
- child.items = append(child.items, mergeChild.items...)
- child.children = append(child.children, mergeChild.children...)
- n.cow.freeNode(mergeChild)
- }
- return n.remove(item, minItems, typ)
-}
-
-type direction int
-
-const (
- descend = direction(-1)
- ascend = direction(+1)
-)
-
-// iterate provides a simple method for iterating over elements in the tree.
-//
-// When ascending, the 'start' should be less than 'stop' and when descending,
-// the 'start' should be greater than 'stop'. Setting 'includeStart' to true
-// will force the iterator to include the first item when it equals 'start',
-// thus creating a "greaterOrEqual" or "lessThanEqual" rather than just a
-// "greaterThan" or "lessThan" queries.
-func (n *node) iterate(dir direction, start, stop Item, includeStart bool, hit bool, iter ItemIterator) (bool, bool) {
- var ok, found bool
- var index int
- switch dir {
- case ascend:
- if start != nil {
- index, _ = n.items.find(start)
- }
- for i := index; i < len(n.items); i++ {
- if len(n.children) > 0 {
- if hit, ok = n.children[i].iterate(dir, start, stop, includeStart, hit, iter); !ok {
- return hit, false
- }
- }
- if !includeStart && !hit && start != nil && !start.Less(n.items[i]) {
- hit = true
- continue
- }
- hit = true
- if stop != nil && !n.items[i].Less(stop) {
- return hit, false
- }
- if !iter(n.items[i]) {
- return hit, false
- }
- }
- if len(n.children) > 0 {
- if hit, ok = n.children[len(n.children)-1].iterate(dir, start, stop, includeStart, hit, iter); !ok {
- return hit, false
- }
- }
- case descend:
- if start != nil {
- index, found = n.items.find(start)
- if !found {
- index = index - 1
- }
- } else {
- index = len(n.items) - 1
- }
- for i := index; i >= 0; i-- {
- if start != nil && !n.items[i].Less(start) {
- if !includeStart || hit || start.Less(n.items[i]) {
- continue
- }
- }
- if len(n.children) > 0 {
- if hit, ok = n.children[i+1].iterate(dir, start, stop, includeStart, hit, iter); !ok {
- return hit, false
- }
- }
- if stop != nil && !stop.Less(n.items[i]) {
- return hit, false // continue
- }
- hit = true
- if !iter(n.items[i]) {
- return hit, false
- }
- }
- if len(n.children) > 0 {
- if hit, ok = n.children[0].iterate(dir, start, stop, includeStart, hit, iter); !ok {
- return hit, false
- }
- }
- }
- return hit, true
-}
-
-// Used for testing/debugging purposes.
-func (n *node) print(w io.Writer, level int) {
- fmt.Fprintf(w, "%sNODE:%v\n", strings.Repeat(" ", level), n.items)
- for _, c := range n.children {
- c.print(w, level+1)
- }
-}
-
-// BTree is an implementation of a B-Tree.
-//
-// BTree stores Item instances in an ordered structure, allowing easy insertion,
-// removal, and iteration.
-//
-// Write operations are not safe for concurrent mutation by multiple
-// goroutines, but Read operations are.
-type BTree struct {
- degree int
- length int
- root *node
- cow *copyOnWriteContext
-}
-
-// copyOnWriteContext pointers determine node ownership... a tree with a write
-// context equivalent to a node's write context is allowed to modify that node.
-// A tree whose write context does not match a node's is not allowed to modify
-// it, and must create a new, writable copy (IE: it's a Clone).
-//
-// When doing any write operation, we maintain the invariant that the current
-// node's context is equal to the context of the tree that requested the write.
-// We do this by, before we descend into any node, creating a copy with the
-// correct context if the contexts don't match.
-//
-// Since the node we're currently visiting on any write has the requesting
-// tree's context, that node is modifiable in place. Children of that node may
-// not share context, but before we descend into them, we'll make a mutable
-// copy.
-type copyOnWriteContext struct {
- freelist *FreeList
-}
-
-// Clone clones the btree, lazily. Clone should not be called concurrently,
-// but the original tree (t) and the new tree (t2) can be used concurrently
-// once the Clone call completes.
-//
-// The internal tree structure of b is marked read-only and shared between t and
-// t2. Writes to both t and t2 use copy-on-write logic, creating new nodes
-// whenever one of b's original nodes would have been modified. Read operations
-// should have no performance degredation. Write operations for both t and t2
-// will initially experience minor slow-downs caused by additional allocs and
-// copies due to the aforementioned copy-on-write logic, but should converge to
-// the original performance characteristics of the original tree.
-func (t *BTree) Clone() (t2 *BTree) {
- // Create two entirely new copy-on-write contexts.
- // This operation effectively creates three trees:
- // the original, shared nodes (old b.cow)
- // the new b.cow nodes
- // the new out.cow nodes
- cow1, cow2 := *t.cow, *t.cow
- out := *t
- t.cow = &cow1
- out.cow = &cow2
- return &out
-}
-
-// maxItems returns the max number of items to allow per node.
-func (t *BTree) maxItems() int {
- return t.degree*2 - 1
-}
-
-// minItems returns the min number of items to allow per node (ignored for the
-// root node).
-func (t *BTree) minItems() int {
- return t.degree - 1
-}
-
-func (c *copyOnWriteContext) newNode() (n *node) {
- n = c.freelist.newNode()
- n.cow = c
- return
-}
-
-type freeType int
-
-const (
- ftFreelistFull freeType = iota // node was freed (available for GC, not stored in freelist)
- ftStored // node was stored in the freelist for later use
- ftNotOwned // node was ignored by COW, since it's owned by another one
-)
-
-// freeNode frees a node within a given COW context, if it's owned by that
-// context. It returns what happened to the node (see freeType const
-// documentation).
-func (c *copyOnWriteContext) freeNode(n *node) freeType {
- if n.cow == c {
- // clear to allow GC
- n.items.truncate(0)
- n.children.truncate(0)
- n.cow = nil
- if c.freelist.freeNode(n) {
- return ftStored
- } else {
- return ftFreelistFull
- }
- } else {
- return ftNotOwned
- }
-}
-
-// ReplaceOrInsert adds the given item to the tree. If an item in the tree
-// already equals the given one, it is removed from the tree and returned.
-// Otherwise, nil is returned.
-//
-// nil cannot be added to the tree (will panic).
-func (t *BTree) ReplaceOrInsert(item Item) Item {
- if item == nil {
- panic("nil item being added to BTree")
- }
- if t.root == nil {
- t.root = t.cow.newNode()
- t.root.items = append(t.root.items, item)
- t.length++
- return nil
- } else {
- t.root = t.root.mutableFor(t.cow)
- if len(t.root.items) >= t.maxItems() {
- item2, second := t.root.split(t.maxItems() / 2)
- oldroot := t.root
- t.root = t.cow.newNode()
- t.root.items = append(t.root.items, item2)
- t.root.children = append(t.root.children, oldroot, second)
- }
- }
- out := t.root.insert(item, t.maxItems())
- if out == nil {
- t.length++
- }
- return out
-}
-
-// Delete removes an item equal to the passed in item from the tree, returning
-// it. If no such item exists, returns nil.
-func (t *BTree) Delete(item Item) Item {
- return t.deleteItem(item, removeItem)
-}
-
-// DeleteMin removes the smallest item in the tree and returns it.
-// If no such item exists, returns nil.
-func (t *BTree) DeleteMin() Item {
- return t.deleteItem(nil, removeMin)
-}
-
-// DeleteMax removes the largest item in the tree and returns it.
-// If no such item exists, returns nil.
-func (t *BTree) DeleteMax() Item {
- return t.deleteItem(nil, removeMax)
-}
-
-func (t *BTree) deleteItem(item Item, typ toRemove) Item {
- if t.root == nil || len(t.root.items) == 0 {
- return nil
- }
- t.root = t.root.mutableFor(t.cow)
- out := t.root.remove(item, t.minItems(), typ)
- if len(t.root.items) == 0 && len(t.root.children) > 0 {
- oldroot := t.root
- t.root = t.root.children[0]
- t.cow.freeNode(oldroot)
- }
- if out != nil {
- t.length--
- }
- return out
-}
-
-// AscendRange calls the iterator for every value in the tree within the range
-// [greaterOrEqual, lessThan), until iterator returns false.
-func (t *BTree) AscendRange(greaterOrEqual, lessThan Item, iterator ItemIterator) {
- if t.root == nil {
- return
- }
- t.root.iterate(ascend, greaterOrEqual, lessThan, true, false, iterator)
-}
-
-// AscendLessThan calls the iterator for every value in the tree within the range
-// [first, pivot), until iterator returns false.
-func (t *BTree) AscendLessThan(pivot Item, iterator ItemIterator) {
- if t.root == nil {
- return
- }
- t.root.iterate(ascend, nil, pivot, false, false, iterator)
-}
-
-// AscendGreaterOrEqual calls the iterator for every value in the tree within
-// the range [pivot, last], until iterator returns false.
-func (t *BTree) AscendGreaterOrEqual(pivot Item, iterator ItemIterator) {
- if t.root == nil {
- return
- }
- t.root.iterate(ascend, pivot, nil, true, false, iterator)
-}
-
-// Ascend calls the iterator for every value in the tree within the range
-// [first, last], until iterator returns false.
-func (t *BTree) Ascend(iterator ItemIterator) {
- if t.root == nil {
- return
- }
- t.root.iterate(ascend, nil, nil, false, false, iterator)
-}
-
-// DescendRange calls the iterator for every value in the tree within the range
-// [lessOrEqual, greaterThan), until iterator returns false.
-func (t *BTree) DescendRange(lessOrEqual, greaterThan Item, iterator ItemIterator) {
- if t.root == nil {
- return
- }
- t.root.iterate(descend, lessOrEqual, greaterThan, true, false, iterator)
-}
-
-// DescendLessOrEqual calls the iterator for every value in the tree within the range
-// [pivot, first], until iterator returns false.
-func (t *BTree) DescendLessOrEqual(pivot Item, iterator ItemIterator) {
- if t.root == nil {
- return
- }
- t.root.iterate(descend, pivot, nil, true, false, iterator)
-}
-
-// DescendGreaterThan calls the iterator for every value in the tree within
-// the range [last, pivot), until iterator returns false.
-func (t *BTree) DescendGreaterThan(pivot Item, iterator ItemIterator) {
- if t.root == nil {
- return
- }
- t.root.iterate(descend, nil, pivot, false, false, iterator)
-}
-
-// Descend calls the iterator for every value in the tree within the range
-// [last, first], until iterator returns false.
-func (t *BTree) Descend(iterator ItemIterator) {
- if t.root == nil {
- return
- }
- t.root.iterate(descend, nil, nil, false, false, iterator)
-}
-
-// Get looks for the key item in the tree, returning it. It returns nil if
-// unable to find that item.
-func (t *BTree) Get(key Item) Item {
- if t.root == nil {
- return nil
- }
- return t.root.get(key)
-}
-
-// Min returns the smallest item in the tree, or nil if the tree is empty.
-func (t *BTree) Min() Item {
- return min(t.root)
-}
-
-// Max returns the largest item in the tree, or nil if the tree is empty.
-func (t *BTree) Max() Item {
- return max(t.root)
-}
-
-// Has returns true if the given key is in the tree.
-func (t *BTree) Has(key Item) bool {
- return t.Get(key) != nil
-}
-
-// Len returns the number of items currently in the tree.
-func (t *BTree) Len() int {
- return t.length
-}
-
-// Clear removes all items from the btree. If addNodesToFreelist is true,
-// t's nodes are added to its freelist as part of this call, until the freelist
-// is full. Otherwise, the root node is simply dereferenced and the subtree
-// left to Go's normal GC processes.
-//
-// This can be much faster
-// than calling Delete on all elements, because that requires finding/removing
-// each element in the tree and updating the tree accordingly. It also is
-// somewhat faster than creating a new tree to replace the old one, because
-// nodes from the old tree are reclaimed into the freelist for use by the new
-// one, instead of being lost to the garbage collector.
-//
-// This call takes:
-// O(1): when addNodesToFreelist is false, this is a single operation.
-// O(1): when the freelist is already full, it breaks out immediately
-// O(freelist size): when the freelist is empty and the nodes are all owned
-// by this tree, nodes are added to the freelist until full.
-// O(tree size): when all nodes are owned by another tree, all nodes are
-// iterated over looking for nodes to add to the freelist, and due to
-// ownership, none are.
-func (t *BTree) Clear(addNodesToFreelist bool) {
- if t.root != nil && addNodesToFreelist {
- t.root.reset(t.cow)
- }
- t.root, t.length = nil, 0
-}
-
-// reset returns a subtree to the freelist. It breaks out immediately if the
-// freelist is full, since the only benefit of iterating is to fill that
-// freelist up. Returns true if parent reset call should continue.
-func (n *node) reset(c *copyOnWriteContext) bool {
- for _, child := range n.children {
- if !child.reset(c) {
- return false
- }
- }
- return c.freeNode(n) != ftFreelistFull
-}
-
-// Int implements the Item interface for integers.
-type Int int
-
-// Less returns true if int(a) < int(b).
-func (a Int) Less(b Item) bool {
- return a < b.(Int)
-}
diff --git a/vendor/github.com/google/btree/btree_generic.go b/vendor/github.com/google/btree/btree_generic.go
deleted file mode 100644
index e44a0f488..000000000
--- a/vendor/github.com/google/btree/btree_generic.go
+++ /dev/null
@@ -1,1083 +0,0 @@
-// Copyright 2014-2022 Google Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build go1.18
-// +build go1.18
-
-// In Go 1.18 and beyond, a BTreeG generic is created, and BTree is a specific
-// instantiation of that generic for the Item interface, with a backwards-
-// compatible API. Before go1.18, generics are not supported,
-// and BTree is just an implementation based around the Item interface.
-
-// Package btree implements in-memory B-Trees of arbitrary degree.
-//
-// btree implements an in-memory B-Tree for use as an ordered data structure.
-// It is not meant for persistent storage solutions.
-//
-// It has a flatter structure than an equivalent red-black or other binary tree,
-// which in some cases yields better memory usage and/or performance.
-// See some discussion on the matter here:
-// http://google-opensource.blogspot.com/2013/01/c-containers-that-save-memory-and-time.html
-// Note, though, that this project is in no way related to the C++ B-Tree
-// implementation written about there.
-//
-// Within this tree, each node contains a slice of items and a (possibly nil)
-// slice of children. For basic numeric values or raw structs, this can cause
-// efficiency differences when compared to equivalent C++ template code that
-// stores values in arrays within the node:
-// * Due to the overhead of storing values as interfaces (each
-// value needs to be stored as the value itself, then 2 words for the
-// interface pointing to that value and its type), resulting in higher
-// memory use.
-// * Since interfaces can point to values anywhere in memory, values are
-// most likely not stored in contiguous blocks, resulting in a higher
-// number of cache misses.
-// These issues don't tend to matter, though, when working with strings or other
-// heap-allocated structures, since C++-equivalent structures also must store
-// pointers and also distribute their values across the heap.
-//
-// This implementation is designed to be a drop-in replacement to gollrb.LLRB
-// trees, (http://github.com/petar/gollrb), an excellent and probably the most
-// widely used ordered tree implementation in the Go ecosystem currently.
-// Its functions, therefore, exactly mirror those of
-// llrb.LLRB where possible. Unlike gollrb, though, we currently don't
-// support storing multiple equivalent values.
-//
-// There are two implementations; those suffixed with 'G' are generics, usable
-// for any type, and require a passed-in "less" function to define their ordering.
-// Those without this prefix are specific to the 'Item' interface, and use
-// its 'Less' function for ordering.
-package btree
-
-import (
- "fmt"
- "io"
- "sort"
- "strings"
- "sync"
-)
-
-// Item represents a single object in the tree.
-type Item interface {
- // Less tests whether the current item is less than the given argument.
- //
- // This must provide a strict weak ordering.
- // If !a.Less(b) && !b.Less(a), we treat this to mean a == b (i.e. we can only
- // hold one of either a or b in the tree).
- Less(than Item) bool
-}
-
-const (
- DefaultFreeListSize = 32
-)
-
-// FreeListG represents a free list of btree nodes. By default each
-// BTree has its own FreeList, but multiple BTrees can share the same
-// FreeList, in particular when they're created with Clone.
-// Two Btrees using the same freelist are safe for concurrent write access.
-type FreeListG[T any] struct {
- mu sync.Mutex
- freelist []*node[T]
-}
-
-// NewFreeListG creates a new free list.
-// size is the maximum size of the returned free list.
-func NewFreeListG[T any](size int) *FreeListG[T] {
- return &FreeListG[T]{freelist: make([]*node[T], 0, size)}
-}
-
-func (f *FreeListG[T]) newNode() (n *node[T]) {
- f.mu.Lock()
- index := len(f.freelist) - 1
- if index < 0 {
- f.mu.Unlock()
- return new(node[T])
- }
- n = f.freelist[index]
- f.freelist[index] = nil
- f.freelist = f.freelist[:index]
- f.mu.Unlock()
- return
-}
-
-func (f *FreeListG[T]) freeNode(n *node[T]) (out bool) {
- f.mu.Lock()
- if len(f.freelist) < cap(f.freelist) {
- f.freelist = append(f.freelist, n)
- out = true
- }
- f.mu.Unlock()
- return
-}
-
-// ItemIteratorG allows callers of {A/De}scend* to iterate in-order over portions of
-// the tree. When this function returns false, iteration will stop and the
-// associated Ascend* function will immediately return.
-type ItemIteratorG[T any] func(item T) bool
-
-// Ordered represents the set of types for which the '<' operator work.
-type Ordered interface {
- ~int | ~int8 | ~int16 | ~int32 | ~int64 | ~uint | ~uint8 | ~uint16 | ~uint32 | ~uint64 | ~float32 | ~float64 | ~string
-}
-
-// Less[T] returns a default LessFunc that uses the '<' operator for types that support it.
-func Less[T Ordered]() LessFunc[T] {
- return func(a, b T) bool { return a < b }
-}
-
-// NewOrderedG creates a new B-Tree for ordered types.
-func NewOrderedG[T Ordered](degree int) *BTreeG[T] {
- return NewG[T](degree, Less[T]())
-}
-
-// NewG creates a new B-Tree with the given degree.
-//
-// NewG(2), for example, will create a 2-3-4 tree (each node contains 1-3 items
-// and 2-4 children).
-//
-// The passed-in LessFunc determines how objects of type T are ordered.
-func NewG[T any](degree int, less LessFunc[T]) *BTreeG[T] {
- return NewWithFreeListG(degree, less, NewFreeListG[T](DefaultFreeListSize))
-}
-
-// NewWithFreeListG creates a new B-Tree that uses the given node free list.
-func NewWithFreeListG[T any](degree int, less LessFunc[T], f *FreeListG[T]) *BTreeG[T] {
- if degree <= 1 {
- panic("bad degree")
- }
- return &BTreeG[T]{
- degree: degree,
- cow: ©OnWriteContext[T]{freelist: f, less: less},
- }
-}
-
-// items stores items in a node.
-type items[T any] []T
-
-// insertAt inserts a value into the given index, pushing all subsequent values
-// forward.
-func (s *items[T]) insertAt(index int, item T) {
- var zero T
- *s = append(*s, zero)
- if index < len(*s) {
- copy((*s)[index+1:], (*s)[index:])
- }
- (*s)[index] = item
-}
-
-// removeAt removes a value at a given index, pulling all subsequent values
-// back.
-func (s *items[T]) removeAt(index int) T {
- item := (*s)[index]
- copy((*s)[index:], (*s)[index+1:])
- var zero T
- (*s)[len(*s)-1] = zero
- *s = (*s)[:len(*s)-1]
- return item
-}
-
-// pop removes and returns the last element in the list.
-func (s *items[T]) pop() (out T) {
- index := len(*s) - 1
- out = (*s)[index]
- var zero T
- (*s)[index] = zero
- *s = (*s)[:index]
- return
-}
-
-// truncate truncates this instance at index so that it contains only the
-// first index items. index must be less than or equal to length.
-func (s *items[T]) truncate(index int) {
- var toClear items[T]
- *s, toClear = (*s)[:index], (*s)[index:]
- var zero T
- for i := 0; i < len(toClear); i++ {
- toClear[i] = zero
- }
-}
-
-// find returns the index where the given item should be inserted into this
-// list. 'found' is true if the item already exists in the list at the given
-// index.
-func (s items[T]) find(item T, less func(T, T) bool) (index int, found bool) {
- i := sort.Search(len(s), func(i int) bool {
- return less(item, s[i])
- })
- if i > 0 && !less(s[i-1], item) {
- return i - 1, true
- }
- return i, false
-}
-
-// node is an internal node in a tree.
-//
-// It must at all times maintain the invariant that either
-// * len(children) == 0, len(items) unconstrained
-// * len(children) == len(items) + 1
-type node[T any] struct {
- items items[T]
- children items[*node[T]]
- cow *copyOnWriteContext[T]
-}
-
-func (n *node[T]) mutableFor(cow *copyOnWriteContext[T]) *node[T] {
- if n.cow == cow {
- return n
- }
- out := cow.newNode()
- if cap(out.items) >= len(n.items) {
- out.items = out.items[:len(n.items)]
- } else {
- out.items = make(items[T], len(n.items), cap(n.items))
- }
- copy(out.items, n.items)
- // Copy children
- if cap(out.children) >= len(n.children) {
- out.children = out.children[:len(n.children)]
- } else {
- out.children = make(items[*node[T]], len(n.children), cap(n.children))
- }
- copy(out.children, n.children)
- return out
-}
-
-func (n *node[T]) mutableChild(i int) *node[T] {
- c := n.children[i].mutableFor(n.cow)
- n.children[i] = c
- return c
-}
-
-// split splits the given node at the given index. The current node shrinks,
-// and this function returns the item that existed at that index and a new node
-// containing all items/children after it.
-func (n *node[T]) split(i int) (T, *node[T]) {
- item := n.items[i]
- next := n.cow.newNode()
- next.items = append(next.items, n.items[i+1:]...)
- n.items.truncate(i)
- if len(n.children) > 0 {
- next.children = append(next.children, n.children[i+1:]...)
- n.children.truncate(i + 1)
- }
- return item, next
-}
-
-// maybeSplitChild checks if a child should be split, and if so splits it.
-// Returns whether or not a split occurred.
-func (n *node[T]) maybeSplitChild(i, maxItems int) bool {
- if len(n.children[i].items) < maxItems {
- return false
- }
- first := n.mutableChild(i)
- item, second := first.split(maxItems / 2)
- n.items.insertAt(i, item)
- n.children.insertAt(i+1, second)
- return true
-}
-
-// insert inserts an item into the subtree rooted at this node, making sure
-// no nodes in the subtree exceed maxItems items. Should an equivalent item be
-// be found/replaced by insert, it will be returned.
-func (n *node[T]) insert(item T, maxItems int) (_ T, _ bool) {
- i, found := n.items.find(item, n.cow.less)
- if found {
- out := n.items[i]
- n.items[i] = item
- return out, true
- }
- if len(n.children) == 0 {
- n.items.insertAt(i, item)
- return
- }
- if n.maybeSplitChild(i, maxItems) {
- inTree := n.items[i]
- switch {
- case n.cow.less(item, inTree):
- // no change, we want first split node
- case n.cow.less(inTree, item):
- i++ // we want second split node
- default:
- out := n.items[i]
- n.items[i] = item
- return out, true
- }
- }
- return n.mutableChild(i).insert(item, maxItems)
-}
-
-// get finds the given key in the subtree and returns it.
-func (n *node[T]) get(key T) (_ T, _ bool) {
- i, found := n.items.find(key, n.cow.less)
- if found {
- return n.items[i], true
- } else if len(n.children) > 0 {
- return n.children[i].get(key)
- }
- return
-}
-
-// min returns the first item in the subtree.
-func min[T any](n *node[T]) (_ T, found bool) {
- if n == nil {
- return
- }
- for len(n.children) > 0 {
- n = n.children[0]
- }
- if len(n.items) == 0 {
- return
- }
- return n.items[0], true
-}
-
-// max returns the last item in the subtree.
-func max[T any](n *node[T]) (_ T, found bool) {
- if n == nil {
- return
- }
- for len(n.children) > 0 {
- n = n.children[len(n.children)-1]
- }
- if len(n.items) == 0 {
- return
- }
- return n.items[len(n.items)-1], true
-}
-
-// toRemove details what item to remove in a node.remove call.
-type toRemove int
-
-const (
- removeItem toRemove = iota // removes the given item
- removeMin // removes smallest item in the subtree
- removeMax // removes largest item in the subtree
-)
-
-// remove removes an item from the subtree rooted at this node.
-func (n *node[T]) remove(item T, minItems int, typ toRemove) (_ T, _ bool) {
- var i int
- var found bool
- switch typ {
- case removeMax:
- if len(n.children) == 0 {
- return n.items.pop(), true
- }
- i = len(n.items)
- case removeMin:
- if len(n.children) == 0 {
- return n.items.removeAt(0), true
- }
- i = 0
- case removeItem:
- i, found = n.items.find(item, n.cow.less)
- if len(n.children) == 0 {
- if found {
- return n.items.removeAt(i), true
- }
- return
- }
- default:
- panic("invalid type")
- }
- // If we get to here, we have children.
- if len(n.children[i].items) <= minItems {
- return n.growChildAndRemove(i, item, minItems, typ)
- }
- child := n.mutableChild(i)
- // Either we had enough items to begin with, or we've done some
- // merging/stealing, because we've got enough now and we're ready to return
- // stuff.
- if found {
- // The item exists at index 'i', and the child we've selected can give us a
- // predecessor, since if we've gotten here it's got > minItems items in it.
- out := n.items[i]
- // We use our special-case 'remove' call with typ=maxItem to pull the
- // predecessor of item i (the rightmost leaf of our immediate left child)
- // and set it into where we pulled the item from.
- var zero T
- n.items[i], _ = child.remove(zero, minItems, removeMax)
- return out, true
- }
- // Final recursive call. Once we're here, we know that the item isn't in this
- // node and that the child is big enough to remove from.
- return child.remove(item, minItems, typ)
-}
-
-// growChildAndRemove grows child 'i' to make sure it's possible to remove an
-// item from it while keeping it at minItems, then calls remove to actually
-// remove it.
-//
-// Most documentation says we have to do two sets of special casing:
-// 1) item is in this node
-// 2) item is in child
-// In both cases, we need to handle the two subcases:
-// A) node has enough values that it can spare one
-// B) node doesn't have enough values
-// For the latter, we have to check:
-// a) left sibling has node to spare
-// b) right sibling has node to spare
-// c) we must merge
-// To simplify our code here, we handle cases #1 and #2 the same:
-// If a node doesn't have enough items, we make sure it does (using a,b,c).
-// We then simply redo our remove call, and the second time (regardless of
-// whether we're in case 1 or 2), we'll have enough items and can guarantee
-// that we hit case A.
-func (n *node[T]) growChildAndRemove(i int, item T, minItems int, typ toRemove) (T, bool) {
- if i > 0 && len(n.children[i-1].items) > minItems {
- // Steal from left child
- child := n.mutableChild(i)
- stealFrom := n.mutableChild(i - 1)
- stolenItem := stealFrom.items.pop()
- child.items.insertAt(0, n.items[i-1])
- n.items[i-1] = stolenItem
- if len(stealFrom.children) > 0 {
- child.children.insertAt(0, stealFrom.children.pop())
- }
- } else if i < len(n.items) && len(n.children[i+1].items) > minItems {
- // steal from right child
- child := n.mutableChild(i)
- stealFrom := n.mutableChild(i + 1)
- stolenItem := stealFrom.items.removeAt(0)
- child.items = append(child.items, n.items[i])
- n.items[i] = stolenItem
- if len(stealFrom.children) > 0 {
- child.children = append(child.children, stealFrom.children.removeAt(0))
- }
- } else {
- if i >= len(n.items) {
- i--
- }
- child := n.mutableChild(i)
- // merge with right child
- mergeItem := n.items.removeAt(i)
- mergeChild := n.children.removeAt(i + 1)
- child.items = append(child.items, mergeItem)
- child.items = append(child.items, mergeChild.items...)
- child.children = append(child.children, mergeChild.children...)
- n.cow.freeNode(mergeChild)
- }
- return n.remove(item, minItems, typ)
-}
-
-type direction int
-
-const (
- descend = direction(-1)
- ascend = direction(+1)
-)
-
-type optionalItem[T any] struct {
- item T
- valid bool
-}
-
-func optional[T any](item T) optionalItem[T] {
- return optionalItem[T]{item: item, valid: true}
-}
-func empty[T any]() optionalItem[T] {
- return optionalItem[T]{}
-}
-
-// iterate provides a simple method for iterating over elements in the tree.
-//
-// When ascending, the 'start' should be less than 'stop' and when descending,
-// the 'start' should be greater than 'stop'. Setting 'includeStart' to true
-// will force the iterator to include the first item when it equals 'start',
-// thus creating a "greaterOrEqual" or "lessThanEqual" rather than just a
-// "greaterThan" or "lessThan" queries.
-func (n *node[T]) iterate(dir direction, start, stop optionalItem[T], includeStart bool, hit bool, iter ItemIteratorG[T]) (bool, bool) {
- var ok, found bool
- var index int
- switch dir {
- case ascend:
- if start.valid {
- index, _ = n.items.find(start.item, n.cow.less)
- }
- for i := index; i < len(n.items); i++ {
- if len(n.children) > 0 {
- if hit, ok = n.children[i].iterate(dir, start, stop, includeStart, hit, iter); !ok {
- return hit, false
- }
- }
- if !includeStart && !hit && start.valid && !n.cow.less(start.item, n.items[i]) {
- hit = true
- continue
- }
- hit = true
- if stop.valid && !n.cow.less(n.items[i], stop.item) {
- return hit, false
- }
- if !iter(n.items[i]) {
- return hit, false
- }
- }
- if len(n.children) > 0 {
- if hit, ok = n.children[len(n.children)-1].iterate(dir, start, stop, includeStart, hit, iter); !ok {
- return hit, false
- }
- }
- case descend:
- if start.valid {
- index, found = n.items.find(start.item, n.cow.less)
- if !found {
- index = index - 1
- }
- } else {
- index = len(n.items) - 1
- }
- for i := index; i >= 0; i-- {
- if start.valid && !n.cow.less(n.items[i], start.item) {
- if !includeStart || hit || n.cow.less(start.item, n.items[i]) {
- continue
- }
- }
- if len(n.children) > 0 {
- if hit, ok = n.children[i+1].iterate(dir, start, stop, includeStart, hit, iter); !ok {
- return hit, false
- }
- }
- if stop.valid && !n.cow.less(stop.item, n.items[i]) {
- return hit, false // continue
- }
- hit = true
- if !iter(n.items[i]) {
- return hit, false
- }
- }
- if len(n.children) > 0 {
- if hit, ok = n.children[0].iterate(dir, start, stop, includeStart, hit, iter); !ok {
- return hit, false
- }
- }
- }
- return hit, true
-}
-
-// print is used for testing/debugging purposes.
-func (n *node[T]) print(w io.Writer, level int) {
- fmt.Fprintf(w, "%sNODE:%v\n", strings.Repeat(" ", level), n.items)
- for _, c := range n.children {
- c.print(w, level+1)
- }
-}
-
-// BTreeG is a generic implementation of a B-Tree.
-//
-// BTreeG stores items of type T in an ordered structure, allowing easy insertion,
-// removal, and iteration.
-//
-// Write operations are not safe for concurrent mutation by multiple
-// goroutines, but Read operations are.
-type BTreeG[T any] struct {
- degree int
- length int
- root *node[T]
- cow *copyOnWriteContext[T]
-}
-
-// LessFunc[T] determines how to order a type 'T'. It should implement a strict
-// ordering, and should return true if within that ordering, 'a' < 'b'.
-type LessFunc[T any] func(a, b T) bool
-
-// copyOnWriteContext pointers determine node ownership... a tree with a write
-// context equivalent to a node's write context is allowed to modify that node.
-// A tree whose write context does not match a node's is not allowed to modify
-// it, and must create a new, writable copy (IE: it's a Clone).
-//
-// When doing any write operation, we maintain the invariant that the current
-// node's context is equal to the context of the tree that requested the write.
-// We do this by, before we descend into any node, creating a copy with the
-// correct context if the contexts don't match.
-//
-// Since the node we're currently visiting on any write has the requesting
-// tree's context, that node is modifiable in place. Children of that node may
-// not share context, but before we descend into them, we'll make a mutable
-// copy.
-type copyOnWriteContext[T any] struct {
- freelist *FreeListG[T]
- less LessFunc[T]
-}
-
-// Clone clones the btree, lazily. Clone should not be called concurrently,
-// but the original tree (t) and the new tree (t2) can be used concurrently
-// once the Clone call completes.
-//
-// The internal tree structure of b is marked read-only and shared between t and
-// t2. Writes to both t and t2 use copy-on-write logic, creating new nodes
-// whenever one of b's original nodes would have been modified. Read operations
-// should have no performance degredation. Write operations for both t and t2
-// will initially experience minor slow-downs caused by additional allocs and
-// copies due to the aforementioned copy-on-write logic, but should converge to
-// the original performance characteristics of the original tree.
-func (t *BTreeG[T]) Clone() (t2 *BTreeG[T]) {
- // Create two entirely new copy-on-write contexts.
- // This operation effectively creates three trees:
- // the original, shared nodes (old b.cow)
- // the new b.cow nodes
- // the new out.cow nodes
- cow1, cow2 := *t.cow, *t.cow
- out := *t
- t.cow = &cow1
- out.cow = &cow2
- return &out
-}
-
-// maxItems returns the max number of items to allow per node.
-func (t *BTreeG[T]) maxItems() int {
- return t.degree*2 - 1
-}
-
-// minItems returns the min number of items to allow per node (ignored for the
-// root node).
-func (t *BTreeG[T]) minItems() int {
- return t.degree - 1
-}
-
-func (c *copyOnWriteContext[T]) newNode() (n *node[T]) {
- n = c.freelist.newNode()
- n.cow = c
- return
-}
-
-type freeType int
-
-const (
- ftFreelistFull freeType = iota // node was freed (available for GC, not stored in freelist)
- ftStored // node was stored in the freelist for later use
- ftNotOwned // node was ignored by COW, since it's owned by another one
-)
-
-// freeNode frees a node within a given COW context, if it's owned by that
-// context. It returns what happened to the node (see freeType const
-// documentation).
-func (c *copyOnWriteContext[T]) freeNode(n *node[T]) freeType {
- if n.cow == c {
- // clear to allow GC
- n.items.truncate(0)
- n.children.truncate(0)
- n.cow = nil
- if c.freelist.freeNode(n) {
- return ftStored
- } else {
- return ftFreelistFull
- }
- } else {
- return ftNotOwned
- }
-}
-
-// ReplaceOrInsert adds the given item to the tree. If an item in the tree
-// already equals the given one, it is removed from the tree and returned,
-// and the second return value is true. Otherwise, (zeroValue, false)
-//
-// nil cannot be added to the tree (will panic).
-func (t *BTreeG[T]) ReplaceOrInsert(item T) (_ T, _ bool) {
- if t.root == nil {
- t.root = t.cow.newNode()
- t.root.items = append(t.root.items, item)
- t.length++
- return
- } else {
- t.root = t.root.mutableFor(t.cow)
- if len(t.root.items) >= t.maxItems() {
- item2, second := t.root.split(t.maxItems() / 2)
- oldroot := t.root
- t.root = t.cow.newNode()
- t.root.items = append(t.root.items, item2)
- t.root.children = append(t.root.children, oldroot, second)
- }
- }
- out, outb := t.root.insert(item, t.maxItems())
- if !outb {
- t.length++
- }
- return out, outb
-}
-
-// Delete removes an item equal to the passed in item from the tree, returning
-// it. If no such item exists, returns (zeroValue, false).
-func (t *BTreeG[T]) Delete(item T) (T, bool) {
- return t.deleteItem(item, removeItem)
-}
-
-// DeleteMin removes the smallest item in the tree and returns it.
-// If no such item exists, returns (zeroValue, false).
-func (t *BTreeG[T]) DeleteMin() (T, bool) {
- var zero T
- return t.deleteItem(zero, removeMin)
-}
-
-// DeleteMax removes the largest item in the tree and returns it.
-// If no such item exists, returns (zeroValue, false).
-func (t *BTreeG[T]) DeleteMax() (T, bool) {
- var zero T
- return t.deleteItem(zero, removeMax)
-}
-
-func (t *BTreeG[T]) deleteItem(item T, typ toRemove) (_ T, _ bool) {
- if t.root == nil || len(t.root.items) == 0 {
- return
- }
- t.root = t.root.mutableFor(t.cow)
- out, outb := t.root.remove(item, t.minItems(), typ)
- if len(t.root.items) == 0 && len(t.root.children) > 0 {
- oldroot := t.root
- t.root = t.root.children[0]
- t.cow.freeNode(oldroot)
- }
- if outb {
- t.length--
- }
- return out, outb
-}
-
-// AscendRange calls the iterator for every value in the tree within the range
-// [greaterOrEqual, lessThan), until iterator returns false.
-func (t *BTreeG[T]) AscendRange(greaterOrEqual, lessThan T, iterator ItemIteratorG[T]) {
- if t.root == nil {
- return
- }
- t.root.iterate(ascend, optional[T](greaterOrEqual), optional[T](lessThan), true, false, iterator)
-}
-
-// AscendLessThan calls the iterator for every value in the tree within the range
-// [first, pivot), until iterator returns false.
-func (t *BTreeG[T]) AscendLessThan(pivot T, iterator ItemIteratorG[T]) {
- if t.root == nil {
- return
- }
- t.root.iterate(ascend, empty[T](), optional(pivot), false, false, iterator)
-}
-
-// AscendGreaterOrEqual calls the iterator for every value in the tree within
-// the range [pivot, last], until iterator returns false.
-func (t *BTreeG[T]) AscendGreaterOrEqual(pivot T, iterator ItemIteratorG[T]) {
- if t.root == nil {
- return
- }
- t.root.iterate(ascend, optional[T](pivot), empty[T](), true, false, iterator)
-}
-
-// Ascend calls the iterator for every value in the tree within the range
-// [first, last], until iterator returns false.
-func (t *BTreeG[T]) Ascend(iterator ItemIteratorG[T]) {
- if t.root == nil {
- return
- }
- t.root.iterate(ascend, empty[T](), empty[T](), false, false, iterator)
-}
-
-// DescendRange calls the iterator for every value in the tree within the range
-// [lessOrEqual, greaterThan), until iterator returns false.
-func (t *BTreeG[T]) DescendRange(lessOrEqual, greaterThan T, iterator ItemIteratorG[T]) {
- if t.root == nil {
- return
- }
- t.root.iterate(descend, optional[T](lessOrEqual), optional[T](greaterThan), true, false, iterator)
-}
-
-// DescendLessOrEqual calls the iterator for every value in the tree within the range
-// [pivot, first], until iterator returns false.
-func (t *BTreeG[T]) DescendLessOrEqual(pivot T, iterator ItemIteratorG[T]) {
- if t.root == nil {
- return
- }
- t.root.iterate(descend, optional[T](pivot), empty[T](), true, false, iterator)
-}
-
-// DescendGreaterThan calls the iterator for every value in the tree within
-// the range [last, pivot), until iterator returns false.
-func (t *BTreeG[T]) DescendGreaterThan(pivot T, iterator ItemIteratorG[T]) {
- if t.root == nil {
- return
- }
- t.root.iterate(descend, empty[T](), optional[T](pivot), false, false, iterator)
-}
-
-// Descend calls the iterator for every value in the tree within the range
-// [last, first], until iterator returns false.
-func (t *BTreeG[T]) Descend(iterator ItemIteratorG[T]) {
- if t.root == nil {
- return
- }
- t.root.iterate(descend, empty[T](), empty[T](), false, false, iterator)
-}
-
-// Get looks for the key item in the tree, returning it. It returns
-// (zeroValue, false) if unable to find that item.
-func (t *BTreeG[T]) Get(key T) (_ T, _ bool) {
- if t.root == nil {
- return
- }
- return t.root.get(key)
-}
-
-// Min returns the smallest item in the tree, or (zeroValue, false) if the tree is empty.
-func (t *BTreeG[T]) Min() (_ T, _ bool) {
- return min(t.root)
-}
-
-// Max returns the largest item in the tree, or (zeroValue, false) if the tree is empty.
-func (t *BTreeG[T]) Max() (_ T, _ bool) {
- return max(t.root)
-}
-
-// Has returns true if the given key is in the tree.
-func (t *BTreeG[T]) Has(key T) bool {
- _, ok := t.Get(key)
- return ok
-}
-
-// Len returns the number of items currently in the tree.
-func (t *BTreeG[T]) Len() int {
- return t.length
-}
-
-// Clear removes all items from the btree. If addNodesToFreelist is true,
-// t's nodes are added to its freelist as part of this call, until the freelist
-// is full. Otherwise, the root node is simply dereferenced and the subtree
-// left to Go's normal GC processes.
-//
-// This can be much faster
-// than calling Delete on all elements, because that requires finding/removing
-// each element in the tree and updating the tree accordingly. It also is
-// somewhat faster than creating a new tree to replace the old one, because
-// nodes from the old tree are reclaimed into the freelist for use by the new
-// one, instead of being lost to the garbage collector.
-//
-// This call takes:
-// O(1): when addNodesToFreelist is false, this is a single operation.
-// O(1): when the freelist is already full, it breaks out immediately
-// O(freelist size): when the freelist is empty and the nodes are all owned
-// by this tree, nodes are added to the freelist until full.
-// O(tree size): when all nodes are owned by another tree, all nodes are
-// iterated over looking for nodes to add to the freelist, and due to
-// ownership, none are.
-func (t *BTreeG[T]) Clear(addNodesToFreelist bool) {
- if t.root != nil && addNodesToFreelist {
- t.root.reset(t.cow)
- }
- t.root, t.length = nil, 0
-}
-
-// reset returns a subtree to the freelist. It breaks out immediately if the
-// freelist is full, since the only benefit of iterating is to fill that
-// freelist up. Returns true if parent reset call should continue.
-func (n *node[T]) reset(c *copyOnWriteContext[T]) bool {
- for _, child := range n.children {
- if !child.reset(c) {
- return false
- }
- }
- return c.freeNode(n) != ftFreelistFull
-}
-
-// Int implements the Item interface for integers.
-type Int int
-
-// Less returns true if int(a) < int(b).
-func (a Int) Less(b Item) bool {
- return a < b.(Int)
-}
-
-// BTree is an implementation of a B-Tree.
-//
-// BTree stores Item instances in an ordered structure, allowing easy insertion,
-// removal, and iteration.
-//
-// Write operations are not safe for concurrent mutation by multiple
-// goroutines, but Read operations are.
-type BTree BTreeG[Item]
-
-var itemLess LessFunc[Item] = func(a, b Item) bool {
- return a.Less(b)
-}
-
-// New creates a new B-Tree with the given degree.
-//
-// New(2), for example, will create a 2-3-4 tree (each node contains 1-3 items
-// and 2-4 children).
-func New(degree int) *BTree {
- return (*BTree)(NewG[Item](degree, itemLess))
-}
-
-// FreeList represents a free list of btree nodes. By default each
-// BTree has its own FreeList, but multiple BTrees can share the same
-// FreeList.
-// Two Btrees using the same freelist are safe for concurrent write access.
-type FreeList FreeListG[Item]
-
-// NewFreeList creates a new free list.
-// size is the maximum size of the returned free list.
-func NewFreeList(size int) *FreeList {
- return (*FreeList)(NewFreeListG[Item](size))
-}
-
-// NewWithFreeList creates a new B-Tree that uses the given node free list.
-func NewWithFreeList(degree int, f *FreeList) *BTree {
- return (*BTree)(NewWithFreeListG[Item](degree, itemLess, (*FreeListG[Item])(f)))
-}
-
-// ItemIterator allows callers of Ascend* to iterate in-order over portions of
-// the tree. When this function returns false, iteration will stop and the
-// associated Ascend* function will immediately return.
-type ItemIterator ItemIteratorG[Item]
-
-// Clone clones the btree, lazily. Clone should not be called concurrently,
-// but the original tree (t) and the new tree (t2) can be used concurrently
-// once the Clone call completes.
-//
-// The internal tree structure of b is marked read-only and shared between t and
-// t2. Writes to both t and t2 use copy-on-write logic, creating new nodes
-// whenever one of b's original nodes would have been modified. Read operations
-// should have no performance degredation. Write operations for both t and t2
-// will initially experience minor slow-downs caused by additional allocs and
-// copies due to the aforementioned copy-on-write logic, but should converge to
-// the original performance characteristics of the original tree.
-func (t *BTree) Clone() (t2 *BTree) {
- return (*BTree)((*BTreeG[Item])(t).Clone())
-}
-
-// Delete removes an item equal to the passed in item from the tree, returning
-// it. If no such item exists, returns nil.
-func (t *BTree) Delete(item Item) Item {
- i, _ := (*BTreeG[Item])(t).Delete(item)
- return i
-}
-
-// DeleteMax removes the largest item in the tree and returns it.
-// If no such item exists, returns nil.
-func (t *BTree) DeleteMax() Item {
- i, _ := (*BTreeG[Item])(t).DeleteMax()
- return i
-}
-
-// DeleteMin removes the smallest item in the tree and returns it.
-// If no such item exists, returns nil.
-func (t *BTree) DeleteMin() Item {
- i, _ := (*BTreeG[Item])(t).DeleteMin()
- return i
-}
-
-// Get looks for the key item in the tree, returning it. It returns nil if
-// unable to find that item.
-func (t *BTree) Get(key Item) Item {
- i, _ := (*BTreeG[Item])(t).Get(key)
- return i
-}
-
-// Max returns the largest item in the tree, or nil if the tree is empty.
-func (t *BTree) Max() Item {
- i, _ := (*BTreeG[Item])(t).Max()
- return i
-}
-
-// Min returns the smallest item in the tree, or nil if the tree is empty.
-func (t *BTree) Min() Item {
- i, _ := (*BTreeG[Item])(t).Min()
- return i
-}
-
-// Has returns true if the given key is in the tree.
-func (t *BTree) Has(key Item) bool {
- return (*BTreeG[Item])(t).Has(key)
-}
-
-// ReplaceOrInsert adds the given item to the tree. If an item in the tree
-// already equals the given one, it is removed from the tree and returned.
-// Otherwise, nil is returned.
-//
-// nil cannot be added to the tree (will panic).
-func (t *BTree) ReplaceOrInsert(item Item) Item {
- i, _ := (*BTreeG[Item])(t).ReplaceOrInsert(item)
- return i
-}
-
-// AscendRange calls the iterator for every value in the tree within the range
-// [greaterOrEqual, lessThan), until iterator returns false.
-func (t *BTree) AscendRange(greaterOrEqual, lessThan Item, iterator ItemIterator) {
- (*BTreeG[Item])(t).AscendRange(greaterOrEqual, lessThan, (ItemIteratorG[Item])(iterator))
-}
-
-// AscendLessThan calls the iterator for every value in the tree within the range
-// [first, pivot), until iterator returns false.
-func (t *BTree) AscendLessThan(pivot Item, iterator ItemIterator) {
- (*BTreeG[Item])(t).AscendLessThan(pivot, (ItemIteratorG[Item])(iterator))
-}
-
-// AscendGreaterOrEqual calls the iterator for every value in the tree within
-// the range [pivot, last], until iterator returns false.
-func (t *BTree) AscendGreaterOrEqual(pivot Item, iterator ItemIterator) {
- (*BTreeG[Item])(t).AscendGreaterOrEqual(pivot, (ItemIteratorG[Item])(iterator))
-}
-
-// Ascend calls the iterator for every value in the tree within the range
-// [first, last], until iterator returns false.
-func (t *BTree) Ascend(iterator ItemIterator) {
- (*BTreeG[Item])(t).Ascend((ItemIteratorG[Item])(iterator))
-}
-
-// DescendRange calls the iterator for every value in the tree within the range
-// [lessOrEqual, greaterThan), until iterator returns false.
-func (t *BTree) DescendRange(lessOrEqual, greaterThan Item, iterator ItemIterator) {
- (*BTreeG[Item])(t).DescendRange(lessOrEqual, greaterThan, (ItemIteratorG[Item])(iterator))
-}
-
-// DescendLessOrEqual calls the iterator for every value in the tree within the range
-// [pivot, first], until iterator returns false.
-func (t *BTree) DescendLessOrEqual(pivot Item, iterator ItemIterator) {
- (*BTreeG[Item])(t).DescendLessOrEqual(pivot, (ItemIteratorG[Item])(iterator))
-}
-
-// DescendGreaterThan calls the iterator for every value in the tree within
-// the range [last, pivot), until iterator returns false.
-func (t *BTree) DescendGreaterThan(pivot Item, iterator ItemIterator) {
- (*BTreeG[Item])(t).DescendGreaterThan(pivot, (ItemIteratorG[Item])(iterator))
-}
-
-// Descend calls the iterator for every value in the tree within the range
-// [last, first], until iterator returns false.
-func (t *BTree) Descend(iterator ItemIterator) {
- (*BTreeG[Item])(t).Descend((ItemIteratorG[Item])(iterator))
-}
-
-// Len returns the number of items currently in the tree.
-func (t *BTree) Len() int {
- return (*BTreeG[Item])(t).Len()
-}
-
-// Clear removes all items from the btree. If addNodesToFreelist is true,
-// t's nodes are added to its freelist as part of this call, until the freelist
-// is full. Otherwise, the root node is simply dereferenced and the subtree
-// left to Go's normal GC processes.
-//
-// This can be much faster
-// than calling Delete on all elements, because that requires finding/removing
-// each element in the tree and updating the tree accordingly. It also is
-// somewhat faster than creating a new tree to replace the old one, because
-// nodes from the old tree are reclaimed into the freelist for use by the new
-// one, instead of being lost to the garbage collector.
-//
-// This call takes:
-// O(1): when addNodesToFreelist is false, this is a single operation.
-// O(1): when the freelist is already full, it breaks out immediately
-// O(freelist size): when the freelist is empty and the nodes are all owned
-// by this tree, nodes are added to the freelist until full.
-// O(tree size): when all nodes are owned by another tree, all nodes are
-// iterated over looking for nodes to add to the freelist, and due to
-// ownership, none are.
-func (t *BTree) Clear(addNodesToFreelist bool) {
- (*BTreeG[Item])(t).Clear(addNodesToFreelist)
-}
diff --git a/vendor/github.com/google/pprof/profile/merge.go b/vendor/github.com/google/pprof/profile/merge.go
index ba4d74640..8a51690be 100644
--- a/vendor/github.com/google/pprof/profile/merge.go
+++ b/vendor/github.com/google/pprof/profile/merge.go
@@ -17,6 +17,7 @@ package profile
import (
"encoding/binary"
"fmt"
+ "slices"
"sort"
"strconv"
"strings"
@@ -78,12 +79,10 @@ func Merge(srcs []*Profile) (*Profile, error) {
}
}
- for _, s := range p.Sample {
- if isZeroSample(s) {
- // If there are any zero samples, re-merge the profile to GC
- // them.
- return Merge([]*Profile{p})
- }
+ if slices.ContainsFunc(p.Sample, isZeroSample) {
+ // If there are any zero samples, re-merge the profile to GC
+ // them.
+ return Merge([]*Profile{p})
}
return p, nil
diff --git a/vendor/github.com/google/pprof/profile/profile.go b/vendor/github.com/google/pprof/profile/profile.go
index f47a24390..18df65a8d 100644
--- a/vendor/github.com/google/pprof/profile/profile.go
+++ b/vendor/github.com/google/pprof/profile/profile.go
@@ -24,6 +24,7 @@ import (
"math"
"path/filepath"
"regexp"
+ "slices"
"sort"
"strings"
"sync"
@@ -277,7 +278,7 @@ func (p *Profile) massageMappings() {
// Use heuristics to identify main binary and move it to the top of the list of mappings
for i, m := range p.Mapping {
- file := strings.TrimSpace(strings.Replace(m.File, "(deleted)", "", -1))
+ file := strings.TrimSpace(strings.ReplaceAll(m.File, "(deleted)", ""))
if len(file) == 0 {
continue
}
@@ -734,12 +735,7 @@ func (p *Profile) RemoveLabel(key string) {
// HasLabel returns true if a sample has a label with indicated key and value.
func (s *Sample) HasLabel(key, value string) bool {
- for _, v := range s.Label[key] {
- if v == value {
- return true
- }
- }
- return false
+ return slices.Contains(s.Label[key], value)
}
// SetNumLabel sets the specified key to the specified value for all samples in the
@@ -852,7 +848,17 @@ func (p *Profile) HasFileLines() bool {
// "[vdso]", "[vsyscall]" and some others, see the code.
func (m *Mapping) Unsymbolizable() bool {
name := filepath.Base(m.File)
- return strings.HasPrefix(name, "[") || strings.HasPrefix(name, "linux-vdso") || strings.HasPrefix(m.File, "/dev/dri/") || m.File == "//anon"
+ switch {
+ case strings.HasPrefix(name, "["):
+ case strings.HasPrefix(name, "linux-vdso"):
+ case strings.HasPrefix(m.File, "/dev/dri/"):
+ case m.File == "//anon":
+ case m.File == "":
+ case strings.HasPrefix(m.File, "/memfd:"):
+ default:
+ return false
+ }
+ return true
}
// Copy makes a fully independent copy of a profile.
diff --git a/vendor/github.com/google/pprof/profile/proto.go b/vendor/github.com/google/pprof/profile/proto.go
index a15696ba1..31bf6bca6 100644
--- a/vendor/github.com/google/pprof/profile/proto.go
+++ b/vendor/github.com/google/pprof/profile/proto.go
@@ -36,6 +36,7 @@ package profile
import (
"errors"
"fmt"
+ "slices"
)
type buffer struct {
@@ -187,6 +188,16 @@ func le32(p []byte) uint32 {
return uint32(p[0]) | uint32(p[1])<<8 | uint32(p[2])<<16 | uint32(p[3])<<24
}
+func peekNumVarints(data []byte) (numVarints int) {
+ for ; len(data) > 0; numVarints++ {
+ var err error
+ if _, data, err = decodeVarint(data); err != nil {
+ break
+ }
+ }
+ return numVarints
+}
+
func decodeVarint(data []byte) (uint64, []byte, error) {
var u uint64
for i := 0; ; i++ {
@@ -286,6 +297,9 @@ func decodeInt64(b *buffer, x *int64) error {
func decodeInt64s(b *buffer, x *[]int64) error {
if b.typ == 2 {
// Packed encoding
+ dataLen := peekNumVarints(b.data)
+ *x = slices.Grow(*x, dataLen)
+
data := b.data
for len(data) > 0 {
var u uint64
@@ -316,8 +330,11 @@ func decodeUint64(b *buffer, x *uint64) error {
func decodeUint64s(b *buffer, x *[]uint64) error {
if b.typ == 2 {
- data := b.data
// Packed encoding
+ dataLen := peekNumVarints(b.data)
+ *x = slices.Grow(*x, dataLen)
+
+ data := b.data
for len(data) > 0 {
var u uint64
var err error
diff --git a/vendor/github.com/google/pprof/profile/prune.go b/vendor/github.com/google/pprof/profile/prune.go
index b2f9fd546..7bba31e8c 100644
--- a/vendor/github.com/google/pprof/profile/prune.go
+++ b/vendor/github.com/google/pprof/profile/prune.go
@@ -19,6 +19,7 @@ package profile
import (
"fmt"
"regexp"
+ "slices"
"strings"
)
@@ -40,13 +41,7 @@ func simplifyFunc(f string) string {
// Account for unsimplified names -- try to remove the argument list by trimming
// starting from the first '(', but skipping reserved names that have '('.
for _, ind := range bracketRx.FindAllStringSubmatchIndex(funcName, -1) {
- foundReserved := false
- for _, res := range reservedNames {
- if funcName[ind[0]:ind[1]] == res {
- foundReserved = true
- break
- }
- }
+ foundReserved := slices.Contains(reservedNames, funcName[ind[0]:ind[1]])
if !foundReserved {
funcName = funcName[:ind[0]]
break
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/LICENSE b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/LICENSE
similarity index 100%
rename from vendor/github.com/grpc-ecosystem/go-grpc-prometheus/LICENSE
rename to vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/LICENSE
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_metrics.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_metrics.go
new file mode 100644
index 000000000..5c8ba2076
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_metrics.go
@@ -0,0 +1,117 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+package prometheus
+
+import (
+ "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors"
+ "github.com/prometheus/client_golang/prometheus"
+ "google.golang.org/grpc"
+)
+
+// ClientMetrics represents a collection of metrics to be registered on a
+// Prometheus metrics registry for a gRPC client.
+type ClientMetrics struct {
+ clientStartedCounter *prometheus.CounterVec
+ clientHandledCounter *prometheus.CounterVec
+ clientStreamMsgReceived *prometheus.CounterVec
+ clientStreamMsgSent *prometheus.CounterVec
+
+ // clientHandledHistogram can be nil
+ clientHandledHistogram *prometheus.HistogramVec
+ // clientStreamRecvHistogram can be nil
+ clientStreamRecvHistogram *prometheus.HistogramVec
+ // clientStreamSendHistogram can be nil
+ clientStreamSendHistogram *prometheus.HistogramVec
+}
+
+// NewClientMetrics returns a new ClientMetrics object.
+// NOTE: Remember to register ClientMetrics object using prometheus registry
+// e.g. prometheus.MustRegister(myClientMetrics).
+func NewClientMetrics(opts ...ClientMetricsOption) *ClientMetrics {
+ var config clientMetricsConfig
+ config.apply(opts)
+ return &ClientMetrics{
+ clientStartedCounter: prometheus.NewCounterVec(
+ config.counterOpts.apply(prometheus.CounterOpts{
+ Name: "grpc_client_started_total",
+ Help: "Total number of RPCs started on the client.",
+ }), []string{"grpc_type", "grpc_service", "grpc_method"}),
+
+ clientHandledCounter: prometheus.NewCounterVec(
+ config.counterOpts.apply(prometheus.CounterOpts{
+ Name: "grpc_client_handled_total",
+ Help: "Total number of RPCs completed by the client, regardless of success or failure.",
+ }), []string{"grpc_type", "grpc_service", "grpc_method", "grpc_code"}),
+
+ clientStreamMsgReceived: prometheus.NewCounterVec(
+ config.counterOpts.apply(prometheus.CounterOpts{
+ Name: "grpc_client_msg_received_total",
+ Help: "Total number of RPC stream messages received by the client.",
+ }), []string{"grpc_type", "grpc_service", "grpc_method"}),
+
+ clientStreamMsgSent: prometheus.NewCounterVec(
+ config.counterOpts.apply(prometheus.CounterOpts{
+ Name: "grpc_client_msg_sent_total",
+ Help: "Total number of gRPC stream messages sent by the client.",
+ }), []string{"grpc_type", "grpc_service", "grpc_method"}),
+
+ clientHandledHistogram: config.clientHandledHistogram,
+ clientStreamRecvHistogram: config.clientStreamRecvHistogram,
+ clientStreamSendHistogram: config.clientStreamSendHistogram,
+ }
+}
+
+// Describe sends the super-set of all possible descriptors of metrics
+// collected by this Collector to the provided channel and returns once
+// the last descriptor has been sent.
+func (m *ClientMetrics) Describe(ch chan<- *prometheus.Desc) {
+ m.clientStartedCounter.Describe(ch)
+ m.clientHandledCounter.Describe(ch)
+ m.clientStreamMsgReceived.Describe(ch)
+ m.clientStreamMsgSent.Describe(ch)
+ if m.clientHandledHistogram != nil {
+ m.clientHandledHistogram.Describe(ch)
+ }
+ if m.clientStreamRecvHistogram != nil {
+ m.clientStreamRecvHistogram.Describe(ch)
+ }
+ if m.clientStreamSendHistogram != nil {
+ m.clientStreamSendHistogram.Describe(ch)
+ }
+}
+
+// Collect is called by the Prometheus registry when collecting
+// metrics. The implementation sends each collected metric via the
+// provided channel and returns once the last metric has been sent.
+func (m *ClientMetrics) Collect(ch chan<- prometheus.Metric) {
+ m.clientStartedCounter.Collect(ch)
+ m.clientHandledCounter.Collect(ch)
+ m.clientStreamMsgReceived.Collect(ch)
+ m.clientStreamMsgSent.Collect(ch)
+ if m.clientHandledHistogram != nil {
+ m.clientHandledHistogram.Collect(ch)
+ }
+ if m.clientStreamRecvHistogram != nil {
+ m.clientStreamRecvHistogram.Collect(ch)
+ }
+ if m.clientStreamSendHistogram != nil {
+ m.clientStreamSendHistogram.Collect(ch)
+ }
+}
+
+// UnaryClientInterceptor is a gRPC client-side interceptor that provides Prometheus monitoring for Unary RPCs.
+func (m *ClientMetrics) UnaryClientInterceptor(opts ...Option) grpc.UnaryClientInterceptor {
+ return interceptors.UnaryClientInterceptor(&reportable{
+ opts: opts,
+ clientMetrics: m,
+ })
+}
+
+// StreamClientInterceptor is a gRPC client-side interceptor that provides Prometheus monitoring for Streaming RPCs.
+func (m *ClientMetrics) StreamClientInterceptor(opts ...Option) grpc.StreamClientInterceptor {
+ return interceptors.StreamClientInterceptor(&reportable{
+ opts: opts,
+ clientMetrics: m,
+ })
+}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_options.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_options.go
new file mode 100644
index 000000000..c2671679c
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/client_options.go
@@ -0,0 +1,77 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+package prometheus
+
+import (
+ "github.com/prometheus/client_golang/prometheus"
+)
+
+type clientMetricsConfig struct {
+ counterOpts counterOptions
+ // clientHandledHistogram can be nil.
+ clientHandledHistogram *prometheus.HistogramVec
+ // clientStreamRecvHistogram can be nil.
+ clientStreamRecvHistogram *prometheus.HistogramVec
+ // clientStreamSendHistogram can be nil.
+ clientStreamSendHistogram *prometheus.HistogramVec
+}
+
+type ClientMetricsOption func(*clientMetricsConfig)
+
+func (c *clientMetricsConfig) apply(opts []ClientMetricsOption) {
+ for _, o := range opts {
+ o(c)
+ }
+}
+
+func WithClientCounterOptions(opts ...CounterOption) ClientMetricsOption {
+ return func(o *clientMetricsConfig) {
+ o.counterOpts = opts
+ }
+}
+
+// WithClientHandlingTimeHistogram turns on recording of handling time of RPCs.
+// Histogram metrics can be very expensive for Prometheus to retain and query.
+func WithClientHandlingTimeHistogram(opts ...HistogramOption) ClientMetricsOption {
+ return func(o *clientMetricsConfig) {
+ o.clientHandledHistogram = prometheus.NewHistogramVec(
+ histogramOptions(opts).apply(prometheus.HistogramOpts{
+ Name: "grpc_client_handling_seconds",
+ Help: "Histogram of response latency (seconds) of the gRPC until it is finished by the application.",
+ Buckets: prometheus.DefBuckets,
+ }),
+ []string{"grpc_type", "grpc_service", "grpc_method"},
+ )
+ }
+}
+
+// WithClientStreamRecvHistogram turns on recording of single message receive time of streaming RPCs.
+// Histogram metrics can be very expensive for Prometheus to retain and query.
+func WithClientStreamRecvHistogram(opts ...HistogramOption) ClientMetricsOption {
+ return func(o *clientMetricsConfig) {
+ o.clientStreamRecvHistogram = prometheus.NewHistogramVec(
+ histogramOptions(opts).apply(prometheus.HistogramOpts{
+ Name: "grpc_client_msg_recv_handling_seconds",
+ Help: "Histogram of response latency (seconds) of the gRPC single message receive.",
+ Buckets: prometheus.DefBuckets,
+ }),
+ []string{"grpc_type", "grpc_service", "grpc_method"},
+ )
+ }
+}
+
+// WithClientStreamSendHistogram turns on recording of single message send time of streaming RPCs.
+// Histogram metrics can be very expensive for Prometheus to retain and query.
+func WithClientStreamSendHistogram(opts ...HistogramOption) ClientMetricsOption {
+ return func(o *clientMetricsConfig) {
+ o.clientStreamSendHistogram = prometheus.NewHistogramVec(
+ histogramOptions(opts).apply(prometheus.HistogramOpts{
+ Name: "grpc_client_msg_send_handling_seconds",
+ Help: "Histogram of response latency (seconds) of the gRPC single message send.",
+ Buckets: prometheus.DefBuckets,
+ }),
+ []string{"grpc_type", "grpc_service", "grpc_method"},
+ )
+ }
+}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/constants.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/constants.go
new file mode 100644
index 000000000..5c36923f7
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/constants.go
@@ -0,0 +1,23 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+package prometheus
+
+type grpcType string
+
+// grpcType describes all types of grpc connection.
+const (
+ Unary grpcType = "unary"
+ ClientStream grpcType = "client_stream"
+ ServerStream grpcType = "server_stream"
+ BidiStream grpcType = "bidi_stream"
+)
+
+// Kind describes whether interceptor is a client or server type.
+type Kind string
+
+// Enum for Client and Server Kind.
+const (
+ KindClient Kind = "client"
+ KindServer Kind = "server"
+)
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/doc.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/doc.go
new file mode 100644
index 000000000..b62f17efb
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/doc.go
@@ -0,0 +1,8 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+/*
+Package prometheus provides a standalone interceptor for metrics. It's next iteration of deprecated https://github.com/grpc-ecosystem/go-grpc-prometheus.
+See https://github.com/grpc-ecosystem/go-grpc-middleware/tree/main/examples for example.
+*/
+package prometheus
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/options.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/options.go
new file mode 100644
index 000000000..2047b5fe4
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/options.go
@@ -0,0 +1,152 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+package prometheus
+
+import (
+ "github.com/prometheus/client_golang/prometheus"
+ "google.golang.org/grpc"
+ "google.golang.org/grpc/status"
+)
+
+// FromError returns a grpc status. If the error code is neither a valid grpc status nor a context error, codes.Unknown
+// will be set.
+func FromError(err error) *status.Status {
+ s, ok := status.FromError(err)
+ // Mirror what the grpc server itself does, i.e. also convert context errors to status
+ if !ok {
+ s = status.FromContextError(err)
+ }
+ return s
+}
+
+// A CounterOption lets you add options to Counter metrics using With* funcs.
+type CounterOption func(*prometheus.CounterOpts)
+
+type counterOptions []CounterOption
+
+func (co counterOptions) apply(o prometheus.CounterOpts) prometheus.CounterOpts {
+ for _, f := range co {
+ f(&o)
+ }
+ return o
+}
+
+// WithConstLabels allows you to add ConstLabels to Counter metrics.
+func WithConstLabels(labels prometheus.Labels) CounterOption {
+ return func(o *prometheus.CounterOpts) {
+ o.ConstLabels = labels
+ }
+}
+
+// WithSubsystem allows you to add a Subsystem to Counter metrics.
+func WithSubsystem(subsystem string) CounterOption {
+ return func(o *prometheus.CounterOpts) {
+ o.Subsystem = subsystem
+ }
+}
+
+// WithNamespace allows you to add a Namespace to Counter metrics.
+func WithNamespace(namespace string) CounterOption {
+ return func(o *prometheus.CounterOpts) {
+ o.Namespace = namespace
+ }
+}
+
+// A HistogramOption lets you add options to Histogram metrics using With*
+// funcs.
+type HistogramOption func(*prometheus.HistogramOpts)
+
+type histogramOptions []HistogramOption
+
+func (ho histogramOptions) apply(o prometheus.HistogramOpts) prometheus.HistogramOpts {
+ for _, f := range ho {
+ f(&o)
+ }
+ return o
+}
+
+// WithHistogramBuckets allows you to specify custom bucket ranges for histograms if EnableHandlingTimeHistogram is on.
+func WithHistogramBuckets(buckets []float64) HistogramOption {
+ return func(o *prometheus.HistogramOpts) { o.Buckets = buckets }
+}
+
+// WithHistogramOpts allows you to specify HistogramOpts but makes sure the correct name and label is used.
+// This function is helpful when specifying more than just the buckets, like using NativeHistograms.
+func WithHistogramOpts(opts *prometheus.HistogramOpts) HistogramOption {
+ // TODO: This isn't ideal either if new fields are added to prometheus.HistogramOpts.
+ // Maybe we can change the interface to accept arbitrary HistogramOpts and
+ // only make sure to overwrite the necessary fields (name, labels).
+ return func(o *prometheus.HistogramOpts) {
+ o.Buckets = opts.Buckets
+ o.NativeHistogramBucketFactor = opts.NativeHistogramBucketFactor
+ o.NativeHistogramZeroThreshold = opts.NativeHistogramZeroThreshold
+ o.NativeHistogramMaxBucketNumber = opts.NativeHistogramMaxBucketNumber
+ o.NativeHistogramMinResetDuration = opts.NativeHistogramMinResetDuration
+ o.NativeHistogramMaxZeroThreshold = opts.NativeHistogramMaxZeroThreshold
+ }
+}
+
+// WithHistogramConstLabels allows you to add custom ConstLabels to
+// histograms metrics.
+func WithHistogramConstLabels(labels prometheus.Labels) HistogramOption {
+ return func(o *prometheus.HistogramOpts) {
+ o.ConstLabels = labels
+ }
+}
+
+// WithHistogramSubsystem allows you to add a Subsystem to histograms metrics.
+func WithHistogramSubsystem(subsystem string) HistogramOption {
+ return func(o *prometheus.HistogramOpts) {
+ o.Subsystem = subsystem
+ }
+}
+
+// WithHistogramNamespace allows you to add a Namespace to histograms metrics.
+func WithHistogramNamespace(namespace string) HistogramOption {
+ return func(o *prometheus.HistogramOpts) {
+ o.Namespace = namespace
+ }
+}
+
+func typeFromMethodInfo(mInfo *grpc.MethodInfo) grpcType {
+ if !mInfo.IsClientStream && !mInfo.IsServerStream {
+ return Unary
+ }
+ if mInfo.IsClientStream && !mInfo.IsServerStream {
+ return ClientStream
+ }
+ if !mInfo.IsClientStream && mInfo.IsServerStream {
+ return ServerStream
+ }
+ return BidiStream
+}
+
+// An Option lets you add options to prometheus interceptors using With* funcs.
+type Option func(*config)
+
+type config struct {
+ exemplarFn exemplarFromCtxFn
+ labelsFn labelsFromCtxFn
+}
+
+func (c *config) apply(opts []Option) {
+ for _, o := range opts {
+ o(c)
+ }
+}
+
+// WithExemplarFromContext sets function that will be used to deduce exemplar for all counter and histogram metrics.
+func WithExemplarFromContext(exemplarFn exemplarFromCtxFn) Option {
+ return func(o *config) {
+ o.exemplarFn = exemplarFn
+ }
+}
+
+// WithLabelsFromContext sets function that will be used to extract labels from context for metrics.
+// This should be used in conjunction with WithContextLabels to define which labels to extract.
+func WithLabelsFromContext(labelsFn labelsFromCtxFn) Option {
+ return func(o *config) {
+ o.labelsFn = labelsFn
+ }
+}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/reporter.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/reporter.go
new file mode 100644
index 000000000..268beb3e6
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/reporter.go
@@ -0,0 +1,139 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+package prometheus
+
+import (
+ "context"
+ "time"
+
+ "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors"
+ "github.com/prometheus/client_golang/prometheus"
+)
+
+type reporter struct {
+ clientMetrics *ClientMetrics
+ serverMetrics *ServerMetrics
+ typ interceptors.GRPCType
+ service, method string
+ kind Kind
+ exemplar prometheus.Labels
+ contextLabels []string
+}
+
+func (r *reporter) PostCall(err error, rpcDuration time.Duration) {
+ // get status code from error
+ status := FromError(err)
+ code := status.Code()
+
+ // perform handling of metrics from code
+ switch r.kind {
+ case KindServer:
+ baseLabels := []string{string(r.typ), r.service, r.method, code.String()}
+ allLabels := append(baseLabels, r.contextLabels...)
+ r.incrementWithExemplar(r.serverMetrics.serverHandledCounter, allLabels...)
+ if r.serverMetrics.serverHandledHistogram != nil {
+ histLabels := []string{string(r.typ), r.service, r.method}
+ allHistLabels := append(histLabels, r.contextLabels...)
+ r.observeWithExemplar(r.serverMetrics.serverHandledHistogram, rpcDuration.Seconds(), allHistLabels...)
+ }
+
+ case KindClient:
+ r.incrementWithExemplar(r.clientMetrics.clientHandledCounter, string(r.typ), r.service, r.method, code.String())
+ if r.clientMetrics.clientHandledHistogram != nil {
+ r.observeWithExemplar(r.clientMetrics.clientHandledHistogram, rpcDuration.Seconds(), string(r.typ), r.service, r.method)
+ }
+ }
+}
+
+func (r *reporter) PostMsgSend(_ any, _ error, sendDuration time.Duration) {
+ switch r.kind {
+ case KindServer:
+ baseLabels := []string{string(r.typ), r.service, r.method}
+ allLabels := append(baseLabels, r.contextLabels...)
+ r.incrementWithExemplar(r.serverMetrics.serverStreamMsgSent, allLabels...)
+ case KindClient:
+ r.incrementWithExemplar(r.clientMetrics.clientStreamMsgSent, string(r.typ), r.service, r.method)
+ if r.clientMetrics.clientStreamSendHistogram != nil {
+ r.observeWithExemplar(r.clientMetrics.clientStreamSendHistogram, sendDuration.Seconds(), string(r.typ), r.service, r.method)
+ }
+ }
+}
+
+func (r *reporter) PostMsgReceive(_ any, _ error, recvDuration time.Duration) {
+ switch r.kind {
+ case KindServer:
+ baseLabels := []string{string(r.typ), r.service, r.method}
+ allLabels := append(baseLabels, r.contextLabels...)
+ r.incrementWithExemplar(r.serverMetrics.serverStreamMsgReceived, allLabels...)
+ case KindClient:
+ r.incrementWithExemplar(r.clientMetrics.clientStreamMsgReceived, string(r.typ), r.service, r.method)
+ if r.clientMetrics.clientStreamRecvHistogram != nil {
+ r.observeWithExemplar(r.clientMetrics.clientStreamRecvHistogram, recvDuration.Seconds(), string(r.typ), r.service, r.method)
+ }
+ }
+}
+
+type reportable struct {
+ clientMetrics *ClientMetrics
+ serverMetrics *ServerMetrics
+
+ opts []Option
+}
+
+func (rep *reportable) ServerReporter(ctx context.Context, meta interceptors.CallMeta) (interceptors.Reporter, context.Context) {
+ return rep.reporter(ctx, rep.serverMetrics, nil, meta, KindServer)
+}
+
+func (rep *reportable) ClientReporter(ctx context.Context, meta interceptors.CallMeta) (interceptors.Reporter, context.Context) {
+ return rep.reporter(ctx, nil, rep.clientMetrics, meta, KindClient)
+}
+
+func (rep *reportable) reporter(ctx context.Context, sm *ServerMetrics, cm *ClientMetrics, meta interceptors.CallMeta, kind Kind) (interceptors.Reporter, context.Context) {
+ var c config
+ c.apply(rep.opts)
+ r := &reporter{
+ clientMetrics: cm,
+ serverMetrics: sm,
+ typ: meta.Typ,
+ service: meta.Service,
+ method: meta.Method,
+ kind: kind,
+ }
+ if c.exemplarFn != nil {
+ r.exemplar = c.exemplarFn(ctx)
+ }
+
+ // Extract context labels if labelsFn is configured and we're on server side
+ if c.labelsFn != nil && kind == KindServer && sm != nil {
+ contextLabelMap := c.labelsFn(ctx)
+ // Extract context label values in the order defined by the server metrics
+ r.contextLabels = make([]string, len(sm.contextLabelNames))
+ for i, labelName := range sm.contextLabelNames {
+ if value, exists := contextLabelMap[labelName]; exists {
+ r.contextLabels[i] = value
+ } else {
+ // Use empty string if label not found in context
+ r.contextLabels[i] = ""
+ }
+ }
+ }
+
+ switch kind {
+ case KindClient:
+ r.incrementWithExemplar(r.clientMetrics.clientStartedCounter, string(r.typ), r.service, r.method)
+ case KindServer:
+ baseLabels := []string{string(r.typ), r.service, r.method}
+ allLabels := append(baseLabels, r.contextLabels...)
+ r.incrementWithExemplar(r.serverMetrics.serverStartedCounter, allLabels...)
+ }
+ return r, ctx
+}
+
+func (r *reporter) incrementWithExemplar(c *prometheus.CounterVec, lvals ...string) {
+ c.WithLabelValues(lvals...).(prometheus.ExemplarAdder).AddWithExemplar(1, r.exemplar)
+}
+
+func (r *reporter) observeWithExemplar(h *prometheus.HistogramVec, value float64, lvals ...string) {
+ h.WithLabelValues(lvals...).(prometheus.ExemplarObserver).ObserveWithExemplar(value, r.exemplar)
+}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_metrics.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_metrics.go
new file mode 100644
index 000000000..358d574ca
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_metrics.go
@@ -0,0 +1,163 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+package prometheus
+
+import (
+ "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors"
+ "github.com/prometheus/client_golang/prometheus"
+ "google.golang.org/grpc"
+ "google.golang.org/grpc/reflection"
+)
+
+// ServerMetrics represents a collection of metrics to be registered on a
+// Prometheus metrics registry for a gRPC server.
+type ServerMetrics struct {
+ serverStartedCounter *prometheus.CounterVec
+ serverHandledCounter *prometheus.CounterVec
+ serverStreamMsgReceived *prometheus.CounterVec
+ serverStreamMsgSent *prometheus.CounterVec
+ // serverHandledHistogram can be nil.
+ serverHandledHistogram *prometheus.HistogramVec
+ // contextLabelNames stores the names of context labels
+ contextLabelNames []string
+}
+
+// NewServerMetrics returns a new ServerMetrics object that has server interceptor methods.
+// NOTE: Remember to register ServerMetrics object by using prometheus registry
+// e.g. prometheus.MustRegister(myServerMetrics).
+func NewServerMetrics(opts ...ServerMetricsOption) *ServerMetrics {
+ var config serverMetricsConfig
+ config.apply(opts)
+
+ // Build label names by combining default labels with context labels
+ defaultLabels := []string{"grpc_type", "grpc_service", "grpc_method"}
+ defaultLabelsWithCode := []string{"grpc_type", "grpc_service", "grpc_method", "grpc_code"}
+
+ startedLabels := append(defaultLabels, config.contextLabels...)
+ handledLabels := append(defaultLabelsWithCode, config.contextLabels...)
+ streamLabels := append(defaultLabels, config.contextLabels...)
+
+ // Create histogram if enabled
+ var serverHandledHistogram *prometheus.HistogramVec
+ if config.enableHistogram {
+ histogramLabels := append(defaultLabels, config.contextLabels...)
+ serverHandledHistogram = prometheus.NewHistogramVec(
+ histogramOptions(config.histogramOpts).apply(prometheus.HistogramOpts{
+ Name: "grpc_server_handling_seconds",
+ Help: "Histogram of response latency (seconds) of gRPC that had been application-level handled by the server.",
+ Buckets: prometheus.DefBuckets,
+ }),
+ histogramLabels,
+ )
+ }
+
+ return &ServerMetrics{
+ serverStartedCounter: prometheus.NewCounterVec(
+ config.counterOpts.apply(prometheus.CounterOpts{
+ Name: "grpc_server_started_total",
+ Help: "Total number of RPCs started on the server.",
+ }), startedLabels),
+ serverHandledCounter: prometheus.NewCounterVec(
+ config.counterOpts.apply(prometheus.CounterOpts{
+ Name: "grpc_server_handled_total",
+ Help: "Total number of RPCs completed on the server, regardless of success or failure.",
+ }), handledLabels),
+ serverStreamMsgReceived: prometheus.NewCounterVec(
+ config.counterOpts.apply(prometheus.CounterOpts{
+ Name: "grpc_server_msg_received_total",
+ Help: "Total number of RPC stream messages received on the server.",
+ }), streamLabels),
+ serverStreamMsgSent: prometheus.NewCounterVec(
+ config.counterOpts.apply(prometheus.CounterOpts{
+ Name: "grpc_server_msg_sent_total",
+ Help: "Total number of gRPC stream messages sent by the server.",
+ }), streamLabels),
+ serverHandledHistogram: serverHandledHistogram,
+ contextLabelNames: config.contextLabels,
+ }
+}
+
+// Describe sends the super-set of all possible descriptors of metrics
+// collected by this Collector to the provided channel and returns once
+// the last descriptor has been sent.
+func (m *ServerMetrics) Describe(ch chan<- *prometheus.Desc) {
+ m.serverStartedCounter.Describe(ch)
+ m.serverHandledCounter.Describe(ch)
+ m.serverStreamMsgReceived.Describe(ch)
+ m.serverStreamMsgSent.Describe(ch)
+ if m.serverHandledHistogram != nil {
+ m.serverHandledHistogram.Describe(ch)
+ }
+}
+
+// Collect is called by the Prometheus registry when collecting
+// metrics. The implementation sends each collected metric via the
+// provided channel and returns once the last metric has been sent.
+func (m *ServerMetrics) Collect(ch chan<- prometheus.Metric) {
+ m.serverStartedCounter.Collect(ch)
+ m.serverHandledCounter.Collect(ch)
+ m.serverStreamMsgReceived.Collect(ch)
+ m.serverStreamMsgSent.Collect(ch)
+ if m.serverHandledHistogram != nil {
+ m.serverHandledHistogram.Collect(ch)
+ }
+}
+
+// InitializeMetrics initializes all metrics, with their appropriate null
+// value, for all gRPC methods registered on a gRPC server. This is useful, to
+// ensure that all metrics exist when collecting and querying.
+// NOTE: This might add significant cardinality and might not be needed in future version of Prometheus (created timestamp).
+func (m *ServerMetrics) InitializeMetrics(server reflection.ServiceInfoProvider) {
+ serviceInfo := server.GetServiceInfo()
+ for serviceName, info := range serviceInfo {
+ for _, mInfo := range info.Methods {
+ m.preRegisterMethod(serviceName, &mInfo)
+ }
+ }
+}
+
+// preRegisterMethod is invoked on Register of a Server, allowing all gRPC services labels to be pre-populated.
+func (m *ServerMetrics) preRegisterMethod(serviceName string, mInfo *grpc.MethodInfo) {
+ methodName := mInfo.Name
+ methodType := string(typeFromMethodInfo(mInfo))
+
+ // Create empty context label values for pre-registration
+ contextLabels := make([]string, len(m.contextLabelNames))
+ for i := range contextLabels {
+ contextLabels[i] = ""
+ }
+
+ // Build complete label value arrays
+ startedLabels := append([]string{methodType, serviceName, methodName}, contextLabels...)
+ handledLabels := append([]string{methodType, serviceName, methodName}, contextLabels...)
+ streamLabels := append([]string{methodType, serviceName, methodName}, contextLabels...)
+
+ // These are just references (no increments), as just referencing will create the labels but not set values.
+ _, _ = m.serverStartedCounter.GetMetricWithLabelValues(startedLabels...)
+ _, _ = m.serverStreamMsgReceived.GetMetricWithLabelValues(streamLabels...)
+ _, _ = m.serverStreamMsgSent.GetMetricWithLabelValues(streamLabels...)
+ if m.serverHandledHistogram != nil {
+ _, _ = m.serverHandledHistogram.GetMetricWithLabelValues(streamLabels...)
+ }
+ for _, code := range interceptors.AllCodes {
+ handledLabelsWithCode := append(handledLabels, code.String())
+ _, _ = m.serverHandledCounter.GetMetricWithLabelValues(handledLabelsWithCode...)
+ }
+}
+
+// UnaryServerInterceptor is a gRPC server-side interceptor that provides Prometheus monitoring for Unary RPCs.
+func (m *ServerMetrics) UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor {
+ return interceptors.UnaryServerInterceptor(&reportable{
+ opts: opts,
+ serverMetrics: m,
+ })
+}
+
+// StreamServerInterceptor is a gRPC server-side interceptor that provides Prometheus monitoring for Streaming RPCs.
+func (m *ServerMetrics) StreamServerInterceptor(opts ...Option) grpc.StreamServerInterceptor {
+ return interceptors.StreamServerInterceptor(&reportable{
+ opts: opts,
+ serverMetrics: m,
+ })
+}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_options.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_options.go
new file mode 100644
index 000000000..14340637d
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus/server_options.go
@@ -0,0 +1,56 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+package prometheus
+
+import (
+ "context"
+
+ "github.com/prometheus/client_golang/prometheus"
+)
+
+type exemplarFromCtxFn func(ctx context.Context) prometheus.Labels
+type labelsFromCtxFn func(metadata context.Context) prometheus.Labels
+
+type serverMetricsConfig struct {
+ counterOpts counterOptions
+ // histogramOpts stores the options for creating the histogram with dynamic labels
+ histogramOpts histogramOptions
+ // enableHistogram indicates whether histogram should be created
+ enableHistogram bool
+ // contextLabels defines the names of dynamic labels to be extracted from context
+ contextLabels []string
+}
+
+type ServerMetricsOption func(*serverMetricsConfig)
+
+func (c *serverMetricsConfig) apply(opts []ServerMetricsOption) {
+ for _, o := range opts {
+ o(c)
+ }
+}
+
+// WithServerCounterOptions sets counter options.
+func WithServerCounterOptions(opts ...CounterOption) ServerMetricsOption {
+ return func(o *serverMetricsConfig) {
+ o.counterOpts = opts
+ }
+}
+
+// WithServerHandlingTimeHistogram turns on recording of handling time of RPCs.
+// Histogram metrics can be very expensive for Prometheus to retain and query.
+func WithServerHandlingTimeHistogram(opts ...HistogramOption) ServerMetricsOption {
+ return func(o *serverMetricsConfig) {
+ o.histogramOpts = opts
+ o.enableHistogram = true
+ }
+}
+
+// WithContextLabels configures the server metrics to include dynamic labels extracted from context.
+// The provided label names will be added to all server metrics as dynamic labels.
+// Use WithLabelsFromContext in the interceptor options to specify how to extract these labels from context.
+func WithContextLabels(labelNames ...string) ServerMetricsOption {
+ return func(o *serverMetricsConfig) {
+ o.contextLabels = labelNames
+ }
+}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/COPYRIGHT b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/COPYRIGHT
new file mode 100644
index 000000000..3b13627cd
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/COPYRIGHT
@@ -0,0 +1,2 @@
+Copyright (c) The go-grpc-middleware Authors.
+Licensed under the Apache License 2.0.
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/LICENSE b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/LICENSE
new file mode 100644
index 000000000..b2b065037
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/LICENSE
@@ -0,0 +1,201 @@
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright [yyyy] [name of copyright owner]
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
\ No newline at end of file
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/callmeta.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/callmeta.go
new file mode 100644
index 000000000..df3f5d11a
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/callmeta.go
@@ -0,0 +1,67 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+package interceptors
+
+import (
+ "fmt"
+ "strings"
+
+ "google.golang.org/grpc"
+)
+
+func splitFullMethodName(fullMethod string) (string, string) {
+ fullMethod = strings.TrimPrefix(fullMethod, "/") // remove leading slash
+ if i := strings.Index(fullMethod, "/"); i >= 0 {
+ return fullMethod[:i], fullMethod[i+1:]
+ }
+ return "unknown", "unknown"
+}
+
+type CallMeta struct {
+ ReqOrNil any
+ Typ GRPCType
+ Service string
+ Method string
+ IsClient bool
+}
+
+func NewClientCallMeta(fullMethod string, streamDesc *grpc.StreamDesc, reqOrNil any) CallMeta {
+ c := CallMeta{IsClient: true, ReqOrNil: reqOrNil, Typ: Unary}
+ if streamDesc != nil {
+ c.Typ = clientStreamType(streamDesc)
+ }
+ c.Service, c.Method = splitFullMethodName(fullMethod)
+ return c
+}
+
+func NewServerCallMeta(fullMethod string, streamInfo *grpc.StreamServerInfo, reqOrNil any) CallMeta {
+ c := CallMeta{IsClient: false, ReqOrNil: reqOrNil, Typ: Unary}
+ if streamInfo != nil {
+ c.Typ = serverStreamType(streamInfo)
+ }
+ c.Service, c.Method = splitFullMethodName(fullMethod)
+ return c
+}
+
+func (c CallMeta) FullMethod() string {
+ return fmt.Sprintf("/%s/%s", c.Service, c.Method)
+}
+
+func clientStreamType(desc *grpc.StreamDesc) GRPCType {
+ if desc.ClientStreams && !desc.ServerStreams {
+ return ClientStream
+ } else if !desc.ClientStreams && desc.ServerStreams {
+ return ServerStream
+ }
+ return BidiStream
+}
+
+func serverStreamType(info *grpc.StreamServerInfo) GRPCType {
+ if info.IsClientStream && !info.IsServerStream {
+ return ClientStream
+ } else if !info.IsClientStream && info.IsServerStream {
+ return ServerStream
+ }
+ return BidiStream
+}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/client.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/client.go
new file mode 100644
index 000000000..7b4460e21
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/client.go
@@ -0,0 +1,80 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+// Go gRPC Middleware monitoring interceptors for client-side gRPC.
+
+package interceptors
+
+import (
+ "context"
+ "errors"
+ "io"
+ "time"
+
+ "google.golang.org/grpc"
+)
+
+// UnaryClientInterceptor is a gRPC client-side interceptor that provides reporting for Unary RPCs.
+func UnaryClientInterceptor(reportable ClientReportable) grpc.UnaryClientInterceptor {
+ return func(ctx context.Context, method string, req, reply any, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
+ r := newReport(NewClientCallMeta(method, nil, req))
+ reporter, newCtx := reportable.ClientReporter(ctx, r.callMeta)
+
+ reporter.PostMsgSend(req, nil, time.Since(r.startTime))
+ err := invoker(newCtx, method, req, reply, cc, opts...)
+ reporter.PostMsgReceive(reply, err, time.Since(r.startTime))
+ reporter.PostCall(err, time.Since(r.startTime))
+ return err
+ }
+}
+
+// StreamClientInterceptor is a gRPC client-side interceptor that provides reporting for Stream RPCs.
+func StreamClientInterceptor(reportable ClientReportable) grpc.StreamClientInterceptor {
+ return func(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string, streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) {
+ r := newReport(NewClientCallMeta(method, desc, nil))
+ reporter, newCtx := reportable.ClientReporter(ctx, r.callMeta)
+
+ clientStream, err := streamer(newCtx, desc, cc, method, opts...)
+ if err != nil {
+ reporter.PostCall(err, time.Since(r.startTime))
+ return nil, err
+ }
+ return &monitoredClientStream{ClientStream: clientStream, startTime: r.startTime, hasServerStream: desc.ServerStreams, reporter: reporter}, nil
+ }
+}
+
+// monitoredClientStream wraps grpc.ClientStream allowing each Sent/Recv of message to report.
+type monitoredClientStream struct {
+ grpc.ClientStream
+
+ startTime time.Time
+ hasServerStream bool
+ reporter Reporter
+}
+
+func (s *monitoredClientStream) SendMsg(m any) error {
+ start := time.Now()
+ err := s.ClientStream.SendMsg(m)
+ s.reporter.PostMsgSend(m, err, time.Since(start))
+ return err
+}
+
+func (s *monitoredClientStream) RecvMsg(m any) error {
+ start := time.Now()
+ err := s.ClientStream.RecvMsg(m)
+ s.reporter.PostMsgReceive(m, err, time.Since(start))
+
+ if s.hasServerStream {
+ if err == nil {
+ return nil
+ }
+ var postErr error
+ if !errors.Is(err, io.EOF) {
+ postErr = err
+ }
+ s.reporter.PostCall(postErr, time.Since(s.startTime))
+ } else {
+ s.reporter.PostCall(err, time.Since(s.startTime))
+ }
+ return err
+}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/doc.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/doc.go
new file mode 100644
index 000000000..2608b9a4f
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/doc.go
@@ -0,0 +1,12 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+//
+/*
+interceptor is an internal package used by higher level middlewares. It allows injecting custom code in various
+places of the gRPC lifecycle.
+
+This particular package is intended for use by other middleware, metric, logging or otherwise.
+This allows code to be shared between different implementations.
+*/
+package interceptors
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/reporter.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/reporter.go
new file mode 100644
index 000000000..c1731962a
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/reporter.go
@@ -0,0 +1,73 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+package interceptors
+
+import (
+ "context"
+ "time"
+
+ "google.golang.org/grpc/codes"
+)
+
+type GRPCType string
+
+const (
+ Unary GRPCType = "unary"
+ ClientStream GRPCType = "client_stream"
+ ServerStream GRPCType = "server_stream"
+ BidiStream GRPCType = "bidi_stream"
+)
+
+var AllCodes = []codes.Code{
+ codes.OK, codes.Canceled, codes.Unknown, codes.InvalidArgument, codes.DeadlineExceeded, codes.NotFound,
+ codes.AlreadyExists, codes.PermissionDenied, codes.Unauthenticated, codes.ResourceExhausted,
+ codes.FailedPrecondition, codes.Aborted, codes.OutOfRange, codes.Unimplemented, codes.Internal,
+ codes.Unavailable, codes.DataLoss,
+}
+
+type ClientReportable interface {
+ ClientReporter(context.Context, CallMeta) (Reporter, context.Context)
+}
+
+type ServerReportable interface {
+ ServerReporter(context.Context, CallMeta) (Reporter, context.Context)
+}
+
+// CommonReportableFunc helper allows an easy way to implement reporter with common client and server logic.
+type CommonReportableFunc func(ctx context.Context, c CallMeta) (Reporter, context.Context)
+
+func (f CommonReportableFunc) ClientReporter(ctx context.Context, c CallMeta) (Reporter, context.Context) {
+ return f(ctx, c)
+}
+
+func (f CommonReportableFunc) ServerReporter(ctx context.Context, c CallMeta) (Reporter, context.Context) {
+ return f(ctx, c)
+}
+
+type Reporter interface {
+ PostCall(err error, rpcDuration time.Duration)
+ PostMsgSend(reqProto any, err error, sendDuration time.Duration)
+ PostMsgReceive(replyProto any, err error, recvDuration time.Duration)
+}
+
+var _ Reporter = NoopReporter{}
+
+type NoopReporter struct{}
+
+func (NoopReporter) PostCall(error, time.Duration) {}
+func (NoopReporter) PostMsgSend(any, error, time.Duration) {}
+func (NoopReporter) PostMsgReceive(any, error, time.Duration) {}
+
+type report struct {
+ callMeta CallMeta
+ startTime time.Time
+}
+
+func newReport(callMeta CallMeta) report {
+ r := report{
+ startTime: time.Now(),
+ callMeta: callMeta,
+ }
+ return r
+}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/server.go b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/server.go
new file mode 100644
index 000000000..048410906
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/server.go
@@ -0,0 +1,65 @@
+// Copyright (c) The go-grpc-middleware Authors.
+// Licensed under the Apache License 2.0.
+
+// Go gRPC Middleware monitoring interceptors for server-side gRPC.
+
+package interceptors
+
+import (
+ "context"
+ "time"
+
+ "google.golang.org/grpc"
+)
+
+// UnaryServerInterceptor is a gRPC server-side interceptor that provides reporting for Unary RPCs.
+func UnaryServerInterceptor(reportable ServerReportable) grpc.UnaryServerInterceptor {
+ return func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+ r := newReport(NewServerCallMeta(info.FullMethod, nil, req))
+ reporter, newCtx := reportable.ServerReporter(ctx, r.callMeta)
+
+ reporter.PostMsgReceive(req, nil, time.Since(r.startTime))
+ resp, err := handler(newCtx, req)
+ reporter.PostMsgSend(resp, err, time.Since(r.startTime))
+
+ reporter.PostCall(err, time.Since(r.startTime))
+ return resp, err
+ }
+}
+
+// StreamServerInterceptor is a gRPC server-side interceptor that provides reporting for Streaming RPCs.
+func StreamServerInterceptor(reportable ServerReportable) grpc.StreamServerInterceptor {
+ return func(srv any, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+ r := newReport(NewServerCallMeta(info.FullMethod, info, nil))
+ reporter, newCtx := reportable.ServerReporter(ss.Context(), r.callMeta)
+ err := handler(srv, &monitoredServerStream{ServerStream: ss, newCtx: newCtx, reporter: reporter})
+ reporter.PostCall(err, time.Since(r.startTime))
+ return err
+ }
+}
+
+// monitoredStream wraps grpc.ServerStream allowing each Sent/Recv of message to report.
+type monitoredServerStream struct {
+ grpc.ServerStream
+
+ newCtx context.Context
+ reporter Reporter
+}
+
+func (s *monitoredServerStream) Context() context.Context {
+ return s.newCtx
+}
+
+func (s *monitoredServerStream) SendMsg(m any) error {
+ start := time.Now()
+ err := s.ServerStream.SendMsg(m)
+ s.reporter.PostMsgSend(m, err, time.Since(start))
+ return err
+}
+
+func (s *monitoredServerStream) RecvMsg(m any) error {
+ start := time.Now()
+ err := s.ServerStream.RecvMsg(m)
+ s.reporter.PostMsgReceive(m, err, time.Since(start))
+ return err
+}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.gitignore b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.gitignore
deleted file mode 100644
index 2233cff9d..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.gitignore
+++ /dev/null
@@ -1,201 +0,0 @@
-#vendor
-vendor/
-
-# Created by .ignore support plugin (hsz.mobi)
-coverage.txt
-### Go template
-# Compiled Object files, Static and Dynamic libs (Shared Objects)
-*.o
-*.a
-*.so
-
-# Folders
-_obj
-_test
-
-# Architecture specific extensions/prefixes
-*.[568vq]
-[568vq].out
-
-*.cgo1.go
-*.cgo2.c
-_cgo_defun.c
-_cgo_gotypes.go
-_cgo_export.*
-
-_testmain.go
-
-*.exe
-*.test
-*.prof
-### Windows template
-# Windows image file caches
-Thumbs.db
-ehthumbs.db
-
-# Folder config file
-Desktop.ini
-
-# Recycle Bin used on file shares
-$RECYCLE.BIN/
-
-# Windows Installer files
-*.cab
-*.msi
-*.msm
-*.msp
-
-# Windows shortcuts
-*.lnk
-### Kate template
-# Swap Files #
-.*.kate-swp
-.swp.*
-### SublimeText template
-# cache files for sublime text
-*.tmlanguage.cache
-*.tmPreferences.cache
-*.stTheme.cache
-
-# workspace files are user-specific
-*.sublime-workspace
-
-# project files should be checked into the repository, unless a significant
-# proportion of contributors will probably not be using SublimeText
-# *.sublime-project
-
-# sftp configuration file
-sftp-config.json
-### Linux template
-*~
-
-# temporary files which can be created if a process still has a handle open of a deleted file
-.fuse_hidden*
-
-# KDE directory preferences
-.directory
-
-# Linux trash folder which might appear on any partition or disk
-.Trash-*
-### JetBrains template
-# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm
-# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
-
-# User-specific stuff:
-.idea
-.idea/tasks.xml
-.idea/dictionaries
-.idea/vcs.xml
-.idea/jsLibraryMappings.xml
-
-# Sensitive or high-churn files:
-.idea/dataSources.ids
-.idea/dataSources.xml
-.idea/dataSources.local.xml
-.idea/sqlDataSources.xml
-.idea/dynamic.xml
-.idea/uiDesigner.xml
-
-# Gradle:
-.idea/gradle.xml
-.idea/libraries
-
-# Mongo Explorer plugin:
-.idea/mongoSettings.xml
-
-## File-based project format:
-*.iws
-
-## Plugin-specific files:
-
-# IntelliJ
-/out/
-
-# mpeltonen/sbt-idea plugin
-.idea_modules/
-
-# JIRA plugin
-atlassian-ide-plugin.xml
-
-# Crashlytics plugin (for Android Studio and IntelliJ)
-com_crashlytics_export_strings.xml
-crashlytics.properties
-crashlytics-build.properties
-fabric.properties
-### Xcode template
-# Xcode
-#
-# gitignore contributors: remember to update Global/Xcode.gitignore, Objective-C.gitignore & Swift.gitignore
-
-## Build generated
-build/
-DerivedData/
-
-## Various settings
-*.pbxuser
-!default.pbxuser
-*.mode1v3
-!default.mode1v3
-*.mode2v3
-!default.mode2v3
-*.perspectivev3
-!default.perspectivev3
-xcuserdata/
-
-## Other
-*.moved-aside
-*.xccheckout
-*.xcscmblueprint
-### Eclipse template
-
-.metadata
-bin/
-tmp/
-*.tmp
-*.bak
-*.swp
-*~.nib
-local.properties
-.settings/
-.loadpath
-.recommenders
-
-# Eclipse Core
-.project
-
-# External tool builders
-.externalToolBuilders/
-
-# Locally stored "Eclipse launch configurations"
-*.launch
-
-# PyDev specific (Python IDE for Eclipse)
-*.pydevproject
-
-# CDT-specific (C/C++ Development Tooling)
-.cproject
-
-# JDT-specific (Eclipse Java Development Tools)
-.classpath
-
-# Java annotation processor (APT)
-.factorypath
-
-# PDT-specific (PHP Development Tools)
-.buildpath
-
-# sbteclipse plugin
-.target
-
-# Tern plugin
-.tern-project
-
-# TeXlipse plugin
-.texlipse
-
-# STS (Spring Tool Suite)
-.springBeans
-
-# Code Recommenders
-.recommenders/
-
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.travis.yml b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.travis.yml
deleted file mode 100644
index 2a845b96a..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/.travis.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-sudo: false
-language: go
-# * github.com/grpc/grpc-go still supports go1.6
-# - When we drop support for go1.6 we can remove golang.org/x/net/context
-# below as it is part of the Go std library since go1.7
-# * github.com/prometheus/client_golang already requires at least go1.7 since
-# September 2017
-go:
- - 1.6.x
- - 1.7.x
- - 1.8.x
- - 1.9.x
- - 1.10.x
- - master
-
-install:
- - go get github.com/prometheus/client_golang/prometheus
- - go get google.golang.org/grpc
- - go get golang.org/x/net/context
- - go get github.com/stretchr/testify
-script:
- - make test
-
-after_success:
- - bash <(curl -s https://codecov.io/bash)
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/CHANGELOG.md b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/CHANGELOG.md
deleted file mode 100644
index 19a8059e1..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/CHANGELOG.md
+++ /dev/null
@@ -1,24 +0,0 @@
-# Changelog
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
-and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-## [1.2.0](https://github.com/grpc-ecosystem/go-grpc-prometheus/releases/tag/v1.2.0) - 2018-06-04
-
-### Added
-
-* Provide metrics object as `prometheus.Collector`, for conventional metric registration.
-* Support non-default/global Prometheus registry.
-* Allow configuring counters with `prometheus.CounterOpts`.
-
-### Changed
-
-* Remove usage of deprecated `grpc.Code()`.
-* Remove usage of deprecated `grpc.Errorf` and replace with `status.Errorf`.
-
----
-
-This changelog was started with version `v1.2.0`, for earlier versions refer to the respective [GitHub releases](https://github.com/grpc-ecosystem/go-grpc-prometheus/releases).
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/README.md b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/README.md
deleted file mode 100644
index 499c58355..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/README.md
+++ /dev/null
@@ -1,247 +0,0 @@
-# Go gRPC Interceptors for Prometheus monitoring
-
-[](https://travis-ci.org/grpc-ecosystem/go-grpc-prometheus)
-[](http://goreportcard.com/report/grpc-ecosystem/go-grpc-prometheus)
-[](https://godoc.org/github.com/grpc-ecosystem/go-grpc-prometheus)
-[](https://sourcegraph.com/github.com/grpc-ecosystem/go-grpc-prometheus/?badge)
-[](https://codecov.io/gh/grpc-ecosystem/go-grpc-prometheus)
-[](LICENSE)
-
-[Prometheus](https://prometheus.io/) monitoring for your [gRPC Go](https://github.com/grpc/grpc-go) servers and clients.
-
-A sister implementation for [gRPC Java](https://github.com/grpc/grpc-java) (same metrics, same semantics) is in [grpc-ecosystem/java-grpc-prometheus](https://github.com/grpc-ecosystem/java-grpc-prometheus).
-
-## Interceptors
-
-[gRPC Go](https://github.com/grpc/grpc-go) recently acquired support for Interceptors, i.e. middleware that is executed
-by a gRPC Server before the request is passed onto the user's application logic. It is a perfect way to implement
-common patterns: auth, logging and... monitoring.
-
-To use Interceptors in chains, please see [`go-grpc-middleware`](https://github.com/mwitkow/go-grpc-middleware).
-
-## Usage
-
-There are two types of interceptors: client-side and server-side. This package provides monitoring Interceptors for both.
-
-### Server-side
-
-```go
-import "github.com/grpc-ecosystem/go-grpc-prometheus"
-...
- // Initialize your gRPC server's interceptor.
- myServer := grpc.NewServer(
- grpc.StreamInterceptor(grpc_prometheus.StreamServerInterceptor),
- grpc.UnaryInterceptor(grpc_prometheus.UnaryServerInterceptor),
- )
- // Register your gRPC service implementations.
- myservice.RegisterMyServiceServer(s.server, &myServiceImpl{})
- // After all your registrations, make sure all of the Prometheus metrics are initialized.
- grpc_prometheus.Register(myServer)
- // Register Prometheus metrics handler.
- http.Handle("/metrics", promhttp.Handler())
-...
-```
-
-### Client-side
-
-```go
-import "github.com/grpc-ecosystem/go-grpc-prometheus"
-...
- clientConn, err = grpc.Dial(
- address,
- grpc.WithUnaryInterceptor(grpc_prometheus.UnaryClientInterceptor),
- grpc.WithStreamInterceptor(grpc_prometheus.StreamClientInterceptor)
- )
- client = pb_testproto.NewTestServiceClient(clientConn)
- resp, err := client.PingEmpty(s.ctx, &myservice.Request{Msg: "hello"})
-...
-```
-
-# Metrics
-
-## Labels
-
-All server-side metrics start with `grpc_server` as Prometheus subsystem name. All client-side metrics start with `grpc_client`. Both of them have mirror-concepts. Similarly all methods
-contain the same rich labels:
-
- * `grpc_service` - the [gRPC service](http://www.grpc.io/docs/#defining-a-service) name, which is the combination of protobuf `package` and
- the `grpc_service` section name. E.g. for `package = mwitkow.testproto` and
- `service TestService` the label will be `grpc_service="mwitkow.testproto.TestService"`
- * `grpc_method` - the name of the method called on the gRPC service. E.g.
- `grpc_method="Ping"`
- * `grpc_type` - the gRPC [type of request](http://www.grpc.io/docs/guides/concepts.html#rpc-life-cycle).
- Differentiating between the two is important especially for latency measurements.
-
- - `unary` is single request, single response RPC
- - `client_stream` is a multi-request, single response RPC
- - `server_stream` is a single request, multi-response RPC
- - `bidi_stream` is a multi-request, multi-response RPC
-
-
-Additionally for completed RPCs, the following labels are used:
-
- * `grpc_code` - the human-readable [gRPC status code](https://github.com/grpc/grpc-go/blob/master/codes/codes.go).
- The list of all statuses is to long, but here are some common ones:
-
- - `OK` - means the RPC was successful
- - `IllegalArgument` - RPC contained bad values
- - `Internal` - server-side error not disclosed to the clients
-
-## Counters
-
-The counters and their up to date documentation is in [server_reporter.go](server_reporter.go) and [client_reporter.go](client_reporter.go)
-the respective Prometheus handler (usually `/metrics`).
-
-For the purpose of this documentation we will only discuss `grpc_server` metrics. The `grpc_client` ones contain mirror concepts.
-
-For simplicity, let's assume we're tracking a single server-side RPC call of [`mwitkow.testproto.TestService`](examples/testproto/test.proto),
-calling the method `PingList`. The call succeeds and returns 20 messages in the stream.
-
-First, immediately after the server receives the call it will increment the
-`grpc_server_started_total` and start the handling time clock (if histograms are enabled).
-
-```jsoniq
-grpc_server_started_total{grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream"} 1
-```
-
-Then the user logic gets invoked. It receives one message from the client containing the request
-(it's a `server_stream`):
-
-```jsoniq
-grpc_server_msg_received_total{grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream"} 1
-```
-
-The user logic may return an error, or send multiple messages back to the client. In this case, on
-each of the 20 messages sent back, a counter will be incremented:
-
-```jsoniq
-grpc_server_msg_sent_total{grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream"} 20
-```
-
-After the call completes, its status (`OK` or other [gRPC status code](https://github.com/grpc/grpc-go/blob/master/codes/codes.go))
-and the relevant call labels increment the `grpc_server_handled_total` counter.
-
-```jsoniq
-grpc_server_handled_total{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream"} 1
-```
-
-## Histograms
-
-[Prometheus histograms](https://prometheus.io/docs/concepts/metric_types/#histogram) are a great way
-to measure latency distributions of your RPCs. However, since it is bad practice to have metrics
-of [high cardinality](https://prometheus.io/docs/practices/instrumentation/#do-not-overuse-labels)
-the latency monitoring metrics are disabled by default. To enable them please call the following
-in your server initialization code:
-
-```jsoniq
-grpc_prometheus.EnableHandlingTimeHistogram()
-```
-
-After the call completes, its handling time will be recorded in a [Prometheus histogram](https://prometheus.io/docs/concepts/metric_types/#histogram)
-variable `grpc_server_handling_seconds`. The histogram variable contains three sub-metrics:
-
- * `grpc_server_handling_seconds_count` - the count of all completed RPCs by status and method
- * `grpc_server_handling_seconds_sum` - cumulative time of RPCs by status and method, useful for
- calculating average handling times
- * `grpc_server_handling_seconds_bucket` - contains the counts of RPCs by status and method in respective
- handling-time buckets. These buckets can be used by Prometheus to estimate SLAs (see [here](https://prometheus.io/docs/practices/histograms/))
-
-The counter values will look as follows:
-
-```jsoniq
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="0.005"} 1
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="0.01"} 1
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="0.025"} 1
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="0.05"} 1
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="0.1"} 1
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="0.25"} 1
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="0.5"} 1
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="1"} 1
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="2.5"} 1
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="5"} 1
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="10"} 1
-grpc_server_handling_seconds_bucket{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream",le="+Inf"} 1
-grpc_server_handling_seconds_sum{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream"} 0.0003866430000000001
-grpc_server_handling_seconds_count{grpc_code="OK",grpc_method="PingList",grpc_service="mwitkow.testproto.TestService",grpc_type="server_stream"} 1
-```
-
-
-## Useful query examples
-
-Prometheus philosophy is to provide raw metrics to the monitoring system, and
-let the aggregations be handled there. The verbosity of above metrics make it possible to have that
-flexibility. Here's a couple of useful monitoring queries:
-
-
-### request inbound rate
-```jsoniq
-sum(rate(grpc_server_started_total{job="foo"}[1m])) by (grpc_service)
-```
-For `job="foo"` (common label to differentiate between Prometheus monitoring targets), calculate the
-rate of requests per second (1 minute window) for each gRPC `grpc_service` that the job has. Please note
-how the `grpc_method` is being omitted here: all methods of a given gRPC service will be summed together.
-
-### unary request error rate
-```jsoniq
-sum(rate(grpc_server_handled_total{job="foo",grpc_type="unary",grpc_code!="OK"}[1m])) by (grpc_service)
-```
-For `job="foo"`, calculate the per-`grpc_service` rate of `unary` (1:1) RPCs that failed, i.e. the
-ones that didn't finish with `OK` code.
-
-### unary request error percentage
-```jsoniq
-sum(rate(grpc_server_handled_total{job="foo",grpc_type="unary",grpc_code!="OK"}[1m])) by (grpc_service)
- /
-sum(rate(grpc_server_started_total{job="foo",grpc_type="unary"}[1m])) by (grpc_service)
- * 100.0
-```
-For `job="foo"`, calculate the percentage of failed requests by service. It's easy to notice that
-this is a combination of the two above examples. This is an example of a query you would like to
-[alert on](https://prometheus.io/docs/alerting/rules/) in your system for SLA violations, e.g.
-"no more than 1% requests should fail".
-
-### average response stream size
-```jsoniq
-sum(rate(grpc_server_msg_sent_total{job="foo",grpc_type="server_stream"}[10m])) by (grpc_service)
- /
-sum(rate(grpc_server_started_total{job="foo",grpc_type="server_stream"}[10m])) by (grpc_service)
-```
-For `job="foo"` what is the `grpc_service`-wide `10m` average of messages returned for all `
-server_stream` RPCs. This allows you to track the stream sizes returned by your system, e.g. allows
-you to track when clients started to send "wide" queries that ret
-Note the divisor is the number of started RPCs, in order to account for in-flight requests.
-
-### 99%-tile latency of unary requests
-```jsoniq
-histogram_quantile(0.99,
- sum(rate(grpc_server_handling_seconds_bucket{job="foo",grpc_type="unary"}[5m])) by (grpc_service,le)
-)
-```
-For `job="foo"`, returns an 99%-tile [quantile estimation](https://prometheus.io/docs/practices/histograms/#quantiles)
-of the handling time of RPCs per service. Please note the `5m` rate, this means that the quantile
-estimation will take samples in a rolling `5m` window. When combined with other quantiles
-(e.g. 50%, 90%), this query gives you tremendous insight into the responsiveness of your system
-(e.g. impact of caching).
-
-### percentage of slow unary queries (>250ms)
-```jsoniq
-100.0 - (
-sum(rate(grpc_server_handling_seconds_bucket{job="foo",grpc_type="unary",le="0.25"}[5m])) by (grpc_service)
- /
-sum(rate(grpc_server_handling_seconds_count{job="foo",grpc_type="unary"}[5m])) by (grpc_service)
-) * 100.0
-```
-For `job="foo"` calculate the by-`grpc_service` fraction of slow requests that took longer than `0.25`
-seconds. This query is relatively complex, since the Prometheus aggregations use `le` (less or equal)
-buckets, meaning that counting "fast" requests fractions is easier. However, simple maths helps.
-This is an example of a query you would like to alert on in your system for SLA violations,
-e.g. "less than 1% of requests are slower than 250ms".
-
-
-## Status
-
-This code has been used since August 2015 as the basis for monitoring of *production* gRPC micro services at [Improbable](https://improbable.io).
-
-## License
-
-`go-grpc-prometheus` is released under the Apache 2.0 license. See the [LICENSE](LICENSE) file for details.
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client.go b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client.go
deleted file mode 100644
index 751a4c72d..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client.go
+++ /dev/null
@@ -1,39 +0,0 @@
-// Copyright 2016 Michal Witkowski. All Rights Reserved.
-// See LICENSE for licensing terms.
-
-// gRPC Prometheus monitoring interceptors for client-side gRPC.
-
-package grpc_prometheus
-
-import (
- prom "github.com/prometheus/client_golang/prometheus"
-)
-
-var (
- // DefaultClientMetrics is the default instance of ClientMetrics. It is
- // intended to be used in conjunction the default Prometheus metrics
- // registry.
- DefaultClientMetrics = NewClientMetrics()
-
- // UnaryClientInterceptor is a gRPC client-side interceptor that provides Prometheus monitoring for Unary RPCs.
- UnaryClientInterceptor = DefaultClientMetrics.UnaryClientInterceptor()
-
- // StreamClientInterceptor is a gRPC client-side interceptor that provides Prometheus monitoring for Streaming RPCs.
- StreamClientInterceptor = DefaultClientMetrics.StreamClientInterceptor()
-)
-
-func init() {
- prom.MustRegister(DefaultClientMetrics.clientStartedCounter)
- prom.MustRegister(DefaultClientMetrics.clientHandledCounter)
- prom.MustRegister(DefaultClientMetrics.clientStreamMsgReceived)
- prom.MustRegister(DefaultClientMetrics.clientStreamMsgSent)
-}
-
-// EnableClientHandlingTimeHistogram turns on recording of handling time of
-// RPCs. Histogram metrics can be very expensive for Prometheus to retain and
-// query. This function acts on the DefaultClientMetrics variable and the
-// default Prometheus metrics registry.
-func EnableClientHandlingTimeHistogram(opts ...HistogramOption) {
- DefaultClientMetrics.EnableClientHandlingTimeHistogram(opts...)
- prom.Register(DefaultClientMetrics.clientHandledHistogram)
-}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_metrics.go b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_metrics.go
deleted file mode 100644
index 9b476f983..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_metrics.go
+++ /dev/null
@@ -1,170 +0,0 @@
-package grpc_prometheus
-
-import (
- "io"
-
- prom "github.com/prometheus/client_golang/prometheus"
- "golang.org/x/net/context"
- "google.golang.org/grpc"
- "google.golang.org/grpc/codes"
- "google.golang.org/grpc/status"
-)
-
-// ClientMetrics represents a collection of metrics to be registered on a
-// Prometheus metrics registry for a gRPC client.
-type ClientMetrics struct {
- clientStartedCounter *prom.CounterVec
- clientHandledCounter *prom.CounterVec
- clientStreamMsgReceived *prom.CounterVec
- clientStreamMsgSent *prom.CounterVec
- clientHandledHistogramEnabled bool
- clientHandledHistogramOpts prom.HistogramOpts
- clientHandledHistogram *prom.HistogramVec
-}
-
-// NewClientMetrics returns a ClientMetrics object. Use a new instance of
-// ClientMetrics when not using the default Prometheus metrics registry, for
-// example when wanting to control which metrics are added to a registry as
-// opposed to automatically adding metrics via init functions.
-func NewClientMetrics(counterOpts ...CounterOption) *ClientMetrics {
- opts := counterOptions(counterOpts)
- return &ClientMetrics{
- clientStartedCounter: prom.NewCounterVec(
- opts.apply(prom.CounterOpts{
- Name: "grpc_client_started_total",
- Help: "Total number of RPCs started on the client.",
- }), []string{"grpc_type", "grpc_service", "grpc_method"}),
-
- clientHandledCounter: prom.NewCounterVec(
- opts.apply(prom.CounterOpts{
- Name: "grpc_client_handled_total",
- Help: "Total number of RPCs completed by the client, regardless of success or failure.",
- }), []string{"grpc_type", "grpc_service", "grpc_method", "grpc_code"}),
-
- clientStreamMsgReceived: prom.NewCounterVec(
- opts.apply(prom.CounterOpts{
- Name: "grpc_client_msg_received_total",
- Help: "Total number of RPC stream messages received by the client.",
- }), []string{"grpc_type", "grpc_service", "grpc_method"}),
-
- clientStreamMsgSent: prom.NewCounterVec(
- opts.apply(prom.CounterOpts{
- Name: "grpc_client_msg_sent_total",
- Help: "Total number of gRPC stream messages sent by the client.",
- }), []string{"grpc_type", "grpc_service", "grpc_method"}),
-
- clientHandledHistogramEnabled: false,
- clientHandledHistogramOpts: prom.HistogramOpts{
- Name: "grpc_client_handling_seconds",
- Help: "Histogram of response latency (seconds) of the gRPC until it is finished by the application.",
- Buckets: prom.DefBuckets,
- },
- clientHandledHistogram: nil,
- }
-}
-
-// Describe sends the super-set of all possible descriptors of metrics
-// collected by this Collector to the provided channel and returns once
-// the last descriptor has been sent.
-func (m *ClientMetrics) Describe(ch chan<- *prom.Desc) {
- m.clientStartedCounter.Describe(ch)
- m.clientHandledCounter.Describe(ch)
- m.clientStreamMsgReceived.Describe(ch)
- m.clientStreamMsgSent.Describe(ch)
- if m.clientHandledHistogramEnabled {
- m.clientHandledHistogram.Describe(ch)
- }
-}
-
-// Collect is called by the Prometheus registry when collecting
-// metrics. The implementation sends each collected metric via the
-// provided channel and returns once the last metric has been sent.
-func (m *ClientMetrics) Collect(ch chan<- prom.Metric) {
- m.clientStartedCounter.Collect(ch)
- m.clientHandledCounter.Collect(ch)
- m.clientStreamMsgReceived.Collect(ch)
- m.clientStreamMsgSent.Collect(ch)
- if m.clientHandledHistogramEnabled {
- m.clientHandledHistogram.Collect(ch)
- }
-}
-
-// EnableClientHandlingTimeHistogram turns on recording of handling time of RPCs.
-// Histogram metrics can be very expensive for Prometheus to retain and query.
-func (m *ClientMetrics) EnableClientHandlingTimeHistogram(opts ...HistogramOption) {
- for _, o := range opts {
- o(&m.clientHandledHistogramOpts)
- }
- if !m.clientHandledHistogramEnabled {
- m.clientHandledHistogram = prom.NewHistogramVec(
- m.clientHandledHistogramOpts,
- []string{"grpc_type", "grpc_service", "grpc_method"},
- )
- }
- m.clientHandledHistogramEnabled = true
-}
-
-// UnaryClientInterceptor is a gRPC client-side interceptor that provides Prometheus monitoring for Unary RPCs.
-func (m *ClientMetrics) UnaryClientInterceptor() func(ctx context.Context, method string, req, reply interface{}, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
- return func(ctx context.Context, method string, req, reply interface{}, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
- monitor := newClientReporter(m, Unary, method)
- monitor.SentMessage()
- err := invoker(ctx, method, req, reply, cc, opts...)
- if err != nil {
- monitor.ReceivedMessage()
- }
- st, _ := status.FromError(err)
- monitor.Handled(st.Code())
- return err
- }
-}
-
-// StreamClientInterceptor is a gRPC client-side interceptor that provides Prometheus monitoring for Streaming RPCs.
-func (m *ClientMetrics) StreamClientInterceptor() func(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string, streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) {
- return func(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string, streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) {
- monitor := newClientReporter(m, clientStreamType(desc), method)
- clientStream, err := streamer(ctx, desc, cc, method, opts...)
- if err != nil {
- st, _ := status.FromError(err)
- monitor.Handled(st.Code())
- return nil, err
- }
- return &monitoredClientStream{clientStream, monitor}, nil
- }
-}
-
-func clientStreamType(desc *grpc.StreamDesc) grpcType {
- if desc.ClientStreams && !desc.ServerStreams {
- return ClientStream
- } else if !desc.ClientStreams && desc.ServerStreams {
- return ServerStream
- }
- return BidiStream
-}
-
-// monitoredClientStream wraps grpc.ClientStream allowing each Sent/Recv of message to increment counters.
-type monitoredClientStream struct {
- grpc.ClientStream
- monitor *clientReporter
-}
-
-func (s *monitoredClientStream) SendMsg(m interface{}) error {
- err := s.ClientStream.SendMsg(m)
- if err == nil {
- s.monitor.SentMessage()
- }
- return err
-}
-
-func (s *monitoredClientStream) RecvMsg(m interface{}) error {
- err := s.ClientStream.RecvMsg(m)
- if err == nil {
- s.monitor.ReceivedMessage()
- } else if err == io.EOF {
- s.monitor.Handled(codes.OK)
- } else {
- st, _ := status.FromError(err)
- s.monitor.Handled(st.Code())
- }
- return err
-}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_reporter.go b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_reporter.go
deleted file mode 100644
index cbf153229..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/client_reporter.go
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2016 Michal Witkowski. All Rights Reserved.
-// See LICENSE for licensing terms.
-
-package grpc_prometheus
-
-import (
- "time"
-
- "google.golang.org/grpc/codes"
-)
-
-type clientReporter struct {
- metrics *ClientMetrics
- rpcType grpcType
- serviceName string
- methodName string
- startTime time.Time
-}
-
-func newClientReporter(m *ClientMetrics, rpcType grpcType, fullMethod string) *clientReporter {
- r := &clientReporter{
- metrics: m,
- rpcType: rpcType,
- }
- if r.metrics.clientHandledHistogramEnabled {
- r.startTime = time.Now()
- }
- r.serviceName, r.methodName = splitMethodName(fullMethod)
- r.metrics.clientStartedCounter.WithLabelValues(string(r.rpcType), r.serviceName, r.methodName).Inc()
- return r
-}
-
-func (r *clientReporter) ReceivedMessage() {
- r.metrics.clientStreamMsgReceived.WithLabelValues(string(r.rpcType), r.serviceName, r.methodName).Inc()
-}
-
-func (r *clientReporter) SentMessage() {
- r.metrics.clientStreamMsgSent.WithLabelValues(string(r.rpcType), r.serviceName, r.methodName).Inc()
-}
-
-func (r *clientReporter) Handled(code codes.Code) {
- r.metrics.clientHandledCounter.WithLabelValues(string(r.rpcType), r.serviceName, r.methodName, code.String()).Inc()
- if r.metrics.clientHandledHistogramEnabled {
- r.metrics.clientHandledHistogram.WithLabelValues(string(r.rpcType), r.serviceName, r.methodName).Observe(time.Since(r.startTime).Seconds())
- }
-}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/makefile b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/makefile
deleted file mode 100644
index 74c084223..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/makefile
+++ /dev/null
@@ -1,16 +0,0 @@
-SHELL="/bin/bash"
-
-GOFILES_NOVENDOR = $(shell go list ./... | grep -v /vendor/)
-
-all: vet fmt test
-
-fmt:
- go fmt $(GOFILES_NOVENDOR)
-
-vet:
- go vet $(GOFILES_NOVENDOR)
-
-test: vet
- ./scripts/test_all.sh
-
-.PHONY: all vet test
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/metric_options.go b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/metric_options.go
deleted file mode 100644
index 9d51aec98..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/metric_options.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package grpc_prometheus
-
-import (
- prom "github.com/prometheus/client_golang/prometheus"
-)
-
-// A CounterOption lets you add options to Counter metrics using With* funcs.
-type CounterOption func(*prom.CounterOpts)
-
-type counterOptions []CounterOption
-
-func (co counterOptions) apply(o prom.CounterOpts) prom.CounterOpts {
- for _, f := range co {
- f(&o)
- }
- return o
-}
-
-// WithConstLabels allows you to add ConstLabels to Counter metrics.
-func WithConstLabels(labels prom.Labels) CounterOption {
- return func(o *prom.CounterOpts) {
- o.ConstLabels = labels
- }
-}
-
-// A HistogramOption lets you add options to Histogram metrics using With*
-// funcs.
-type HistogramOption func(*prom.HistogramOpts)
-
-// WithHistogramBuckets allows you to specify custom bucket ranges for histograms if EnableHandlingTimeHistogram is on.
-func WithHistogramBuckets(buckets []float64) HistogramOption {
- return func(o *prom.HistogramOpts) { o.Buckets = buckets }
-}
-
-// WithHistogramConstLabels allows you to add custom ConstLabels to
-// histograms metrics.
-func WithHistogramConstLabels(labels prom.Labels) HistogramOption {
- return func(o *prom.HistogramOpts) {
- o.ConstLabels = labels
- }
-}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server.go b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server.go
deleted file mode 100644
index 322f99046..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server.go
+++ /dev/null
@@ -1,48 +0,0 @@
-// Copyright 2016 Michal Witkowski. All Rights Reserved.
-// See LICENSE for licensing terms.
-
-// gRPC Prometheus monitoring interceptors for server-side gRPC.
-
-package grpc_prometheus
-
-import (
- prom "github.com/prometheus/client_golang/prometheus"
- "google.golang.org/grpc"
-)
-
-var (
- // DefaultServerMetrics is the default instance of ServerMetrics. It is
- // intended to be used in conjunction the default Prometheus metrics
- // registry.
- DefaultServerMetrics = NewServerMetrics()
-
- // UnaryServerInterceptor is a gRPC server-side interceptor that provides Prometheus monitoring for Unary RPCs.
- UnaryServerInterceptor = DefaultServerMetrics.UnaryServerInterceptor()
-
- // StreamServerInterceptor is a gRPC server-side interceptor that provides Prometheus monitoring for Streaming RPCs.
- StreamServerInterceptor = DefaultServerMetrics.StreamServerInterceptor()
-)
-
-func init() {
- prom.MustRegister(DefaultServerMetrics.serverStartedCounter)
- prom.MustRegister(DefaultServerMetrics.serverHandledCounter)
- prom.MustRegister(DefaultServerMetrics.serverStreamMsgReceived)
- prom.MustRegister(DefaultServerMetrics.serverStreamMsgSent)
-}
-
-// Register takes a gRPC server and pre-initializes all counters to 0. This
-// allows for easier monitoring in Prometheus (no missing metrics), and should
-// be called *after* all services have been registered with the server. This
-// function acts on the DefaultServerMetrics variable.
-func Register(server *grpc.Server) {
- DefaultServerMetrics.InitializeMetrics(server)
-}
-
-// EnableHandlingTimeHistogram turns on recording of handling time
-// of RPCs. Histogram metrics can be very expensive for Prometheus
-// to retain and query. This function acts on the DefaultServerMetrics
-// variable and the default Prometheus metrics registry.
-func EnableHandlingTimeHistogram(opts ...HistogramOption) {
- DefaultServerMetrics.EnableHandlingTimeHistogram(opts...)
- prom.Register(DefaultServerMetrics.serverHandledHistogram)
-}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_metrics.go b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_metrics.go
deleted file mode 100644
index 5b1467e7a..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_metrics.go
+++ /dev/null
@@ -1,185 +0,0 @@
-package grpc_prometheus
-
-import (
- prom "github.com/prometheus/client_golang/prometheus"
- "golang.org/x/net/context"
- "google.golang.org/grpc"
- "google.golang.org/grpc/status"
-)
-
-// ServerMetrics represents a collection of metrics to be registered on a
-// Prometheus metrics registry for a gRPC server.
-type ServerMetrics struct {
- serverStartedCounter *prom.CounterVec
- serverHandledCounter *prom.CounterVec
- serverStreamMsgReceived *prom.CounterVec
- serverStreamMsgSent *prom.CounterVec
- serverHandledHistogramEnabled bool
- serverHandledHistogramOpts prom.HistogramOpts
- serverHandledHistogram *prom.HistogramVec
-}
-
-// NewServerMetrics returns a ServerMetrics object. Use a new instance of
-// ServerMetrics when not using the default Prometheus metrics registry, for
-// example when wanting to control which metrics are added to a registry as
-// opposed to automatically adding metrics via init functions.
-func NewServerMetrics(counterOpts ...CounterOption) *ServerMetrics {
- opts := counterOptions(counterOpts)
- return &ServerMetrics{
- serverStartedCounter: prom.NewCounterVec(
- opts.apply(prom.CounterOpts{
- Name: "grpc_server_started_total",
- Help: "Total number of RPCs started on the server.",
- }), []string{"grpc_type", "grpc_service", "grpc_method"}),
- serverHandledCounter: prom.NewCounterVec(
- opts.apply(prom.CounterOpts{
- Name: "grpc_server_handled_total",
- Help: "Total number of RPCs completed on the server, regardless of success or failure.",
- }), []string{"grpc_type", "grpc_service", "grpc_method", "grpc_code"}),
- serverStreamMsgReceived: prom.NewCounterVec(
- opts.apply(prom.CounterOpts{
- Name: "grpc_server_msg_received_total",
- Help: "Total number of RPC stream messages received on the server.",
- }), []string{"grpc_type", "grpc_service", "grpc_method"}),
- serverStreamMsgSent: prom.NewCounterVec(
- opts.apply(prom.CounterOpts{
- Name: "grpc_server_msg_sent_total",
- Help: "Total number of gRPC stream messages sent by the server.",
- }), []string{"grpc_type", "grpc_service", "grpc_method"}),
- serverHandledHistogramEnabled: false,
- serverHandledHistogramOpts: prom.HistogramOpts{
- Name: "grpc_server_handling_seconds",
- Help: "Histogram of response latency (seconds) of gRPC that had been application-level handled by the server.",
- Buckets: prom.DefBuckets,
- },
- serverHandledHistogram: nil,
- }
-}
-
-// EnableHandlingTimeHistogram enables histograms being registered when
-// registering the ServerMetrics on a Prometheus registry. Histograms can be
-// expensive on Prometheus servers. It takes options to configure histogram
-// options such as the defined buckets.
-func (m *ServerMetrics) EnableHandlingTimeHistogram(opts ...HistogramOption) {
- for _, o := range opts {
- o(&m.serverHandledHistogramOpts)
- }
- if !m.serverHandledHistogramEnabled {
- m.serverHandledHistogram = prom.NewHistogramVec(
- m.serverHandledHistogramOpts,
- []string{"grpc_type", "grpc_service", "grpc_method"},
- )
- }
- m.serverHandledHistogramEnabled = true
-}
-
-// Describe sends the super-set of all possible descriptors of metrics
-// collected by this Collector to the provided channel and returns once
-// the last descriptor has been sent.
-func (m *ServerMetrics) Describe(ch chan<- *prom.Desc) {
- m.serverStartedCounter.Describe(ch)
- m.serverHandledCounter.Describe(ch)
- m.serverStreamMsgReceived.Describe(ch)
- m.serverStreamMsgSent.Describe(ch)
- if m.serverHandledHistogramEnabled {
- m.serverHandledHistogram.Describe(ch)
- }
-}
-
-// Collect is called by the Prometheus registry when collecting
-// metrics. The implementation sends each collected metric via the
-// provided channel and returns once the last metric has been sent.
-func (m *ServerMetrics) Collect(ch chan<- prom.Metric) {
- m.serverStartedCounter.Collect(ch)
- m.serverHandledCounter.Collect(ch)
- m.serverStreamMsgReceived.Collect(ch)
- m.serverStreamMsgSent.Collect(ch)
- if m.serverHandledHistogramEnabled {
- m.serverHandledHistogram.Collect(ch)
- }
-}
-
-// UnaryServerInterceptor is a gRPC server-side interceptor that provides Prometheus monitoring for Unary RPCs.
-func (m *ServerMetrics) UnaryServerInterceptor() func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
- return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
- monitor := newServerReporter(m, Unary, info.FullMethod)
- monitor.ReceivedMessage()
- resp, err := handler(ctx, req)
- st, _ := status.FromError(err)
- monitor.Handled(st.Code())
- if err == nil {
- monitor.SentMessage()
- }
- return resp, err
- }
-}
-
-// StreamServerInterceptor is a gRPC server-side interceptor that provides Prometheus monitoring for Streaming RPCs.
-func (m *ServerMetrics) StreamServerInterceptor() func(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
- return func(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
- monitor := newServerReporter(m, streamRPCType(info), info.FullMethod)
- err := handler(srv, &monitoredServerStream{ss, monitor})
- st, _ := status.FromError(err)
- monitor.Handled(st.Code())
- return err
- }
-}
-
-// InitializeMetrics initializes all metrics, with their appropriate null
-// value, for all gRPC methods registered on a gRPC server. This is useful, to
-// ensure that all metrics exist when collecting and querying.
-func (m *ServerMetrics) InitializeMetrics(server *grpc.Server) {
- serviceInfo := server.GetServiceInfo()
- for serviceName, info := range serviceInfo {
- for _, mInfo := range info.Methods {
- preRegisterMethod(m, serviceName, &mInfo)
- }
- }
-}
-
-func streamRPCType(info *grpc.StreamServerInfo) grpcType {
- if info.IsClientStream && !info.IsServerStream {
- return ClientStream
- } else if !info.IsClientStream && info.IsServerStream {
- return ServerStream
- }
- return BidiStream
-}
-
-// monitoredStream wraps grpc.ServerStream allowing each Sent/Recv of message to increment counters.
-type monitoredServerStream struct {
- grpc.ServerStream
- monitor *serverReporter
-}
-
-func (s *monitoredServerStream) SendMsg(m interface{}) error {
- err := s.ServerStream.SendMsg(m)
- if err == nil {
- s.monitor.SentMessage()
- }
- return err
-}
-
-func (s *monitoredServerStream) RecvMsg(m interface{}) error {
- err := s.ServerStream.RecvMsg(m)
- if err == nil {
- s.monitor.ReceivedMessage()
- }
- return err
-}
-
-// preRegisterMethod is invoked on Register of a Server, allowing all gRPC services labels to be pre-populated.
-func preRegisterMethod(metrics *ServerMetrics, serviceName string, mInfo *grpc.MethodInfo) {
- methodName := mInfo.Name
- methodType := string(typeFromMethodInfo(mInfo))
- // These are just references (no increments), as just referencing will create the labels but not set values.
- metrics.serverStartedCounter.GetMetricWithLabelValues(methodType, serviceName, methodName)
- metrics.serverStreamMsgReceived.GetMetricWithLabelValues(methodType, serviceName, methodName)
- metrics.serverStreamMsgSent.GetMetricWithLabelValues(methodType, serviceName, methodName)
- if metrics.serverHandledHistogramEnabled {
- metrics.serverHandledHistogram.GetMetricWithLabelValues(methodType, serviceName, methodName)
- }
- for _, code := range allCodes {
- metrics.serverHandledCounter.GetMetricWithLabelValues(methodType, serviceName, methodName, code.String())
- }
-}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_reporter.go b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_reporter.go
deleted file mode 100644
index aa9db5401..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/server_reporter.go
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2016 Michal Witkowski. All Rights Reserved.
-// See LICENSE for licensing terms.
-
-package grpc_prometheus
-
-import (
- "time"
-
- "google.golang.org/grpc/codes"
-)
-
-type serverReporter struct {
- metrics *ServerMetrics
- rpcType grpcType
- serviceName string
- methodName string
- startTime time.Time
-}
-
-func newServerReporter(m *ServerMetrics, rpcType grpcType, fullMethod string) *serverReporter {
- r := &serverReporter{
- metrics: m,
- rpcType: rpcType,
- }
- if r.metrics.serverHandledHistogramEnabled {
- r.startTime = time.Now()
- }
- r.serviceName, r.methodName = splitMethodName(fullMethod)
- r.metrics.serverStartedCounter.WithLabelValues(string(r.rpcType), r.serviceName, r.methodName).Inc()
- return r
-}
-
-func (r *serverReporter) ReceivedMessage() {
- r.metrics.serverStreamMsgReceived.WithLabelValues(string(r.rpcType), r.serviceName, r.methodName).Inc()
-}
-
-func (r *serverReporter) SentMessage() {
- r.metrics.serverStreamMsgSent.WithLabelValues(string(r.rpcType), r.serviceName, r.methodName).Inc()
-}
-
-func (r *serverReporter) Handled(code codes.Code) {
- r.metrics.serverHandledCounter.WithLabelValues(string(r.rpcType), r.serviceName, r.methodName, code.String()).Inc()
- if r.metrics.serverHandledHistogramEnabled {
- r.metrics.serverHandledHistogram.WithLabelValues(string(r.rpcType), r.serviceName, r.methodName).Observe(time.Since(r.startTime).Seconds())
- }
-}
diff --git a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/util.go b/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/util.go
deleted file mode 100644
index 7987de35f..000000000
--- a/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/util.go
+++ /dev/null
@@ -1,50 +0,0 @@
-// Copyright 2016 Michal Witkowski. All Rights Reserved.
-// See LICENSE for licensing terms.
-
-package grpc_prometheus
-
-import (
- "strings"
-
- "google.golang.org/grpc"
- "google.golang.org/grpc/codes"
-)
-
-type grpcType string
-
-const (
- Unary grpcType = "unary"
- ClientStream grpcType = "client_stream"
- ServerStream grpcType = "server_stream"
- BidiStream grpcType = "bidi_stream"
-)
-
-var (
- allCodes = []codes.Code{
- codes.OK, codes.Canceled, codes.Unknown, codes.InvalidArgument, codes.DeadlineExceeded, codes.NotFound,
- codes.AlreadyExists, codes.PermissionDenied, codes.Unauthenticated, codes.ResourceExhausted,
- codes.FailedPrecondition, codes.Aborted, codes.OutOfRange, codes.Unimplemented, codes.Internal,
- codes.Unavailable, codes.DataLoss,
- }
-)
-
-func splitMethodName(fullMethodName string) (string, string) {
- fullMethodName = strings.TrimPrefix(fullMethodName, "/") // remove leading slash
- if i := strings.Index(fullMethodName, "/"); i >= 0 {
- return fullMethodName[:i], fullMethodName[i+1:]
- }
- return "unknown", "unknown"
-}
-
-func typeFromMethodInfo(mInfo *grpc.MethodInfo) grpcType {
- if !mInfo.IsClientStream && !mInfo.IsServerStream {
- return Unary
- }
- if mInfo.IsClientStream && !mInfo.IsServerStream {
- return ClientStream
- }
- if !mInfo.IsClientStream && mInfo.IsServerStream {
- return ServerStream
- }
- return BidiStream
-}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.pb.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.pb.go
index 3a34e664e..5121dce38 100644
--- a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.pb.go
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.pb.go
@@ -3476,6 +3476,9 @@ type JSONSchema_FieldConfiguration struct {
// parameter. Use this to avoid having auto generated path parameter names
// for overlapping paths.
PathParamName string `protobuf:"bytes,47,opt,name=path_param_name,json=pathParamName,proto3" json:"path_param_name,omitempty"`
+ // Declares this field to be deprecated. Allows for the generated OpenAPI
+ // parameter to be marked as deprecated without affecting the proto field.
+ Deprecated bool `protobuf:"varint,49,opt,name=deprecated,proto3" json:"deprecated,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
@@ -3512,10 +3515,21 @@ func (x *JSONSchema_FieldConfiguration) GetPathParamName() string {
return ""
}
+func (x *JSONSchema_FieldConfiguration) GetDeprecated() bool {
+ if x != nil {
+ return x.Deprecated
+ }
+ return false
+}
+
func (x *JSONSchema_FieldConfiguration) SetPathParamName(v string) {
x.PathParamName = v
}
+func (x *JSONSchema_FieldConfiguration) SetDeprecated(v bool) {
+ x.Deprecated = v
+}
+
type JSONSchema_FieldConfiguration_builder struct {
_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
@@ -3524,6 +3538,9 @@ type JSONSchema_FieldConfiguration_builder struct {
// parameter. Use this to avoid having auto generated path parameter names
// for overlapping paths.
PathParamName string
+ // Declares this field to be deprecated. Allows for the generated OpenAPI
+ // parameter to be marked as deprecated without affecting the proto field.
+ Deprecated bool
}
func (b0 JSONSchema_FieldConfiguration_builder) Build() *JSONSchema_FieldConfiguration {
@@ -3531,6 +3548,7 @@ func (b0 JSONSchema_FieldConfiguration_builder) Build() *JSONSchema_FieldConfigu
b, x := &b0, m0
_, _ = b, x
x.PathParamName = b.PathParamName
+ x.Deprecated = b.Deprecated
return m0
}
@@ -3904,7 +3922,7 @@ var file_protoc_gen_openapiv2_options_openapiv2_proto_rawDesc = []byte{
0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2c, 0x0a, 0x05,
0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x67, 0x6f,
0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x56, 0x61,
- 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xd7,
+ 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf7,
0x0a, 0x0a, 0x0a, 0x4a, 0x53, 0x4f, 0x4e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x12, 0x10, 0x0a,
0x03, 0x72, 0x65, 0x66, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x65, 0x66, 0x12,
0x14, 0x0a, 0x05, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
@@ -3968,11 +3986,13 @@ var file_protoc_gen_openapiv2_options_openapiv2_proto_rawDesc = []byte{
0x67, 0x65, 0x6e, 0x5f, 0x6f, 0x70, 0x65, 0x6e, 0x61, 0x70, 0x69, 0x76, 0x32, 0x2e, 0x6f, 0x70,
0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4a, 0x53, 0x4f, 0x4e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61,
0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
- 0x52, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x3c, 0x0a, 0x12,
+ 0x52, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x5c, 0x0a, 0x12,
0x46, 0x69, 0x65, 0x6c, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69,
0x6f, 0x6e, 0x12, 0x26, 0x0a, 0x0f, 0x70, 0x61, 0x74, 0x68, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d,
0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x2f, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x70, 0x61, 0x74,
- 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x4e, 0x61, 0x6d, 0x65, 0x1a, 0x55, 0x0a, 0x0f, 0x45, 0x78,
+ 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x64, 0x65,
+ 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x31, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a,
+ 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x1a, 0x55, 0x0a, 0x0f, 0x45, 0x78,
0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
0x2c, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.proto b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.proto
index 5313f0818..444a5687a 100644
--- a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.proto
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2.proto
@@ -612,6 +612,9 @@ message JSONSchema {
// parameter. Use this to avoid having auto generated path parameter names
// for overlapping paths.
string path_param_name = 47;
+ // Declares this field to be deprecated. Allows for the generated OpenAPI
+ // parameter to be marked as deprecated without affecting the proto field.
+ bool deprecated = 49;
}
// Custom properties that start with "x-" such as "x-foo" used to describe
// extra functionality that is not covered by the standard OpenAPI Specification.
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2_protoopaque.pb.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2_protoopaque.pb.go
index 1f0e0c269..5316ed619 100644
--- a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2_protoopaque.pb.go
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/openapiv2_protoopaque.pb.go
@@ -3268,6 +3268,7 @@ func (b0 Scopes_builder) Build() *Scopes {
type JSONSchema_FieldConfiguration struct {
state protoimpl.MessageState `protogen:"opaque.v1"`
xxx_hidden_PathParamName string `protobuf:"bytes,47,opt,name=path_param_name,json=pathParamName,proto3" json:"path_param_name,omitempty"`
+ xxx_hidden_Deprecated bool `protobuf:"varint,49,opt,name=deprecated,proto3" json:"deprecated,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
@@ -3304,10 +3305,21 @@ func (x *JSONSchema_FieldConfiguration) GetPathParamName() string {
return ""
}
+func (x *JSONSchema_FieldConfiguration) GetDeprecated() bool {
+ if x != nil {
+ return x.xxx_hidden_Deprecated
+ }
+ return false
+}
+
func (x *JSONSchema_FieldConfiguration) SetPathParamName(v string) {
x.xxx_hidden_PathParamName = v
}
+func (x *JSONSchema_FieldConfiguration) SetDeprecated(v bool) {
+ x.xxx_hidden_Deprecated = v
+}
+
type JSONSchema_FieldConfiguration_builder struct {
_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
@@ -3316,6 +3328,9 @@ type JSONSchema_FieldConfiguration_builder struct {
// parameter. Use this to avoid having auto generated path parameter names
// for overlapping paths.
PathParamName string
+ // Declares this field to be deprecated. Allows for the generated OpenAPI
+ // parameter to be marked as deprecated without affecting the proto field.
+ Deprecated bool
}
func (b0 JSONSchema_FieldConfiguration_builder) Build() *JSONSchema_FieldConfiguration {
@@ -3323,6 +3338,7 @@ func (b0 JSONSchema_FieldConfiguration_builder) Build() *JSONSchema_FieldConfigu
b, x := &b0, m0
_, _ = b, x
x.xxx_hidden_PathParamName = b.PathParamName
+ x.xxx_hidden_Deprecated = b.Deprecated
return m0
}
@@ -3696,7 +3712,7 @@ var file_protoc_gen_openapiv2_options_openapiv2_proto_rawDesc = []byte{
0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2c, 0x0a, 0x05,
0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x67, 0x6f,
0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x56, 0x61,
- 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xd7,
+ 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf7,
0x0a, 0x0a, 0x0a, 0x4a, 0x53, 0x4f, 0x4e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x12, 0x10, 0x0a,
0x03, 0x72, 0x65, 0x66, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x65, 0x66, 0x12,
0x14, 0x0a, 0x05, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
@@ -3760,11 +3776,13 @@ var file_protoc_gen_openapiv2_options_openapiv2_proto_rawDesc = []byte{
0x67, 0x65, 0x6e, 0x5f, 0x6f, 0x70, 0x65, 0x6e, 0x61, 0x70, 0x69, 0x76, 0x32, 0x2e, 0x6f, 0x70,
0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4a, 0x53, 0x4f, 0x4e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61,
0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
- 0x52, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x3c, 0x0a, 0x12,
+ 0x52, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x5c, 0x0a, 0x12,
0x46, 0x69, 0x65, 0x6c, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69,
0x6f, 0x6e, 0x12, 0x26, 0x0a, 0x0f, 0x70, 0x61, 0x74, 0x68, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d,
0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x2f, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x70, 0x61, 0x74,
- 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x4e, 0x61, 0x6d, 0x65, 0x1a, 0x55, 0x0a, 0x0f, 0x45, 0x78,
+ 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x64, 0x65,
+ 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x31, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a,
+ 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x1a, 0x55, 0x0a, 0x0f, 0x45, 0x78,
0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
0x2c, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazel b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazel
index a65d88eb8..04b4bebf3 100644
--- a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazel
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazel
@@ -27,6 +27,7 @@ go_library(
"//internal/httprule",
"//utilities",
"@org_golang_google_genproto_googleapis_api//httpbody",
+ "@org_golang_google_grpc//:grpc",
"@org_golang_google_grpc//codes",
"@org_golang_google_grpc//grpclog",
"@org_golang_google_grpc//health/grpc_health_v1",
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.go
index 2f2b34243..00b2228a1 100644
--- a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.go
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.go
@@ -201,13 +201,13 @@ func annotateContext(ctx context.Context, mux *ServeMux, req *http.Request, rpcM
if timeout != 0 {
ctx, _ = context.WithTimeout(ctx, timeout)
}
- if len(pairs) == 0 {
- return ctx, nil, nil
- }
md := metadata.Pairs(pairs...)
for _, mda := range mux.metadataAnnotators {
md = metadata.Join(md, mda(ctx, req))
}
+ if len(md) == 0 {
+ return ctx, nil, nil
+ }
return ctx, md, nil
}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.go
index 8376d1e0e..3d0706300 100644
--- a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.go
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.go
@@ -66,7 +66,7 @@ func (j *JSONPb) marshalTo(w io.Writer, v interface{}) error {
var (
// protoMessageType is stored to prevent constant lookup of the same type at runtime.
- protoMessageType = reflect.TypeOf((*proto.Message)(nil)).Elem()
+ protoMessageType = reflect.TypeFor[proto.Message]()
)
// marshalNonProto marshals a non-message field of a protobuf message.
@@ -325,9 +325,9 @@ type protoEnum interface {
EnumDescriptor() ([]byte, []int)
}
-var typeProtoEnum = reflect.TypeOf((*protoEnum)(nil)).Elem()
+var typeProtoEnum = reflect.TypeFor[protoEnum]()
-var typeProtoMessage = reflect.TypeOf((*proto.Message)(nil)).Elem()
+var typeProtoMessage = reflect.TypeFor[proto.Message]()
// Delimiter for newline encoded JSON streams.
func (j *JSONPb) Delimiter() []byte {
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go
index 19255ec44..3eb161671 100644
--- a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go
@@ -10,6 +10,7 @@ import (
"strings"
"github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule"
+ "google.golang.org/grpc"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/grpclog"
"google.golang.org/grpc/health/grpc_health_v1"
@@ -281,12 +282,19 @@ func WithHealthEndpointAt(healthCheckClient grpc_health_v1.HealthClient, endpoin
http.MethodGet, endpointPath, func(w http.ResponseWriter, r *http.Request, _ map[string]string,
) {
_, outboundMarshaler := MarshalerForRequest(s, r)
+ annotatedContext, err := AnnotateContext(r.Context(), s, r, grpc_health_v1.Health_Check_FullMethodName, WithHTTPPathPattern(endpointPath))
+ if err != nil {
+ s.errorHandler(r.Context(), s, outboundMarshaler, w, r, err)
+ return
+ }
- resp, err := healthCheckClient.Check(r.Context(), &grpc_health_v1.HealthCheckRequest{
+ var md ServerMetadata
+ resp, err := healthCheckClient.Check(annotatedContext, &grpc_health_v1.HealthCheckRequest{
Service: r.URL.Query().Get("service"),
- })
+ }, grpc.Header(&md.HeaderMD), grpc.Trailer(&md.TrailerMD))
+ annotatedContext = NewServerMetadataContext(annotatedContext, md)
if err != nil {
- s.errorHandler(r.Context(), s, outboundMarshaler, w, r, err)
+ s.errorHandler(annotatedContext, s, outboundMarshaler, w, r, err)
return
}
@@ -300,7 +308,7 @@ func WithHealthEndpointAt(healthCheckClient grpc_health_v1.HealthClient, endpoin
err = status.Error(codes.NotFound, resp.String())
}
- s.errorHandler(r.Context(), s, outboundMarshaler, w, r, err)
+ s.errorHandler(annotatedContext, s, outboundMarshaler, w, r, err)
return
}
diff --git a/vendor/github.com/josharian/intern/README.md b/vendor/github.com/josharian/intern/README.md
deleted file mode 100644
index ffc44b219..000000000
--- a/vendor/github.com/josharian/intern/README.md
+++ /dev/null
@@ -1,5 +0,0 @@
-Docs: https://godoc.org/github.com/josharian/intern
-
-See also [Go issue 5160](https://golang.org/issue/5160).
-
-License: MIT
diff --git a/vendor/github.com/josharian/intern/intern.go b/vendor/github.com/josharian/intern/intern.go
deleted file mode 100644
index 7acb1fe90..000000000
--- a/vendor/github.com/josharian/intern/intern.go
+++ /dev/null
@@ -1,44 +0,0 @@
-// Package intern interns strings.
-// Interning is best effort only.
-// Interned strings may be removed automatically
-// at any time without notification.
-// All functions may be called concurrently
-// with themselves and each other.
-package intern
-
-import "sync"
-
-var (
- pool sync.Pool = sync.Pool{
- New: func() interface{} {
- return make(map[string]string)
- },
- }
-)
-
-// String returns s, interned.
-func String(s string) string {
- m := pool.Get().(map[string]string)
- c, ok := m[s]
- if ok {
- pool.Put(m)
- return c
- }
- m[s] = s
- pool.Put(m)
- return s
-}
-
-// Bytes returns b converted to a string, interned.
-func Bytes(b []byte) string {
- m := pool.Get().(map[string]string)
- c, ok := m[string(b)]
- if ok {
- pool.Put(m)
- return c
- }
- s := string(b)
- m[s] = s
- pool.Put(m)
- return s
-}
diff --git a/vendor/github.com/josharian/intern/license.md b/vendor/github.com/josharian/intern/license.md
deleted file mode 100644
index 353d3055f..000000000
--- a/vendor/github.com/josharian/intern/license.md
+++ /dev/null
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2019 Josh Bleecher Snyder
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
diff --git a/vendor/github.com/mailru/easyjson/LICENSE b/vendor/github.com/mailru/easyjson/LICENSE
deleted file mode 100644
index fbff658f7..000000000
--- a/vendor/github.com/mailru/easyjson/LICENSE
+++ /dev/null
@@ -1,7 +0,0 @@
-Copyright (c) 2016 Mail.Ru Group
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/vendor/github.com/mailru/easyjson/buffer/pool.go b/vendor/github.com/mailru/easyjson/buffer/pool.go
deleted file mode 100644
index 598a54af9..000000000
--- a/vendor/github.com/mailru/easyjson/buffer/pool.go
+++ /dev/null
@@ -1,278 +0,0 @@
-// Package buffer implements a buffer for serialization, consisting of a chain of []byte-s to
-// reduce copying and to allow reuse of individual chunks.
-package buffer
-
-import (
- "io"
- "net"
- "sync"
-)
-
-// PoolConfig contains configuration for the allocation and reuse strategy.
-type PoolConfig struct {
- StartSize int // Minimum chunk size that is allocated.
- PooledSize int // Minimum chunk size that is reused, reusing chunks too small will result in overhead.
- MaxSize int // Maximum chunk size that will be allocated.
-}
-
-var config = PoolConfig{
- StartSize: 128,
- PooledSize: 512,
- MaxSize: 32768,
-}
-
-// Reuse pool: chunk size -> pool.
-var buffers = map[int]*sync.Pool{}
-
-func initBuffers() {
- for l := config.PooledSize; l <= config.MaxSize; l *= 2 {
- buffers[l] = new(sync.Pool)
- }
-}
-
-func init() {
- initBuffers()
-}
-
-// Init sets up a non-default pooling and allocation strategy. Should be run before serialization is done.
-func Init(cfg PoolConfig) {
- config = cfg
- initBuffers()
-}
-
-// putBuf puts a chunk to reuse pool if it can be reused.
-func putBuf(buf []byte) {
- size := cap(buf)
- if size < config.PooledSize {
- return
- }
- if c := buffers[size]; c != nil {
- c.Put(buf[:0])
- }
-}
-
-// getBuf gets a chunk from reuse pool or creates a new one if reuse failed.
-func getBuf(size int) []byte {
- if size >= config.PooledSize {
- if c := buffers[size]; c != nil {
- v := c.Get()
- if v != nil {
- return v.([]byte)
- }
- }
- }
- return make([]byte, 0, size)
-}
-
-// Buffer is a buffer optimized for serialization without extra copying.
-type Buffer struct {
-
- // Buf is the current chunk that can be used for serialization.
- Buf []byte
-
- toPool []byte
- bufs [][]byte
-}
-
-// EnsureSpace makes sure that the current chunk contains at least s free bytes,
-// possibly creating a new chunk.
-func (b *Buffer) EnsureSpace(s int) {
- if cap(b.Buf)-len(b.Buf) < s {
- b.ensureSpaceSlow(s)
- }
-}
-
-func (b *Buffer) ensureSpaceSlow(s int) {
- l := len(b.Buf)
- if l > 0 {
- if cap(b.toPool) != cap(b.Buf) {
- // Chunk was reallocated, toPool can be pooled.
- putBuf(b.toPool)
- }
- if cap(b.bufs) == 0 {
- b.bufs = make([][]byte, 0, 8)
- }
- b.bufs = append(b.bufs, b.Buf)
- l = cap(b.toPool) * 2
- } else {
- l = config.StartSize
- }
-
- if l > config.MaxSize {
- l = config.MaxSize
- }
- b.Buf = getBuf(l)
- b.toPool = b.Buf
-}
-
-// AppendByte appends a single byte to buffer.
-func (b *Buffer) AppendByte(data byte) {
- b.EnsureSpace(1)
- b.Buf = append(b.Buf, data)
-}
-
-// AppendBytes appends a byte slice to buffer.
-func (b *Buffer) AppendBytes(data []byte) {
- if len(data) <= cap(b.Buf)-len(b.Buf) {
- b.Buf = append(b.Buf, data...) // fast path
- } else {
- b.appendBytesSlow(data)
- }
-}
-
-func (b *Buffer) appendBytesSlow(data []byte) {
- for len(data) > 0 {
- b.EnsureSpace(1)
-
- sz := cap(b.Buf) - len(b.Buf)
- if sz > len(data) {
- sz = len(data)
- }
-
- b.Buf = append(b.Buf, data[:sz]...)
- data = data[sz:]
- }
-}
-
-// AppendString appends a string to buffer.
-func (b *Buffer) AppendString(data string) {
- if len(data) <= cap(b.Buf)-len(b.Buf) {
- b.Buf = append(b.Buf, data...) // fast path
- } else {
- b.appendStringSlow(data)
- }
-}
-
-func (b *Buffer) appendStringSlow(data string) {
- for len(data) > 0 {
- b.EnsureSpace(1)
-
- sz := cap(b.Buf) - len(b.Buf)
- if sz > len(data) {
- sz = len(data)
- }
-
- b.Buf = append(b.Buf, data[:sz]...)
- data = data[sz:]
- }
-}
-
-// Size computes the size of a buffer by adding sizes of every chunk.
-func (b *Buffer) Size() int {
- size := len(b.Buf)
- for _, buf := range b.bufs {
- size += len(buf)
- }
- return size
-}
-
-// DumpTo outputs the contents of a buffer to a writer and resets the buffer.
-func (b *Buffer) DumpTo(w io.Writer) (written int, err error) {
- bufs := net.Buffers(b.bufs)
- if len(b.Buf) > 0 {
- bufs = append(bufs, b.Buf)
- }
- n, err := bufs.WriteTo(w)
-
- for _, buf := range b.bufs {
- putBuf(buf)
- }
- putBuf(b.toPool)
-
- b.bufs = nil
- b.Buf = nil
- b.toPool = nil
-
- return int(n), err
-}
-
-// BuildBytes creates a single byte slice with all the contents of the buffer. Data is
-// copied if it does not fit in a single chunk. You can optionally provide one byte
-// slice as argument that it will try to reuse.
-func (b *Buffer) BuildBytes(reuse ...[]byte) []byte {
- if len(b.bufs) == 0 {
- ret := b.Buf
- b.toPool = nil
- b.Buf = nil
- return ret
- }
-
- var ret []byte
- size := b.Size()
-
- // If we got a buffer as argument and it is big enough, reuse it.
- if len(reuse) == 1 && cap(reuse[0]) >= size {
- ret = reuse[0][:0]
- } else {
- ret = make([]byte, 0, size)
- }
- for _, buf := range b.bufs {
- ret = append(ret, buf...)
- putBuf(buf)
- }
-
- ret = append(ret, b.Buf...)
- putBuf(b.toPool)
-
- b.bufs = nil
- b.toPool = nil
- b.Buf = nil
-
- return ret
-}
-
-type readCloser struct {
- offset int
- bufs [][]byte
-}
-
-func (r *readCloser) Read(p []byte) (n int, err error) {
- for _, buf := range r.bufs {
- // Copy as much as we can.
- x := copy(p[n:], buf[r.offset:])
- n += x // Increment how much we filled.
-
- // Did we empty the whole buffer?
- if r.offset+x == len(buf) {
- // On to the next buffer.
- r.offset = 0
- r.bufs = r.bufs[1:]
-
- // We can release this buffer.
- putBuf(buf)
- } else {
- r.offset += x
- }
-
- if n == len(p) {
- break
- }
- }
- // No buffers left or nothing read?
- if len(r.bufs) == 0 {
- err = io.EOF
- }
- return
-}
-
-func (r *readCloser) Close() error {
- // Release all remaining buffers.
- for _, buf := range r.bufs {
- putBuf(buf)
- }
- // In case Close gets called multiple times.
- r.bufs = nil
-
- return nil
-}
-
-// ReadCloser creates an io.ReadCloser with all the contents of the buffer.
-func (b *Buffer) ReadCloser() io.ReadCloser {
- ret := &readCloser{0, append(b.bufs, b.Buf)}
-
- b.bufs = nil
- b.toPool = nil
- b.Buf = nil
-
- return ret
-}
diff --git a/vendor/github.com/mailru/easyjson/jlexer/bytestostr.go b/vendor/github.com/mailru/easyjson/jlexer/bytestostr.go
deleted file mode 100644
index ff7b27c5b..000000000
--- a/vendor/github.com/mailru/easyjson/jlexer/bytestostr.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// This file will only be included to the build if neither
-// easyjson_nounsafe nor appengine build tag is set. See README notes
-// for more details.
-
-//+build !easyjson_nounsafe
-//+build !appengine
-
-package jlexer
-
-import (
- "reflect"
- "unsafe"
-)
-
-// bytesToStr creates a string pointing at the slice to avoid copying.
-//
-// Warning: the string returned by the function should be used with care, as the whole input data
-// chunk may be either blocked from being freed by GC because of a single string or the buffer.Data
-// may be garbage-collected even when the string exists.
-func bytesToStr(data []byte) string {
- h := (*reflect.SliceHeader)(unsafe.Pointer(&data))
- shdr := reflect.StringHeader{Data: h.Data, Len: h.Len}
- return *(*string)(unsafe.Pointer(&shdr))
-}
diff --git a/vendor/github.com/mailru/easyjson/jlexer/bytestostr_nounsafe.go b/vendor/github.com/mailru/easyjson/jlexer/bytestostr_nounsafe.go
deleted file mode 100644
index 864d1be67..000000000
--- a/vendor/github.com/mailru/easyjson/jlexer/bytestostr_nounsafe.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// This file is included to the build if any of the buildtags below
-// are defined. Refer to README notes for more details.
-
-//+build easyjson_nounsafe appengine
-
-package jlexer
-
-// bytesToStr creates a string normally from []byte
-//
-// Note that this method is roughly 1.5x slower than using the 'unsafe' method.
-func bytesToStr(data []byte) string {
- return string(data)
-}
diff --git a/vendor/github.com/mailru/easyjson/jlexer/error.go b/vendor/github.com/mailru/easyjson/jlexer/error.go
deleted file mode 100644
index e90ec40d0..000000000
--- a/vendor/github.com/mailru/easyjson/jlexer/error.go
+++ /dev/null
@@ -1,15 +0,0 @@
-package jlexer
-
-import "fmt"
-
-// LexerError implements the error interface and represents all possible errors that can be
-// generated during parsing the JSON data.
-type LexerError struct {
- Reason string
- Offset int
- Data string
-}
-
-func (l *LexerError) Error() string {
- return fmt.Sprintf("parse error: %s near offset %d of '%s'", l.Reason, l.Offset, l.Data)
-}
diff --git a/vendor/github.com/mailru/easyjson/jlexer/lexer.go b/vendor/github.com/mailru/easyjson/jlexer/lexer.go
deleted file mode 100644
index b5f5e2613..000000000
--- a/vendor/github.com/mailru/easyjson/jlexer/lexer.go
+++ /dev/null
@@ -1,1244 +0,0 @@
-// Package jlexer contains a JSON lexer implementation.
-//
-// It is expected that it is mostly used with generated parser code, so the interface is tuned
-// for a parser that knows what kind of data is expected.
-package jlexer
-
-import (
- "bytes"
- "encoding/base64"
- "encoding/json"
- "errors"
- "fmt"
- "io"
- "strconv"
- "unicode"
- "unicode/utf16"
- "unicode/utf8"
-
- "github.com/josharian/intern"
-)
-
-// tokenKind determines type of a token.
-type tokenKind byte
-
-const (
- tokenUndef tokenKind = iota // No token.
- tokenDelim // Delimiter: one of '{', '}', '[' or ']'.
- tokenString // A string literal, e.g. "abc\u1234"
- tokenNumber // Number literal, e.g. 1.5e5
- tokenBool // Boolean literal: true or false.
- tokenNull // null keyword.
-)
-
-// token describes a single token: type, position in the input and value.
-type token struct {
- kind tokenKind // Type of a token.
-
- boolValue bool // Value if a boolean literal token.
- byteValueCloned bool // true if byteValue was allocated and does not refer to original json body
- byteValue []byte // Raw value of a token.
- delimValue byte
-}
-
-// Lexer is a JSON lexer: it iterates over JSON tokens in a byte slice.
-type Lexer struct {
- Data []byte // Input data given to the lexer.
-
- start int // Start of the current token.
- pos int // Current unscanned position in the input stream.
- token token // Last scanned token, if token.kind != tokenUndef.
-
- firstElement bool // Whether current element is the first in array or an object.
- wantSep byte // A comma or a colon character, which need to occur before a token.
-
- UseMultipleErrors bool // If we want to use multiple errors.
- fatalError error // Fatal error occurred during lexing. It is usually a syntax error.
- multipleErrors []*LexerError // Semantic errors occurred during lexing. Marshalling will be continued after finding this errors.
-}
-
-// FetchToken scans the input for the next token.
-func (r *Lexer) FetchToken() {
- r.token.kind = tokenUndef
- r.start = r.pos
-
- // Check if r.Data has r.pos element
- // If it doesn't, it mean corrupted input data
- if len(r.Data) < r.pos {
- r.errParse("Unexpected end of data")
- return
- }
- // Determine the type of a token by skipping whitespace and reading the
- // first character.
- for _, c := range r.Data[r.pos:] {
- switch c {
- case ':', ',':
- if r.wantSep == c {
- r.pos++
- r.start++
- r.wantSep = 0
- } else {
- r.errSyntax()
- }
-
- case ' ', '\t', '\r', '\n':
- r.pos++
- r.start++
-
- case '"':
- if r.wantSep != 0 {
- r.errSyntax()
- }
-
- r.token.kind = tokenString
- r.fetchString()
- return
-
- case '{', '[':
- if r.wantSep != 0 {
- r.errSyntax()
- }
- r.firstElement = true
- r.token.kind = tokenDelim
- r.token.delimValue = r.Data[r.pos]
- r.pos++
- return
-
- case '}', ']':
- if !r.firstElement && (r.wantSep != ',') {
- r.errSyntax()
- }
- r.wantSep = 0
- r.token.kind = tokenDelim
- r.token.delimValue = r.Data[r.pos]
- r.pos++
- return
-
- case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '-':
- if r.wantSep != 0 {
- r.errSyntax()
- }
- r.token.kind = tokenNumber
- r.fetchNumber()
- return
-
- case 'n':
- if r.wantSep != 0 {
- r.errSyntax()
- }
-
- r.token.kind = tokenNull
- r.fetchNull()
- return
-
- case 't':
- if r.wantSep != 0 {
- r.errSyntax()
- }
-
- r.token.kind = tokenBool
- r.token.boolValue = true
- r.fetchTrue()
- return
-
- case 'f':
- if r.wantSep != 0 {
- r.errSyntax()
- }
-
- r.token.kind = tokenBool
- r.token.boolValue = false
- r.fetchFalse()
- return
-
- default:
- r.errSyntax()
- return
- }
- }
- r.fatalError = io.EOF
- return
-}
-
-// isTokenEnd returns true if the char can follow a non-delimiter token
-func isTokenEnd(c byte) bool {
- return c == ' ' || c == '\t' || c == '\r' || c == '\n' || c == '[' || c == ']' || c == '{' || c == '}' || c == ',' || c == ':'
-}
-
-// fetchNull fetches and checks remaining bytes of null keyword.
-func (r *Lexer) fetchNull() {
- r.pos += 4
- if r.pos > len(r.Data) ||
- r.Data[r.pos-3] != 'u' ||
- r.Data[r.pos-2] != 'l' ||
- r.Data[r.pos-1] != 'l' ||
- (r.pos != len(r.Data) && !isTokenEnd(r.Data[r.pos])) {
-
- r.pos -= 4
- r.errSyntax()
- }
-}
-
-// fetchTrue fetches and checks remaining bytes of true keyword.
-func (r *Lexer) fetchTrue() {
- r.pos += 4
- if r.pos > len(r.Data) ||
- r.Data[r.pos-3] != 'r' ||
- r.Data[r.pos-2] != 'u' ||
- r.Data[r.pos-1] != 'e' ||
- (r.pos != len(r.Data) && !isTokenEnd(r.Data[r.pos])) {
-
- r.pos -= 4
- r.errSyntax()
- }
-}
-
-// fetchFalse fetches and checks remaining bytes of false keyword.
-func (r *Lexer) fetchFalse() {
- r.pos += 5
- if r.pos > len(r.Data) ||
- r.Data[r.pos-4] != 'a' ||
- r.Data[r.pos-3] != 'l' ||
- r.Data[r.pos-2] != 's' ||
- r.Data[r.pos-1] != 'e' ||
- (r.pos != len(r.Data) && !isTokenEnd(r.Data[r.pos])) {
-
- r.pos -= 5
- r.errSyntax()
- }
-}
-
-// fetchNumber scans a number literal token.
-func (r *Lexer) fetchNumber() {
- hasE := false
- afterE := false
- hasDot := false
-
- r.pos++
- for i, c := range r.Data[r.pos:] {
- switch {
- case c >= '0' && c <= '9':
- afterE = false
- case c == '.' && !hasDot:
- hasDot = true
- case (c == 'e' || c == 'E') && !hasE:
- hasE = true
- hasDot = true
- afterE = true
- case (c == '+' || c == '-') && afterE:
- afterE = false
- default:
- r.pos += i
- if !isTokenEnd(c) {
- r.errSyntax()
- } else {
- r.token.byteValue = r.Data[r.start:r.pos]
- }
- return
- }
- }
-
- r.pos = len(r.Data)
- r.token.byteValue = r.Data[r.start:]
-}
-
-// findStringLen tries to scan into the string literal for ending quote char to determine required size.
-// The size will be exact if no escapes are present and may be inexact if there are escaped chars.
-func findStringLen(data []byte) (isValid bool, length int) {
- for {
- idx := bytes.IndexByte(data, '"')
- if idx == -1 {
- return false, len(data)
- }
- if idx == 0 || (idx > 0 && data[idx-1] != '\\') {
- return true, length + idx
- }
-
- // count \\\\\\\ sequences. even number of slashes means quote is not really escaped
- cnt := 1
- for idx-cnt-1 >= 0 && data[idx-cnt-1] == '\\' {
- cnt++
- }
- if cnt%2 == 0 {
- return true, length + idx
- }
-
- length += idx + 1
- data = data[idx+1:]
- }
-}
-
-// unescapeStringToken performs unescaping of string token.
-// if no escaping is needed, original string is returned, otherwise - a new one allocated
-func (r *Lexer) unescapeStringToken() (err error) {
- data := r.token.byteValue
- var unescapedData []byte
-
- for {
- i := bytes.IndexByte(data, '\\')
- if i == -1 {
- break
- }
-
- escapedRune, escapedBytes, err := decodeEscape(data[i:])
- if err != nil {
- r.errParse(err.Error())
- return err
- }
-
- if unescapedData == nil {
- unescapedData = make([]byte, 0, len(r.token.byteValue))
- }
-
- var d [4]byte
- s := utf8.EncodeRune(d[:], escapedRune)
- unescapedData = append(unescapedData, data[:i]...)
- unescapedData = append(unescapedData, d[:s]...)
-
- data = data[i+escapedBytes:]
- }
-
- if unescapedData != nil {
- r.token.byteValue = append(unescapedData, data...)
- r.token.byteValueCloned = true
- }
- return
-}
-
-// getu4 decodes \uXXXX from the beginning of s, returning the hex value,
-// or it returns -1.
-func getu4(s []byte) rune {
- if len(s) < 6 || s[0] != '\\' || s[1] != 'u' {
- return -1
- }
- var val rune
- for i := 2; i < len(s) && i < 6; i++ {
- var v byte
- c := s[i]
- switch c {
- case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
- v = c - '0'
- case 'a', 'b', 'c', 'd', 'e', 'f':
- v = c - 'a' + 10
- case 'A', 'B', 'C', 'D', 'E', 'F':
- v = c - 'A' + 10
- default:
- return -1
- }
-
- val <<= 4
- val |= rune(v)
- }
- return val
-}
-
-// decodeEscape processes a single escape sequence and returns number of bytes processed.
-func decodeEscape(data []byte) (decoded rune, bytesProcessed int, err error) {
- if len(data) < 2 {
- return 0, 0, errors.New("incorrect escape symbol \\ at the end of token")
- }
-
- c := data[1]
- switch c {
- case '"', '/', '\\':
- return rune(c), 2, nil
- case 'b':
- return '\b', 2, nil
- case 'f':
- return '\f', 2, nil
- case 'n':
- return '\n', 2, nil
- case 'r':
- return '\r', 2, nil
- case 't':
- return '\t', 2, nil
- case 'u':
- rr := getu4(data)
- if rr < 0 {
- return 0, 0, errors.New("incorrectly escaped \\uXXXX sequence")
- }
-
- read := 6
- if utf16.IsSurrogate(rr) {
- rr1 := getu4(data[read:])
- if dec := utf16.DecodeRune(rr, rr1); dec != unicode.ReplacementChar {
- read += 6
- rr = dec
- } else {
- rr = unicode.ReplacementChar
- }
- }
- return rr, read, nil
- }
-
- return 0, 0, errors.New("incorrectly escaped bytes")
-}
-
-// fetchString scans a string literal token.
-func (r *Lexer) fetchString() {
- r.pos++
- data := r.Data[r.pos:]
-
- isValid, length := findStringLen(data)
- if !isValid {
- r.pos += length
- r.errParse("unterminated string literal")
- return
- }
- r.token.byteValue = data[:length]
- r.pos += length + 1 // skip closing '"' as well
-}
-
-// scanToken scans the next token if no token is currently available in the lexer.
-func (r *Lexer) scanToken() {
- if r.token.kind != tokenUndef || r.fatalError != nil {
- return
- }
-
- r.FetchToken()
-}
-
-// consume resets the current token to allow scanning the next one.
-func (r *Lexer) consume() {
- r.token.kind = tokenUndef
- r.token.byteValueCloned = false
- r.token.delimValue = 0
-}
-
-// Ok returns true if no error (including io.EOF) was encountered during scanning.
-func (r *Lexer) Ok() bool {
- return r.fatalError == nil
-}
-
-const maxErrorContextLen = 13
-
-func (r *Lexer) errParse(what string) {
- if r.fatalError == nil {
- var str string
- if len(r.Data)-r.pos <= maxErrorContextLen {
- str = string(r.Data)
- } else {
- str = string(r.Data[r.pos:r.pos+maxErrorContextLen-3]) + "..."
- }
- r.fatalError = &LexerError{
- Reason: what,
- Offset: r.pos,
- Data: str,
- }
- }
-}
-
-func (r *Lexer) errSyntax() {
- r.errParse("syntax error")
-}
-
-func (r *Lexer) errInvalidToken(expected string) {
- if r.fatalError != nil {
- return
- }
- if r.UseMultipleErrors {
- r.pos = r.start
- r.consume()
- r.SkipRecursive()
- switch expected {
- case "[":
- r.token.delimValue = ']'
- r.token.kind = tokenDelim
- case "{":
- r.token.delimValue = '}'
- r.token.kind = tokenDelim
- }
- r.addNonfatalError(&LexerError{
- Reason: fmt.Sprintf("expected %s", expected),
- Offset: r.start,
- Data: string(r.Data[r.start:r.pos]),
- })
- return
- }
-
- var str string
- if len(r.token.byteValue) <= maxErrorContextLen {
- str = string(r.token.byteValue)
- } else {
- str = string(r.token.byteValue[:maxErrorContextLen-3]) + "..."
- }
- r.fatalError = &LexerError{
- Reason: fmt.Sprintf("expected %s", expected),
- Offset: r.pos,
- Data: str,
- }
-}
-
-func (r *Lexer) GetPos() int {
- return r.pos
-}
-
-// Delim consumes a token and verifies that it is the given delimiter.
-func (r *Lexer) Delim(c byte) {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
-
- if !r.Ok() || r.token.delimValue != c {
- r.consume() // errInvalidToken can change token if UseMultipleErrors is enabled.
- r.errInvalidToken(string([]byte{c}))
- } else {
- r.consume()
- }
-}
-
-// IsDelim returns true if there was no scanning error and next token is the given delimiter.
-func (r *Lexer) IsDelim(c byte) bool {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
- return !r.Ok() || r.token.delimValue == c
-}
-
-// Null verifies that the next token is null and consumes it.
-func (r *Lexer) Null() {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
- if !r.Ok() || r.token.kind != tokenNull {
- r.errInvalidToken("null")
- }
- r.consume()
-}
-
-// IsNull returns true if the next token is a null keyword.
-func (r *Lexer) IsNull() bool {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
- return r.Ok() && r.token.kind == tokenNull
-}
-
-// Skip skips a single token.
-func (r *Lexer) Skip() {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
- r.consume()
-}
-
-// SkipRecursive skips next array or object completely, or just skips a single token if not
-// an array/object.
-//
-// Note: no syntax validation is performed on the skipped data.
-func (r *Lexer) SkipRecursive() {
- r.scanToken()
- var start, end byte
- startPos := r.start
-
- switch r.token.delimValue {
- case '{':
- start, end = '{', '}'
- case '[':
- start, end = '[', ']'
- default:
- r.consume()
- return
- }
-
- r.consume()
-
- level := 1
- inQuotes := false
- wasEscape := false
-
- for i, c := range r.Data[r.pos:] {
- switch {
- case c == start && !inQuotes:
- level++
- case c == end && !inQuotes:
- level--
- if level == 0 {
- r.pos += i + 1
- if !json.Valid(r.Data[startPos:r.pos]) {
- r.pos = len(r.Data)
- r.fatalError = &LexerError{
- Reason: "skipped array/object json value is invalid",
- Offset: r.pos,
- Data: string(r.Data[r.pos:]),
- }
- }
- return
- }
- case c == '\\' && inQuotes:
- wasEscape = !wasEscape
- continue
- case c == '"' && inQuotes:
- inQuotes = wasEscape
- case c == '"':
- inQuotes = true
- }
- wasEscape = false
- }
- r.pos = len(r.Data)
- r.fatalError = &LexerError{
- Reason: "EOF reached while skipping array/object or token",
- Offset: r.pos,
- Data: string(r.Data[r.pos:]),
- }
-}
-
-// Raw fetches the next item recursively as a data slice
-func (r *Lexer) Raw() []byte {
- r.SkipRecursive()
- if !r.Ok() {
- return nil
- }
- return r.Data[r.start:r.pos]
-}
-
-// IsStart returns whether the lexer is positioned at the start
-// of an input string.
-func (r *Lexer) IsStart() bool {
- return r.pos == 0
-}
-
-// Consumed reads all remaining bytes from the input, publishing an error if
-// there is anything but whitespace remaining.
-func (r *Lexer) Consumed() {
- if r.pos > len(r.Data) || !r.Ok() {
- return
- }
-
- for _, c := range r.Data[r.pos:] {
- if c != ' ' && c != '\t' && c != '\r' && c != '\n' {
- r.AddError(&LexerError{
- Reason: "invalid character '" + string(c) + "' after top-level value",
- Offset: r.pos,
- Data: string(r.Data[r.pos:]),
- })
- return
- }
-
- r.pos++
- r.start++
- }
-}
-
-func (r *Lexer) unsafeString(skipUnescape bool) (string, []byte) {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
- if !r.Ok() || r.token.kind != tokenString {
- r.errInvalidToken("string")
- return "", nil
- }
- if !skipUnescape {
- if err := r.unescapeStringToken(); err != nil {
- r.errInvalidToken("string")
- return "", nil
- }
- }
-
- bytes := r.token.byteValue
- ret := bytesToStr(r.token.byteValue)
- r.consume()
- return ret, bytes
-}
-
-// UnsafeString returns the string value if the token is a string literal.
-//
-// Warning: returned string may point to the input buffer, so the string should not outlive
-// the input buffer. Intended pattern of usage is as an argument to a switch statement.
-func (r *Lexer) UnsafeString() string {
- ret, _ := r.unsafeString(false)
- return ret
-}
-
-// UnsafeBytes returns the byte slice if the token is a string literal.
-func (r *Lexer) UnsafeBytes() []byte {
- _, ret := r.unsafeString(false)
- return ret
-}
-
-// UnsafeFieldName returns current member name string token
-func (r *Lexer) UnsafeFieldName(skipUnescape bool) string {
- ret, _ := r.unsafeString(skipUnescape)
- return ret
-}
-
-// String reads a string literal.
-func (r *Lexer) String() string {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
- if !r.Ok() || r.token.kind != tokenString {
- r.errInvalidToken("string")
- return ""
- }
- if err := r.unescapeStringToken(); err != nil {
- r.errInvalidToken("string")
- return ""
- }
- var ret string
- if r.token.byteValueCloned {
- ret = bytesToStr(r.token.byteValue)
- } else {
- ret = string(r.token.byteValue)
- }
- r.consume()
- return ret
-}
-
-// StringIntern reads a string literal, and performs string interning on it.
-func (r *Lexer) StringIntern() string {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
- if !r.Ok() || r.token.kind != tokenString {
- r.errInvalidToken("string")
- return ""
- }
- if err := r.unescapeStringToken(); err != nil {
- r.errInvalidToken("string")
- return ""
- }
- ret := intern.Bytes(r.token.byteValue)
- r.consume()
- return ret
-}
-
-// Bytes reads a string literal and base64 decodes it into a byte slice.
-func (r *Lexer) Bytes() []byte {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
- if !r.Ok() || r.token.kind != tokenString {
- r.errInvalidToken("string")
- return nil
- }
- if err := r.unescapeStringToken(); err != nil {
- r.errInvalidToken("string")
- return nil
- }
- ret := make([]byte, base64.StdEncoding.DecodedLen(len(r.token.byteValue)))
- n, err := base64.StdEncoding.Decode(ret, r.token.byteValue)
- if err != nil {
- r.fatalError = &LexerError{
- Reason: err.Error(),
- }
- return nil
- }
-
- r.consume()
- return ret[:n]
-}
-
-// Bool reads a true or false boolean keyword.
-func (r *Lexer) Bool() bool {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
- if !r.Ok() || r.token.kind != tokenBool {
- r.errInvalidToken("bool")
- return false
- }
- ret := r.token.boolValue
- r.consume()
- return ret
-}
-
-func (r *Lexer) number() string {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
- if !r.Ok() || r.token.kind != tokenNumber {
- r.errInvalidToken("number")
- return ""
- }
- ret := bytesToStr(r.token.byteValue)
- r.consume()
- return ret
-}
-
-func (r *Lexer) Uint8() uint8 {
- s := r.number()
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseUint(s, 10, 8)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: s,
- })
- }
- return uint8(n)
-}
-
-func (r *Lexer) Uint16() uint16 {
- s := r.number()
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseUint(s, 10, 16)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: s,
- })
- }
- return uint16(n)
-}
-
-func (r *Lexer) Uint32() uint32 {
- s := r.number()
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseUint(s, 10, 32)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: s,
- })
- }
- return uint32(n)
-}
-
-func (r *Lexer) Uint64() uint64 {
- s := r.number()
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseUint(s, 10, 64)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: s,
- })
- }
- return n
-}
-
-func (r *Lexer) Uint() uint {
- return uint(r.Uint64())
-}
-
-func (r *Lexer) Int8() int8 {
- s := r.number()
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseInt(s, 10, 8)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: s,
- })
- }
- return int8(n)
-}
-
-func (r *Lexer) Int16() int16 {
- s := r.number()
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseInt(s, 10, 16)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: s,
- })
- }
- return int16(n)
-}
-
-func (r *Lexer) Int32() int32 {
- s := r.number()
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseInt(s, 10, 32)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: s,
- })
- }
- return int32(n)
-}
-
-func (r *Lexer) Int64() int64 {
- s := r.number()
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseInt(s, 10, 64)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: s,
- })
- }
- return n
-}
-
-func (r *Lexer) Int() int {
- return int(r.Int64())
-}
-
-func (r *Lexer) Uint8Str() uint8 {
- s, b := r.unsafeString(false)
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseUint(s, 10, 8)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: string(b),
- })
- }
- return uint8(n)
-}
-
-func (r *Lexer) Uint16Str() uint16 {
- s, b := r.unsafeString(false)
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseUint(s, 10, 16)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: string(b),
- })
- }
- return uint16(n)
-}
-
-func (r *Lexer) Uint32Str() uint32 {
- s, b := r.unsafeString(false)
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseUint(s, 10, 32)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: string(b),
- })
- }
- return uint32(n)
-}
-
-func (r *Lexer) Uint64Str() uint64 {
- s, b := r.unsafeString(false)
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseUint(s, 10, 64)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: string(b),
- })
- }
- return n
-}
-
-func (r *Lexer) UintStr() uint {
- return uint(r.Uint64Str())
-}
-
-func (r *Lexer) UintptrStr() uintptr {
- return uintptr(r.Uint64Str())
-}
-
-func (r *Lexer) Int8Str() int8 {
- s, b := r.unsafeString(false)
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseInt(s, 10, 8)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: string(b),
- })
- }
- return int8(n)
-}
-
-func (r *Lexer) Int16Str() int16 {
- s, b := r.unsafeString(false)
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseInt(s, 10, 16)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: string(b),
- })
- }
- return int16(n)
-}
-
-func (r *Lexer) Int32Str() int32 {
- s, b := r.unsafeString(false)
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseInt(s, 10, 32)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: string(b),
- })
- }
- return int32(n)
-}
-
-func (r *Lexer) Int64Str() int64 {
- s, b := r.unsafeString(false)
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseInt(s, 10, 64)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: string(b),
- })
- }
- return n
-}
-
-func (r *Lexer) IntStr() int {
- return int(r.Int64Str())
-}
-
-func (r *Lexer) Float32() float32 {
- s := r.number()
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseFloat(s, 32)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: s,
- })
- }
- return float32(n)
-}
-
-func (r *Lexer) Float32Str() float32 {
- s, b := r.unsafeString(false)
- if !r.Ok() {
- return 0
- }
- n, err := strconv.ParseFloat(s, 32)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: string(b),
- })
- }
- return float32(n)
-}
-
-func (r *Lexer) Float64() float64 {
- s := r.number()
- if !r.Ok() {
- return 0
- }
-
- n, err := strconv.ParseFloat(s, 64)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: s,
- })
- }
- return n
-}
-
-func (r *Lexer) Float64Str() float64 {
- s, b := r.unsafeString(false)
- if !r.Ok() {
- return 0
- }
- n, err := strconv.ParseFloat(s, 64)
- if err != nil {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Reason: err.Error(),
- Data: string(b),
- })
- }
- return n
-}
-
-func (r *Lexer) Error() error {
- return r.fatalError
-}
-
-func (r *Lexer) AddError(e error) {
- if r.fatalError == nil {
- r.fatalError = e
- }
-}
-
-func (r *Lexer) AddNonFatalError(e error) {
- r.addNonfatalError(&LexerError{
- Offset: r.start,
- Data: string(r.Data[r.start:r.pos]),
- Reason: e.Error(),
- })
-}
-
-func (r *Lexer) addNonfatalError(err *LexerError) {
- if r.UseMultipleErrors {
- // We don't want to add errors with the same offset.
- if len(r.multipleErrors) != 0 && r.multipleErrors[len(r.multipleErrors)-1].Offset == err.Offset {
- return
- }
- r.multipleErrors = append(r.multipleErrors, err)
- return
- }
- r.fatalError = err
-}
-
-func (r *Lexer) GetNonFatalErrors() []*LexerError {
- return r.multipleErrors
-}
-
-// JsonNumber fetches and json.Number from 'encoding/json' package.
-// Both int, float or string, contains them are valid values
-func (r *Lexer) JsonNumber() json.Number {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
- if !r.Ok() {
- r.errInvalidToken("json.Number")
- return json.Number("")
- }
-
- switch r.token.kind {
- case tokenString:
- return json.Number(r.String())
- case tokenNumber:
- return json.Number(r.Raw())
- case tokenNull:
- r.Null()
- return json.Number("")
- default:
- r.errSyntax()
- return json.Number("")
- }
-}
-
-// Interface fetches an interface{} analogous to the 'encoding/json' package.
-func (r *Lexer) Interface() interface{} {
- if r.token.kind == tokenUndef && r.Ok() {
- r.FetchToken()
- }
-
- if !r.Ok() {
- return nil
- }
- switch r.token.kind {
- case tokenString:
- return r.String()
- case tokenNumber:
- return r.Float64()
- case tokenBool:
- return r.Bool()
- case tokenNull:
- r.Null()
- return nil
- }
-
- if r.token.delimValue == '{' {
- r.consume()
-
- ret := map[string]interface{}{}
- for !r.IsDelim('}') {
- key := r.String()
- r.WantColon()
- ret[key] = r.Interface()
- r.WantComma()
- }
- r.Delim('}')
-
- if r.Ok() {
- return ret
- } else {
- return nil
- }
- } else if r.token.delimValue == '[' {
- r.consume()
-
- ret := []interface{}{}
- for !r.IsDelim(']') {
- ret = append(ret, r.Interface())
- r.WantComma()
- }
- r.Delim(']')
-
- if r.Ok() {
- return ret
- } else {
- return nil
- }
- }
- r.errSyntax()
- return nil
-}
-
-// WantComma requires a comma to be present before fetching next token.
-func (r *Lexer) WantComma() {
- r.wantSep = ','
- r.firstElement = false
-}
-
-// WantColon requires a colon to be present before fetching next token.
-func (r *Lexer) WantColon() {
- r.wantSep = ':'
- r.firstElement = false
-}
diff --git a/vendor/github.com/mailru/easyjson/jwriter/writer.go b/vendor/github.com/mailru/easyjson/jwriter/writer.go
deleted file mode 100644
index 2c5b20105..000000000
--- a/vendor/github.com/mailru/easyjson/jwriter/writer.go
+++ /dev/null
@@ -1,405 +0,0 @@
-// Package jwriter contains a JSON writer.
-package jwriter
-
-import (
- "io"
- "strconv"
- "unicode/utf8"
-
- "github.com/mailru/easyjson/buffer"
-)
-
-// Flags describe various encoding options. The behavior may be actually implemented in the encoder, but
-// Flags field in Writer is used to set and pass them around.
-type Flags int
-
-const (
- NilMapAsEmpty Flags = 1 << iota // Encode nil map as '{}' rather than 'null'.
- NilSliceAsEmpty // Encode nil slice as '[]' rather than 'null'.
-)
-
-// Writer is a JSON writer.
-type Writer struct {
- Flags Flags
-
- Error error
- Buffer buffer.Buffer
- NoEscapeHTML bool
-}
-
-// Size returns the size of the data that was written out.
-func (w *Writer) Size() int {
- return w.Buffer.Size()
-}
-
-// DumpTo outputs the data to given io.Writer, resetting the buffer.
-func (w *Writer) DumpTo(out io.Writer) (written int, err error) {
- return w.Buffer.DumpTo(out)
-}
-
-// BuildBytes returns writer data as a single byte slice. You can optionally provide one byte slice
-// as argument that it will try to reuse.
-func (w *Writer) BuildBytes(reuse ...[]byte) ([]byte, error) {
- if w.Error != nil {
- return nil, w.Error
- }
-
- return w.Buffer.BuildBytes(reuse...), nil
-}
-
-// ReadCloser returns an io.ReadCloser that can be used to read the data.
-// ReadCloser also resets the buffer.
-func (w *Writer) ReadCloser() (io.ReadCloser, error) {
- if w.Error != nil {
- return nil, w.Error
- }
-
- return w.Buffer.ReadCloser(), nil
-}
-
-// RawByte appends raw binary data to the buffer.
-func (w *Writer) RawByte(c byte) {
- w.Buffer.AppendByte(c)
-}
-
-// RawByte appends raw binary data to the buffer.
-func (w *Writer) RawString(s string) {
- w.Buffer.AppendString(s)
-}
-
-// Raw appends raw binary data to the buffer or sets the error if it is given. Useful for
-// calling with results of MarshalJSON-like functions.
-func (w *Writer) Raw(data []byte, err error) {
- switch {
- case w.Error != nil:
- return
- case err != nil:
- w.Error = err
- case len(data) > 0:
- w.Buffer.AppendBytes(data)
- default:
- w.RawString("null")
- }
-}
-
-// RawText encloses raw binary data in quotes and appends in to the buffer.
-// Useful for calling with results of MarshalText-like functions.
-func (w *Writer) RawText(data []byte, err error) {
- switch {
- case w.Error != nil:
- return
- case err != nil:
- w.Error = err
- case len(data) > 0:
- w.String(string(data))
- default:
- w.RawString("null")
- }
-}
-
-// Base64Bytes appends data to the buffer after base64 encoding it
-func (w *Writer) Base64Bytes(data []byte) {
- if data == nil {
- w.Buffer.AppendString("null")
- return
- }
- w.Buffer.AppendByte('"')
- w.base64(data)
- w.Buffer.AppendByte('"')
-}
-
-func (w *Writer) Uint8(n uint8) {
- w.Buffer.EnsureSpace(3)
- w.Buffer.Buf = strconv.AppendUint(w.Buffer.Buf, uint64(n), 10)
-}
-
-func (w *Writer) Uint16(n uint16) {
- w.Buffer.EnsureSpace(5)
- w.Buffer.Buf = strconv.AppendUint(w.Buffer.Buf, uint64(n), 10)
-}
-
-func (w *Writer) Uint32(n uint32) {
- w.Buffer.EnsureSpace(10)
- w.Buffer.Buf = strconv.AppendUint(w.Buffer.Buf, uint64(n), 10)
-}
-
-func (w *Writer) Uint(n uint) {
- w.Buffer.EnsureSpace(20)
- w.Buffer.Buf = strconv.AppendUint(w.Buffer.Buf, uint64(n), 10)
-}
-
-func (w *Writer) Uint64(n uint64) {
- w.Buffer.EnsureSpace(20)
- w.Buffer.Buf = strconv.AppendUint(w.Buffer.Buf, n, 10)
-}
-
-func (w *Writer) Int8(n int8) {
- w.Buffer.EnsureSpace(4)
- w.Buffer.Buf = strconv.AppendInt(w.Buffer.Buf, int64(n), 10)
-}
-
-func (w *Writer) Int16(n int16) {
- w.Buffer.EnsureSpace(6)
- w.Buffer.Buf = strconv.AppendInt(w.Buffer.Buf, int64(n), 10)
-}
-
-func (w *Writer) Int32(n int32) {
- w.Buffer.EnsureSpace(11)
- w.Buffer.Buf = strconv.AppendInt(w.Buffer.Buf, int64(n), 10)
-}
-
-func (w *Writer) Int(n int) {
- w.Buffer.EnsureSpace(21)
- w.Buffer.Buf = strconv.AppendInt(w.Buffer.Buf, int64(n), 10)
-}
-
-func (w *Writer) Int64(n int64) {
- w.Buffer.EnsureSpace(21)
- w.Buffer.Buf = strconv.AppendInt(w.Buffer.Buf, n, 10)
-}
-
-func (w *Writer) Uint8Str(n uint8) {
- w.Buffer.EnsureSpace(3)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendUint(w.Buffer.Buf, uint64(n), 10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) Uint16Str(n uint16) {
- w.Buffer.EnsureSpace(5)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendUint(w.Buffer.Buf, uint64(n), 10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) Uint32Str(n uint32) {
- w.Buffer.EnsureSpace(10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendUint(w.Buffer.Buf, uint64(n), 10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) UintStr(n uint) {
- w.Buffer.EnsureSpace(20)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendUint(w.Buffer.Buf, uint64(n), 10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) Uint64Str(n uint64) {
- w.Buffer.EnsureSpace(20)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendUint(w.Buffer.Buf, n, 10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) UintptrStr(n uintptr) {
- w.Buffer.EnsureSpace(20)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendUint(w.Buffer.Buf, uint64(n), 10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) Int8Str(n int8) {
- w.Buffer.EnsureSpace(4)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendInt(w.Buffer.Buf, int64(n), 10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) Int16Str(n int16) {
- w.Buffer.EnsureSpace(6)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendInt(w.Buffer.Buf, int64(n), 10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) Int32Str(n int32) {
- w.Buffer.EnsureSpace(11)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendInt(w.Buffer.Buf, int64(n), 10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) IntStr(n int) {
- w.Buffer.EnsureSpace(21)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendInt(w.Buffer.Buf, int64(n), 10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) Int64Str(n int64) {
- w.Buffer.EnsureSpace(21)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendInt(w.Buffer.Buf, n, 10)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) Float32(n float32) {
- w.Buffer.EnsureSpace(20)
- w.Buffer.Buf = strconv.AppendFloat(w.Buffer.Buf, float64(n), 'g', -1, 32)
-}
-
-func (w *Writer) Float32Str(n float32) {
- w.Buffer.EnsureSpace(20)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendFloat(w.Buffer.Buf, float64(n), 'g', -1, 32)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) Float64(n float64) {
- w.Buffer.EnsureSpace(20)
- w.Buffer.Buf = strconv.AppendFloat(w.Buffer.Buf, n, 'g', -1, 64)
-}
-
-func (w *Writer) Float64Str(n float64) {
- w.Buffer.EnsureSpace(20)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
- w.Buffer.Buf = strconv.AppendFloat(w.Buffer.Buf, float64(n), 'g', -1, 64)
- w.Buffer.Buf = append(w.Buffer.Buf, '"')
-}
-
-func (w *Writer) Bool(v bool) {
- w.Buffer.EnsureSpace(5)
- if v {
- w.Buffer.Buf = append(w.Buffer.Buf, "true"...)
- } else {
- w.Buffer.Buf = append(w.Buffer.Buf, "false"...)
- }
-}
-
-const chars = "0123456789abcdef"
-
-func getTable(falseValues ...int) [128]bool {
- table := [128]bool{}
-
- for i := 0; i < 128; i++ {
- table[i] = true
- }
-
- for _, v := range falseValues {
- table[v] = false
- }
-
- return table
-}
-
-var (
- htmlEscapeTable = getTable(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, '"', '&', '<', '>', '\\')
- htmlNoEscapeTable = getTable(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, '"', '\\')
-)
-
-func (w *Writer) String(s string) {
- w.Buffer.AppendByte('"')
-
- // Portions of the string that contain no escapes are appended as
- // byte slices.
-
- p := 0 // last non-escape symbol
-
- escapeTable := &htmlEscapeTable
- if w.NoEscapeHTML {
- escapeTable = &htmlNoEscapeTable
- }
-
- for i := 0; i < len(s); {
- c := s[i]
-
- if c < utf8.RuneSelf {
- if escapeTable[c] {
- // single-width character, no escaping is required
- i++
- continue
- }
-
- w.Buffer.AppendString(s[p:i])
- switch c {
- case '\t':
- w.Buffer.AppendString(`\t`)
- case '\r':
- w.Buffer.AppendString(`\r`)
- case '\n':
- w.Buffer.AppendString(`\n`)
- case '\\':
- w.Buffer.AppendString(`\\`)
- case '"':
- w.Buffer.AppendString(`\"`)
- default:
- w.Buffer.AppendString(`\u00`)
- w.Buffer.AppendByte(chars[c>>4])
- w.Buffer.AppendByte(chars[c&0xf])
- }
-
- i++
- p = i
- continue
- }
-
- // broken utf
- runeValue, runeWidth := utf8.DecodeRuneInString(s[i:])
- if runeValue == utf8.RuneError && runeWidth == 1 {
- w.Buffer.AppendString(s[p:i])
- w.Buffer.AppendString(`\ufffd`)
- i++
- p = i
- continue
- }
-
- // jsonp stuff - tab separator and line separator
- if runeValue == '\u2028' || runeValue == '\u2029' {
- w.Buffer.AppendString(s[p:i])
- w.Buffer.AppendString(`\u202`)
- w.Buffer.AppendByte(chars[runeValue&0xf])
- i += runeWidth
- p = i
- continue
- }
- i += runeWidth
- }
- w.Buffer.AppendString(s[p:])
- w.Buffer.AppendByte('"')
-}
-
-const encode = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
-const padChar = '='
-
-func (w *Writer) base64(in []byte) {
-
- if len(in) == 0 {
- return
- }
-
- w.Buffer.EnsureSpace(((len(in)-1)/3 + 1) * 4)
-
- si := 0
- n := (len(in) / 3) * 3
-
- for si < n {
- // Convert 3x 8bit source bytes into 4 bytes
- val := uint(in[si+0])<<16 | uint(in[si+1])<<8 | uint(in[si+2])
-
- w.Buffer.Buf = append(w.Buffer.Buf, encode[val>>18&0x3F], encode[val>>12&0x3F], encode[val>>6&0x3F], encode[val&0x3F])
-
- si += 3
- }
-
- remain := len(in) - si
- if remain == 0 {
- return
- }
-
- // Add the remaining small block
- val := uint(in[si+0]) << 16
- if remain == 2 {
- val |= uint(in[si+1]) << 8
- }
-
- w.Buffer.Buf = append(w.Buffer.Buf, encode[val>>18&0x3F], encode[val>>12&0x3F])
-
- switch remain {
- case 2:
- w.Buffer.Buf = append(w.Buffer.Buf, encode[val>>6&0x3F], byte(padChar))
- case 1:
- w.Buffer.Buf = append(w.Buffer.Buf, byte(padChar), byte(padChar))
- }
-}
diff --git a/vendor/github.com/onsi/ginkgo/v2/.gitignore b/vendor/github.com/onsi/ginkgo/v2/.gitignore
index 18793c248..6faaaf315 100644
--- a/vendor/github.com/onsi/ginkgo/v2/.gitignore
+++ b/vendor/github.com/onsi/ginkgo/v2/.gitignore
@@ -4,4 +4,5 @@ tmp/**/*
*.coverprofile
.vscode
.idea/
-*.log
\ No newline at end of file
+*.log
+*.test
\ No newline at end of file
diff --git a/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md b/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
index 3011efb57..70050f35d 100644
--- a/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
+++ b/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
@@ -1,3 +1,245 @@
+## 2.28.1
+
+Update all dependencies. This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.
+
+## 2.28.0
+
+Ginkgo's SemVer filter now supports filtering multiple components by SemVer version:
+
+```go
+It("should work in a specific version range (1.0.0, 2.0.0) and third-party dependency redis in [8.0.0, ~)", SemVerConstraint(">= 3.2.0"), ComponentSemVerConstraint("redis", ">= 8.0.0") func() {
+ // This test will only run when version is between 1.0.0 (exclusive) and 2.0.0 (exclusive) and redis version is >= 8.0.0
+})
+```
+
+can be filtered in or out with an invocation like:
+
+```bash
+ginkgo --sem-ver-filter="2.1.1, redis=8.2.0"
+```
+
+Huge thanks to @Icarus9913 for working on this!
+
+## 2.27.5
+
+### Fixes
+Don't make a new formatter for each GinkgoT(); that's just silly and uses precious memory
+
+## 2.27.4
+
+### Fixes
+- CurrentTreeConstructionNodeReport: fix for nested container nodes [59bc751]
+
+## 2.27.3
+
+### Fixes
+report exit result in case of failure [1c9f356]
+fix data race [ece19c8]
+
+## 2.27.2
+
+### Fixes
+- inline automaxprocs to simplify dependencies; this will be removed when Go 1.26 comes out [a69113a]
+
+### Maintenance
+- Fix syntax errors and typo [a99c6e0]
+- Fix paragraph position error [f993df5]
+
+## 2.27.1
+
+### Fixes
+- Fix Ginkgo Reporter slice-bounds panic [606c1cb]
+- Bug Fix: Add GinkoTBWrapper.Attr() and GinkoTBWrapper.Output() [a6463b3]
+
+## 2.27.0
+
+### Features
+
+#### Transforming Nodes during Tree Construction
+
+This release adds support for `NodeArgsTransformer`s that can be registered with `AddTreeConstructionNodeArgsTransformer`.
+
+These are called during the tree construction phase as nodes are constructed and can modify the node strings and decorators. This enables frameworks built on top of Ginkgo to modify Ginkgo nodes and enforce conventions.
+
+Learn more [here](https://onsi.github.io/ginkgo/#advanced-transforming-node-arguments-during-tree-construction).
+
+#### Spec Prioritization
+
+A new `SpecPriority(int)` decorator has been added. Ginkgo will honor priority when ordering specs, ensuring that higher priority specs start running before lower priority specs
+
+Learn more [here](https://onsi.github.io/ginkgo/#prioritizing-specs).
+
+### Maintenance
+- Bump rexml from 3.4.0 to 3.4.2 in /docs (#1595) [1333dae]
+- Bump github.com/gkampitakis/go-snaps from 0.5.14 to 0.5.15 (#1600) [17ae63e]
+
+## 2.26.0
+
+### Features
+
+Ginkgo can now generate json-formatted reports that are compatible with the `go test` json format. Use `ginkgo --gojson-report=report.go.json`. This is not intended to be a replacement for Ginkgo's native json format which is more information rich and better models Ginkgo's test structure semantics.
+
+## 2.25.3
+
+### Fixes
+
+- emit --github-output group only for progress report itself [f01aed1]
+
+## 2.25.2
+
+### Fixes
+Add github output group for progress report content
+
+### Maintenance
+Bump Gomega
+
+## 2.25.1
+
+### Fixes
+- fix(types): ignore nameless nodes on FullText() [10866d3]
+- chore: fix some CodeQL warnings [2e42cff]
+
+## 2.25.0
+
+### `AroundNode`
+
+This release introduces a new decorator to support more complex spec setup usecases.
+
+`AroundNode` registers a function that runs before each individual node. This is considered a more advanced decorator.
+
+Please read the [docs](https://onsi.github.io/ginkgo/#advanced-around-node) for more information and some examples.
+
+Allowed signatures:
+
+- `AroundNode(func())` - `func` will be called before the node is run.
+- `AroundNode(func(ctx context.Context) context.Context)` - `func` can wrap the passed in context and return a new one which will be passed on to the node.
+- `AroundNode(func(ctx context.Context, body func(ctx context.Context)))` - `ctx` is the context for the node and `body` is a function that must be called to run the node. This gives you complete control over what runs before and after the node.
+
+Multiple `AroundNode` decorators can be applied to a single node and they will run in the order they are applied.
+
+Unlike setup nodes like `BeforeEach` and `DeferCleanup`, `AroundNode` is guaranteed to run in the same goroutine as the decorated node. This is necessary when working with lower-level libraries that must run on a single thread (you can call `runtime.LockOSThread()` in the `AroundNode` to ensure that the node runs on a single thread).
+
+Since `AroundNode` allows you to modify the context you can also use `AroundNode` to implement shared setup that attaches values to the context.
+
+If applied to a container, `AroundNode` will run before every node in the container. Including setup nodes like `BeforeEach` and `DeferCleanup`.
+
+`AroundNode` can also be applied to `RunSpecs` to run before every node in the suite. This opens up new mechanisms for instrumenting individual nodes across an entire suite.
+
+## 2.24.0
+
+### Features
+
+Specs can now be decorated with (e.g.) `SemVerConstraint("2.1.0")` and `ginkgo --sem-ver-filter="2.1.1"` will only run constrained specs that match the requested version. Learn more in the docs [here](https://onsi.github.io/ginkgo/#spec-semantic-version-filtering)! Thanks to @Icarus9913 for the PR.
+
+### Fixes
+
+- remove -o from run command [3f5d379]. fixes [#1582](https://github.com/onsi/ginkgo/issues/1582)
+
+### Maintenance
+
+Numerous dependency bumps and documentation fixes
+
+## 2.23.4
+
+Prior to this release Ginkgo would compute the incorrect number of available CPUs when running with `-p` in a linux container. Thanks to @emirot for the fix!
+
+### Features
+- Add automaxprocs for using CPUQuota [2b9c428]
+
+### Fixes
+- clarify gotchas about -vet flag [1f59d07]
+
+### Maintenance
+- bump dependencies [2d134d5]
+
+## 2.23.3
+
+### Fixes
+
+- allow `-` as a standalone argument [cfcc1a5]
+- Bug Fix: Add GinkoTBWrapper.Chdir() and GinkoTBWrapper.Context() [feaf292]
+- ignore exit code for symbol test on linux [88e2282]
+
+## 2.23.2
+
+🎉🎉🎉
+
+At long last, some long-standing performance gaps between `ginkgo` and `go test` have been resolved!
+
+Ginkgo operates by running `go test -c` to generate test binaries, and then running those binaries. It turns out that the compilation step of `go test -c` is slower than `go test`'s compilation step because `go test` strips out debug symbols (`ldflags=-w`) whereas `go test -c` does not.
+
+Ginkgo now passes the appropriate `ldflags` to `go test -c` when running specs to strip out symbols. This is only done when it is safe to do so and symbols are preferred when profiling is enabled and when `ginkgo build` is called explicitly.
+
+This, coupled, with the [instructions for disabling XProtect on MacOS](https://onsi.github.io/ginkgo/#if-you-are-running-on-macos) yields a much better performance experience with Ginkgo.
+
+## 2.23.1
+
+## 🚨 For users on MacOS 🚨
+
+A long-standing Ginkgo performance issue on MacOS seems to be due to mac's antimalware XProtect. You can follow the instructions [here](https://onsi.github.io/ginkgo/#if-you-are-running-on-macos) to disable it in your terminal. Doing so sped up Ginkgo's own test suite from 1m8s to 47s.
+
+### Fixes
+
+Ginkgo's CLI is now a bit clearer if you pass flags in incorrectly:
+
+- make it clearer that you need to pass a filename to the various profile flags, not an absolute directory [a0e52ff]
+- emit an error and exit if the ginkgo invocation includes flags after positional arguments [b799d8d]
+
+This might cause existing CI builds to fail. If so then it's likely that your CI build was misconfigured and should be corrected. Open an issue if you need help.
+
+## 2.23.0
+
+Ginkgo 2.23.0 adds a handful of methods to `GinkgoT()` to make it compatible with the `testing.TB` interface in Go 1.24. `GinkgoT().Context()`, in particular, is a useful shorthand for generating a new context that will clean itself up in a `DeferCleanup()`. This has subtle behavior differences from the golang implementation but should make sense in a Ginkgo... um... context.
+
+### Features
+- bump to go 1.24.0 - support new testing.TB methods and add a test to cover testing.TB regressions [37a511b]
+
+### Fixes
+- fix edge case where build -o is pointing at an explicit file, not a directory [7556a86]
+- Fix binary paths when precompiling multiple suites. [4df06c6]
+
+### Maintenance
+- Fix: Correct Markdown list rendering in MIGRATING_TO_V2.md [cbcf39a]
+- docs: fix test workflow badge (#1512) [9b261ff]
+- Bump golang.org/x/net in /integration/_fixtures/version_mismatch_fixture (#1516) [00f19c8]
+- Bump golang.org/x/tools from 0.28.0 to 0.30.0 (#1515) [e98a4df]
+- Bump activesupport from 6.0.6.1 to 6.1.7.5 in /docs (#1504) [60cc4e2]
+- Bump github-pages from 231 to 232 in /docs (#1447) [fea6f2d]
+- Bump rexml from 3.2.8 to 3.3.9 in /docs (#1497) [31d7813]
+- Bump webrick from 1.8.1 to 1.9.1 in /docs (#1501) [fc3bbd6]
+- Code linting (#1500) [aee0d56]
+- change interface{} to any (#1502) [809a710]
+
+## 2.22.2
+
+### Maintenance
+- Bump github.com/onsi/gomega from 1.36.1 to 1.36.2 (#1499) [cc553ce]
+- Bump golang.org/x/crypto (#1498) [2170370]
+- Bump golang.org/x/net from 0.32.0 to 0.33.0 (#1496) [a96c44f]
+
+## 2.22.1
+
+### Fixes
+Fix CSV encoding
+- Update tests [aab3da6]
+- Properly encode CSV rows [c09df39]
+- Add test case for proper csv escaping [96a80fc]
+- Add meta-test [43dad69]
+
+### Maintenance
+- ensure *.test files are gitignored so we don't accidentally commit compiled tests again [c88c634]
+- remove golang.org/x/net/context in favour of stdlib context [4df44bf]
+
+## 2.22.0
+
+### Features
+- Add label to serial nodes [0fcaa08]
+
+This allows serial tests to be filtered using the `label-filter`
+
+### Maintenance
+Various doc fixes
+
## 2.21.0
@@ -600,7 +842,7 @@ Ginkgo also uses this progress reporting infrastructure under the hood when hand
### Features
- `BeforeSuite`, `AfterSuite`, `SynchronizedBeforeSuite`, `SynchronizedAfterSuite`, and `ReportAfterSuite` now support (the relevant subset of) decorators. These can be passed in _after_ the callback functions that are usually passed into these nodes.
- As a result the **signature of these methods has changed** and now includes a trailing `args ...interface{}`. For most users simply using the DSL, this change is transparent. However if you were assigning one of these functions to a custom variable (or passing it around) then your code may need to change to reflect the new signature.
+ As a result the **signature of these methods has changed** and now includes a trailing `args ...any`. For most users simply using the DSL, this change is transparent. However if you were assigning one of these functions to a custom variable (or passing it around) then your code may need to change to reflect the new signature.
### Maintenance
- Modernize the invocation of Ginkgo in github actions [0ffde58]
@@ -1012,7 +1254,7 @@ New Features:
- `ginkgo -tags=TAG_LIST` passes a list of tags down to the `go build` command.
- `ginkgo --failFast` aborts the test suite after the first failure.
- `ginkgo generate file_1 file_2` can take multiple file arguments.
-- Ginkgo now summarizes any spec failures that occurred at the end of the test run.
+- Ginkgo now summarizes any spec failures that occurred at the end of the test run.
- `ginkgo --randomizeSuites` will run tests *suites* in random order using the generated/passed-in seed.
Improvements:
@@ -1046,7 +1288,7 @@ Bug Fixes:
Breaking changes:
- `thirdparty/gomocktestreporter` is gone. Use `GinkgoT()` instead
-- Modified the Reporter interface
+- Modified the Reporter interface
- `watch` is now a subcommand, not a flag.
DSL changes:
diff --git a/vendor/github.com/onsi/ginkgo/v2/README.md b/vendor/github.com/onsi/ginkgo/v2/README.md
index cb23ffdf6..b4c3ce0ad 100644
--- a/vendor/github.com/onsi/ginkgo/v2/README.md
+++ b/vendor/github.com/onsi/ginkgo/v2/README.md
@@ -1,6 +1,6 @@
-[](https://github.com/onsi/ginkgo/actions?query=workflow%3Atest+branch%3Amaster) | [Ginkgo Docs](https://onsi.github.io/ginkgo/)
+[](https://github.com/onsi/ginkgo/actions?query=workflow%3Atest+branch%3Amaster) | [Ginkgo Docs](https://onsi.github.io/ginkgo/)
---
@@ -113,3 +113,13 @@ Ginkgo is MIT-Licensed
## Contributing
See [CONTRIBUTING.md](CONTRIBUTING.md)
+
+## Sponsors
+
+Sponsors commit to a [sponsorship](https://github.com/sponsors/onsi) for a year. If you're an organization that makes use of Ginkgo please consider becoming a sponsor!
+
+Browser testing via
+
+ 
+
+
diff --git a/vendor/github.com/onsi/ginkgo/v2/core_dsl.go b/vendor/github.com/onsi/ginkgo/v2/core_dsl.go
index a3e8237e9..1c5a39a1f 100644
--- a/vendor/github.com/onsi/ginkgo/v2/core_dsl.go
+++ b/vendor/github.com/onsi/ginkgo/v2/core_dsl.go
@@ -20,6 +20,7 @@ import (
"io"
"os"
"path/filepath"
+ "slices"
"strings"
"github.com/go-logr/logr"
@@ -83,9 +84,9 @@ func exitIfErrors(errors []error) {
type GinkgoWriterInterface interface {
io.Writer
- Print(a ...interface{})
- Printf(format string, a ...interface{})
- Println(a ...interface{})
+ Print(a ...any)
+ Printf(format string, a ...any)
+ Println(a ...any)
TeeTo(writer io.Writer)
ClearTeeWriters()
@@ -186,6 +187,20 @@ func GinkgoLabelFilter() string {
return suiteConfig.LabelFilter
}
+/*
+GinkgoSemVerFilter() returns the semantic version filter configured for this suite via `--sem-ver-filter`.
+
+You can use this to manually check if a set of semantic version constraints would satisfy the filter via:
+
+ if (SemVerConstraint("> 2.6.0", "< 2.8.0").MatchesSemVerFilter(GinkgoSemVerFilter())) {
+ //...
+ }
+*/
+func GinkgoSemVerFilter() string {
+ suiteConfig, _ := GinkgoConfiguration()
+ return suiteConfig.SemVerFilter
+}
+
/*
PauseOutputInterception() pauses Ginkgo's output interception. This is only relevant
when running in parallel and output to stdout/stderr is being intercepted. You generally
@@ -243,7 +258,7 @@ for more on how specs are parallelized in Ginkgo.
You can also pass suite-level Label() decorators to RunSpecs. The passed-in labels will apply to all specs in the suite.
*/
-func RunSpecs(t GinkgoTestingT, description string, args ...interface{}) bool {
+func RunSpecs(t GinkgoTestingT, description string, args ...any) bool {
if suiteDidRun {
exitIfErr(types.GinkgoErrors.RerunningSuite())
}
@@ -254,7 +269,7 @@ func RunSpecs(t GinkgoTestingT, description string, args ...interface{}) bool {
}
defer global.PopClone()
- suiteLabels := extractSuiteConfiguration(args)
+ suiteLabels, suiteSemVerConstraints, suiteComponentSemVerConstraints, suiteAroundNodes := extractSuiteConfiguration(args)
var reporter reporters.Reporter
if suiteConfig.ParallelTotal == 1 {
@@ -297,7 +312,7 @@ func RunSpecs(t GinkgoTestingT, description string, args ...interface{}) bool {
suitePath, err = filepath.Abs(suitePath)
exitIfErr(err)
- passed, hasFocusedTests := global.Suite.Run(description, suiteLabels, suitePath, global.Failer, reporter, writer, outputInterceptor, interrupt_handler.NewInterruptHandler(client), client, internal.RegisterForProgressSignal, suiteConfig)
+ passed, hasFocusedTests := global.Suite.Run(description, suiteLabels, suiteSemVerConstraints, suiteComponentSemVerConstraints, suiteAroundNodes, suitePath, global.Failer, reporter, writer, outputInterceptor, interrupt_handler.NewInterruptHandler(client), client, internal.RegisterForProgressSignal, suiteConfig)
outputInterceptor.Shutdown()
flagSet.ValidateDeprecations(deprecationTracker)
@@ -316,8 +331,11 @@ func RunSpecs(t GinkgoTestingT, description string, args ...interface{}) bool {
return passed
}
-func extractSuiteConfiguration(args []interface{}) Labels {
+func extractSuiteConfiguration(args []any) (Labels, SemVerConstraints, ComponentSemVerConstraints, types.AroundNodes) {
suiteLabels := Labels{}
+ suiteSemVerConstraints := SemVerConstraints{}
+ suiteComponentSemVerConstraints := ComponentSemVerConstraints{}
+ aroundNodes := types.AroundNodes{}
configErrors := []error{}
for _, arg := range args {
switch arg := arg.(type) {
@@ -327,6 +345,15 @@ func extractSuiteConfiguration(args []interface{}) Labels {
reporterConfig = arg
case Labels:
suiteLabels = append(suiteLabels, arg...)
+ case SemVerConstraints:
+ suiteSemVerConstraints = append(suiteSemVerConstraints, arg...)
+ case ComponentSemVerConstraints:
+ for component, constraints := range arg {
+ suiteComponentSemVerConstraints[component] = append(suiteComponentSemVerConstraints[component], constraints...)
+ suiteComponentSemVerConstraints[component] = slices.Compact(suiteComponentSemVerConstraints[component])
+ }
+ case types.AroundNodeDecorator:
+ aroundNodes = append(aroundNodes, arg)
default:
configErrors = append(configErrors, types.GinkgoErrors.UnknownTypePassedToRunSpecs(arg))
}
@@ -335,14 +362,14 @@ func extractSuiteConfiguration(args []interface{}) Labels {
configErrors = types.VetConfig(flagSet, suiteConfig, reporterConfig)
if len(configErrors) > 0 {
- fmt.Fprintf(formatter.ColorableStdErr, formatter.F("{{red}}Ginkgo detected configuration issues:{{/}}\n"))
+ fmt.Fprint(formatter.ColorableStdErr, formatter.F("{{red}}Ginkgo detected configuration issues:{{/}}\n"))
for _, err := range configErrors {
- fmt.Fprintf(formatter.ColorableStdErr, err.Error())
+ fmt.Fprint(formatter.ColorableStdErr, err.Error())
}
os.Exit(1)
}
- return suiteLabels
+ return suiteLabels, suiteSemVerConstraints, suiteComponentSemVerConstraints, aroundNodes
}
func getwd() (string, error) {
@@ -365,7 +392,7 @@ func PreviewSpecs(description string, args ...any) Report {
}
defer global.PopClone()
- suiteLabels := extractSuiteConfiguration(args)
+ suiteLabels, suiteSemVerConstraints, suiteComponentSemVerConstraints, suiteAroundNodes := extractSuiteConfiguration(args)
priorDryRun, priorParallelTotal, priorParallelProcess := suiteConfig.DryRun, suiteConfig.ParallelTotal, suiteConfig.ParallelProcess
suiteConfig.DryRun, suiteConfig.ParallelTotal, suiteConfig.ParallelProcess = true, 1, 1
defer func() {
@@ -383,7 +410,7 @@ func PreviewSpecs(description string, args ...any) Report {
suitePath, err = filepath.Abs(suitePath)
exitIfErr(err)
- global.Suite.Run(description, suiteLabels, suitePath, global.Failer, reporter, writer, outputInterceptor, interrupt_handler.NewInterruptHandler(client), client, internal.RegisterForProgressSignal, suiteConfig)
+ global.Suite.Run(description, suiteLabels, suiteSemVerConstraints, suiteComponentSemVerConstraints, suiteAroundNodes, suitePath, global.Failer, reporter, writer, outputInterceptor, interrupt_handler.NewInterruptHandler(client), client, internal.RegisterForProgressSignal, suiteConfig)
return global.Suite.GetPreviewReport()
}
@@ -481,6 +508,38 @@ func pushNode(node internal.Node, errors []error) bool {
return true
}
+// NodeArgsTransformer is a hook which is called by the test construction DSL methods
+// before creating the new node. If it returns any error, the test suite
+// prints those errors and exits. The text and arguments can be modified,
+// which includes directly changing the args slice that is passed in.
+// Arguments have been flattened already, i.e. none of the entries in args is another []any.
+// The result may be nested.
+//
+// The node type is provided for information and remains the same.
+//
+// The offset is valid for calling NewLocation directly in the
+// implementation of TransformNodeArgs to find the location where
+// the Ginkgo DSL function is called. An additional offset supplied
+// by the caller via args is already included.
+//
+// A NodeArgsTransformer can be registered with AddTreeConstructionNodeArgsTransformer.
+type NodeArgsTransformer func(nodeType types.NodeType, offset Offset, text string, args []any) (string, []any, []error)
+
+// AddTreeConstructionNodeArgsTransformer registers a NodeArgsTransformer.
+// Only nodes which get created after registering a NodeArgsTransformer
+// are transformed by it. The returned function can be called to
+// unregister the transformer.
+//
+// Both may only be called during the construction phase.
+//
+// If there is more than one registered transformer, then the most
+// recently added ones get called first.
+func AddTreeConstructionNodeArgsTransformer(transformer NodeArgsTransformer) func() {
+ // This conversion could be avoided with a type alias, but type aliases make
+ // developer documentation less useful.
+ return internal.AddTreeConstructionNodeArgsTransformer(internal.NodeArgsTransformer(transformer))
+}
+
/*
Describe nodes are Container nodes that allow you to organize your specs. A Describe node's closure can contain any number of
Setup nodes (e.g. BeforeEach, AfterEach, JustBeforeEach), and Subject nodes (i.e. It).
@@ -491,24 +550,24 @@ to Describe the behavior of an object or function and, within that Describe, out
You can learn more at https://onsi.github.io/ginkgo/#organizing-specs-with-container-nodes
In addition, container nodes can be decorated with a variety of decorators. You can learn more here: https://onsi.github.io/ginkgo/#decorator-reference
*/
-func Describe(text string, args ...interface{}) bool {
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeContainer, text, args...))
+func Describe(text string, args ...any) bool {
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeContainer, text, args...)))
}
/*
FDescribe focuses specs within the Describe block.
*/
-func FDescribe(text string, args ...interface{}) bool {
+func FDescribe(text string, args ...any) bool {
args = append(args, internal.Focus)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeContainer, text, args...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeContainer, text, args...)))
}
/*
PDescribe marks specs within the Describe block as pending.
*/
-func PDescribe(text string, args ...interface{}) bool {
+func PDescribe(text string, args ...any) bool {
args = append(args, internal.Pending)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeContainer, text, args...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeContainer, text, args...)))
}
/*
@@ -521,21 +580,21 @@ var XDescribe = PDescribe
/* Context is an alias for Describe - it generates the exact same kind of Container node */
var Context, FContext, PContext, XContext = Describe, FDescribe, PDescribe, XDescribe
-/* When is an alias for Describe - it generates the exact same kind of Container node */
-func When(text string, args ...interface{}) bool {
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeContainer, "when "+text, args...))
+/* When is an alias for Describe - it generates the exact same kind of Container node with "when " as prefix for the text. */
+func When(text string, args ...any) bool {
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeContainer, "when "+text, args...)))
}
-/* When is an alias for Describe - it generates the exact same kind of Container node */
-func FWhen(text string, args ...interface{}) bool {
+/* When is an alias for Describe - it generates the exact same kind of Container node with "when " as prefix for the text. */
+func FWhen(text string, args ...any) bool {
args = append(args, internal.Focus)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeContainer, "when "+text, args...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeContainer, "when "+text, args...)))
}
/* When is an alias for Describe - it generates the exact same kind of Container node */
-func PWhen(text string, args ...interface{}) bool {
+func PWhen(text string, args ...any) bool {
args = append(args, internal.Pending)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeContainer, "when "+text, args...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeContainer, "when "+text, args...)))
}
var XWhen = PWhen
@@ -550,24 +609,24 @@ You can pass It nodes bare functions (func() {}) or functions that receive a Spe
You can learn more at https://onsi.github.io/ginkgo/#spec-subjects-it
In addition, subject nodes can be decorated with a variety of decorators. You can learn more here: https://onsi.github.io/ginkgo/#decorator-reference
*/
-func It(text string, args ...interface{}) bool {
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeIt, text, args...))
+func It(text string, args ...any) bool {
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeIt, text, args...)))
}
/*
FIt allows you to focus an individual It.
*/
-func FIt(text string, args ...interface{}) bool {
+func FIt(text string, args ...any) bool {
args = append(args, internal.Focus)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeIt, text, args...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeIt, text, args...)))
}
/*
PIt allows you to mark an individual It as pending.
*/
-func PIt(text string, args ...interface{}) bool {
+func PIt(text string, args ...any) bool {
args = append(args, internal.Pending)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeIt, text, args...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeIt, text, args...)))
}
/*
@@ -611,10 +670,10 @@ BeforeSuite can take a func() body, or an interruptible func(SpecContext)/func(c
You cannot nest any other Ginkgo nodes within a BeforeSuite node's closure.
You can learn more here: https://onsi.github.io/ginkgo/#suite-setup-and-cleanup-beforesuite-and-aftersuite
*/
-func BeforeSuite(body interface{}, args ...interface{}) bool {
- combinedArgs := []interface{}{body}
+func BeforeSuite(body any, args ...any) bool {
+ combinedArgs := []any{body}
combinedArgs = append(combinedArgs, args...)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeBeforeSuite, "", combinedArgs...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeBeforeSuite, "", combinedArgs...)))
}
/*
@@ -630,10 +689,10 @@ AfterSuite can take a func() body, or an interruptible func(SpecContext)/func(co
You cannot nest any other Ginkgo nodes within an AfterSuite node's closure.
You can learn more here: https://onsi.github.io/ginkgo/#suite-setup-and-cleanup-beforesuite-and-aftersuite
*/
-func AfterSuite(body interface{}, args ...interface{}) bool {
- combinedArgs := []interface{}{body}
+func AfterSuite(body any, args ...any) bool {
+ combinedArgs := []any{body}
combinedArgs = append(combinedArgs, args...)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeAfterSuite, "", combinedArgs...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeAfterSuite, "", combinedArgs...)))
}
/*
@@ -667,11 +726,11 @@ If either function receives a context.Context/SpecContext it is considered inter
You cannot nest any other Ginkgo nodes within an SynchronizedBeforeSuite node's closure.
You can learn more, and see some examples, here: https://onsi.github.io/ginkgo/#parallel-suite-setup-and-cleanup-synchronizedbeforesuite-and-synchronizedaftersuite
*/
-func SynchronizedBeforeSuite(process1Body interface{}, allProcessBody interface{}, args ...interface{}) bool {
- combinedArgs := []interface{}{process1Body, allProcessBody}
+func SynchronizedBeforeSuite(process1Body any, allProcessBody any, args ...any) bool {
+ combinedArgs := []any{process1Body, allProcessBody}
combinedArgs = append(combinedArgs, args...)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeSynchronizedBeforeSuite, "", combinedArgs...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeSynchronizedBeforeSuite, "", combinedArgs...)))
}
/*
@@ -687,11 +746,11 @@ Note that you can also use DeferCleanup() in SynchronizedBeforeSuite to accompli
You cannot nest any other Ginkgo nodes within an SynchronizedAfterSuite node's closure.
You can learn more, and see some examples, here: https://onsi.github.io/ginkgo/#parallel-suite-setup-and-cleanup-synchronizedbeforesuite-and-synchronizedaftersuite
*/
-func SynchronizedAfterSuite(allProcessBody interface{}, process1Body interface{}, args ...interface{}) bool {
- combinedArgs := []interface{}{allProcessBody, process1Body}
+func SynchronizedAfterSuite(allProcessBody any, process1Body any, args ...any) bool {
+ combinedArgs := []any{allProcessBody, process1Body}
combinedArgs = append(combinedArgs, args...)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeSynchronizedAfterSuite, "", combinedArgs...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeSynchronizedAfterSuite, "", combinedArgs...)))
}
/*
@@ -703,8 +762,8 @@ BeforeEach can take a func() body, or an interruptible func(SpecContext)/func(co
You cannot nest any other Ginkgo nodes within a BeforeEach node's closure.
You can learn more here: https://onsi.github.io/ginkgo/#extracting-common-setup-beforeeach
*/
-func BeforeEach(args ...interface{}) bool {
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeBeforeEach, "", args...))
+func BeforeEach(args ...any) bool {
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeBeforeEach, "", args...)))
}
/*
@@ -716,8 +775,8 @@ JustBeforeEach can take a func() body, or an interruptible func(SpecContext)/fun
You cannot nest any other Ginkgo nodes within a JustBeforeEach node's closure.
You can learn more and see some examples here: https://onsi.github.io/ginkgo/#separating-creation-and-configuration-justbeforeeach
*/
-func JustBeforeEach(args ...interface{}) bool {
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeJustBeforeEach, "", args...))
+func JustBeforeEach(args ...any) bool {
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeJustBeforeEach, "", args...)))
}
/*
@@ -731,8 +790,8 @@ AfterEach can take a func() body, or an interruptible func(SpecContext)/func(con
You cannot nest any other Ginkgo nodes within an AfterEach node's closure.
You can learn more here: https://onsi.github.io/ginkgo/#spec-cleanup-aftereach-and-defercleanup
*/
-func AfterEach(args ...interface{}) bool {
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeAfterEach, "", args...))
+func AfterEach(args ...any) bool {
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeAfterEach, "", args...)))
}
/*
@@ -743,8 +802,8 @@ JustAfterEach can take a func() body, or an interruptible func(SpecContext)/func
You cannot nest any other Ginkgo nodes within a JustAfterEach node's closure.
You can learn more and see some examples here: https://onsi.github.io/ginkgo/#separating-diagnostics-collection-and-teardown-justaftereach
*/
-func JustAfterEach(args ...interface{}) bool {
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeJustAfterEach, "", args...))
+func JustAfterEach(args ...any) bool {
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeJustAfterEach, "", args...)))
}
/*
@@ -758,8 +817,8 @@ You cannot nest any other Ginkgo nodes within a BeforeAll node's closure.
You can learn more about Ordered Containers at: https://onsi.github.io/ginkgo/#ordered-containers
And you can learn more about BeforeAll at: https://onsi.github.io/ginkgo/#setup-in-ordered-containers-beforeall-and-afterall
*/
-func BeforeAll(args ...interface{}) bool {
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeBeforeAll, "", args...))
+func BeforeAll(args ...any) bool {
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeBeforeAll, "", args...)))
}
/*
@@ -775,8 +834,8 @@ You cannot nest any other Ginkgo nodes within an AfterAll node's closure.
You can learn more about Ordered Containers at: https://onsi.github.io/ginkgo/#ordered-containers
And you can learn more about AfterAll at: https://onsi.github.io/ginkgo/#setup-in-ordered-containers-beforeall-and-afterall
*/
-func AfterAll(args ...interface{}) bool {
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeAfterAll, "", args...))
+func AfterAll(args ...any) bool {
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeAfterAll, "", args...)))
}
/*
@@ -818,7 +877,7 @@ When DeferCleanup is called in BeforeSuite, SynchronizedBeforeSuite, AfterSuite,
Note that DeferCleanup does not represent a node but rather dynamically generates the appropriate type of cleanup node based on the context in which it is called. As such you must call DeferCleanup within a Setup or Subject node, and not within a Container node.
You can learn more about DeferCleanup here: https://onsi.github.io/ginkgo/#cleaning-up-our-cleanup-code-defercleanup
*/
-func DeferCleanup(args ...interface{}) {
+func DeferCleanup(args ...any) {
fail := func(message string, cl types.CodeLocation) {
global.Failer.Fail(message, cl)
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/decorator_dsl.go b/vendor/github.com/onsi/ginkgo/v2/decorator_dsl.go
index c65af4ce1..ce1d71cec 100644
--- a/vendor/github.com/onsi/ginkgo/v2/decorator_dsl.go
+++ b/vendor/github.com/onsi/ginkgo/v2/decorator_dsl.go
@@ -2,6 +2,7 @@ package ginkgo
import (
"github.com/onsi/ginkgo/v2/internal"
+ "github.com/onsi/ginkgo/v2/types"
)
/*
@@ -99,6 +100,44 @@ You can learn more here: https://onsi.github.io/ginkgo/#spec-labels
*/
type Labels = internal.Labels
+/*
+SemVerConstraint decorates specs with SemVerConstraints. Multiple semantic version constraints can be passed to SemVerConstraint and these strings must follow the semantic version constraint rules.
+SemVerConstraints can be applied to container and subject nodes, but not setup nodes. You can provide multiple SemVerConstraints to a given node and a spec's semantic version constraints is the union of all semantic version constraints in its node hierarchy.
+
+You can learn more here: https://onsi.github.io/ginkgo/#spec-semantic-version-filtering
+You can learn more about decorators here: https://onsi.github.io/ginkgo/#decorator-reference
+*/
+func SemVerConstraint(semVerConstraints ...string) SemVerConstraints {
+ return SemVerConstraints(semVerConstraints)
+}
+
+/*
+SemVerConstraints are the type for spec SemVerConstraint decorators. Use SemVerConstraint(...) to construct SemVerConstraints.
+You can learn more here: https://onsi.github.io/ginkgo/#spec-semantic-version-filtering
+*/
+type SemVerConstraints = internal.SemVerConstraints
+
+/*
+ComponentSemVerConstraint decorates specs with ComponentSemVerConstraints. Multiple components semantic version constraints can be passed to ComponentSemVerConstraint and the component can't be empy, also the version strings must follow the semantic version constraint rules.
+ComponentSemVerConstraints can be applied to container and subject nodes, but not setup nodes. You can provide multiple ComponentSemVerConstraints to a given node and a spec's component semantic version constraints is the union of all component semantic version constraints in its node hierarchy.
+
+You can learn more here: https://onsi.github.io/ginkgo/#spec-semantic-version-filtering
+You can learn more about decorators here: https://onsi.github.io/ginkgo/#decorator-reference
+*/
+func ComponentSemVerConstraint(component string, semVerConstraints ...string) ComponentSemVerConstraints {
+ componentSemVerConstraints := ComponentSemVerConstraints{
+ component: semVerConstraints,
+ }
+
+ return componentSemVerConstraints
+}
+
+/*
+ComponentSemVerConstraints are the type for spec ComponentSemVerConstraint decorators. Use ComponentSemVerConstraint(...) to construct ComponentSemVerConstraints.
+You can learn more here: https://onsi.github.io/ginkgo/#spec-semantic-version-filtering
+*/
+type ComponentSemVerConstraints = internal.ComponentSemVerConstraints
+
/*
PollProgressAfter allows you to override the configured value for --poll-progress-after for a particular node.
@@ -136,8 +175,40 @@ Nodes that do not finish within a GracePeriod will be leaked and Ginkgo will pro
*/
type GracePeriod = internal.GracePeriod
+/*
+SpecPriority allows you to assign a priority to a spec or container.
+
+Specs with higher priority will be scheduled to run before specs with lower priority. The default priority is 0 and negative priorities are allowed.
+*/
+type SpecPriority = internal.SpecPriority
+
/*
SuppressProgressReporting is a decorator that allows you to disable progress reporting of a particular node. This is useful if `ginkgo -v -progress` is generating too much noise; particularly
if you have a `ReportAfterEach` node that is running for every skipped spec and is generating lots of progress reports.
*/
const SuppressProgressReporting = internal.SuppressProgressReporting
+
+/*
+AroundNode registers a function that runs before each individual node. This is considered a more advanced decorator.
+
+Please read the [docs](https://onsi.github.io/ginkgo/#advanced-around-node) for more information.
+
+Allowed signatures:
+
+- AroundNode(func()) - func will be called before the node is run.
+- AroundNode(func(ctx context.Context) context.Context) - func can wrap the passed in context and return a new one which will be passed on to the node.
+- AroundNode(func(ctx context.Context, body func(ctx context.Context))) - ctx is the context for the node and body is a function that must be called to run the node. This gives you complete control over what runs before and after the node.
+
+Multiple AroundNode decorators can be applied to a single node and they will run in the order they are applied.
+
+Unlike setup nodes like BeforeEach and DeferCleanup, AroundNode is guaranteed to run in the same goroutine as the decorated node. This is necessary when working with lower-level libraries that must run on a single thread (you can call runtime.LockOSThread() in the AroundNode to ensure that the node runs on a single thread).
+
+Since AroundNode allows you to modify the context you can also use AroundNode to implement shared setup that attaches values to the context. You must return a context that inherits from the passed in context.
+
+If applied to a container, AroundNode will run before every node in the container. Including setup nodes like BeforeEach and DeferCleanup.
+
+AroundNode can also be applied to RunSpecs to run before every node in the suite.
+*/
+func AroundNode[F types.AroundNodeAllowedFuncs](f F) types.AroundNodeDecorator {
+ return types.AroundNode(f, types.NewCodeLocation(1))
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/deprecated_dsl.go b/vendor/github.com/onsi/ginkgo/v2/deprecated_dsl.go
index f912bbec6..fd45b8bea 100644
--- a/vendor/github.com/onsi/ginkgo/v2/deprecated_dsl.go
+++ b/vendor/github.com/onsi/ginkgo/v2/deprecated_dsl.go
@@ -118,9 +118,9 @@ Use Gomega's gmeasure package instead.
You can learn more here: https://onsi.github.io/ginkgo/#benchmarking-code
*/
type Benchmarker interface {
- Time(name string, body func(), info ...interface{}) (elapsedTime time.Duration)
- RecordValue(name string, value float64, info ...interface{})
- RecordValueWithPrecision(name string, value float64, units string, precision int, info ...interface{})
+ Time(name string, body func(), info ...any) (elapsedTime time.Duration)
+ RecordValue(name string, value float64, info ...any)
+ RecordValueWithPrecision(name string, value float64, units string, precision int, info ...any)
}
/*
@@ -129,7 +129,7 @@ Deprecated: Measure() has been removed from Ginkgo 2.0
Use Gomega's gmeasure package instead.
You can learn more here: https://onsi.github.io/ginkgo/#benchmarking-code
*/
-func Measure(_ ...interface{}) bool {
+func Measure(_ ...any) bool {
deprecationTracker.TrackDeprecation(types.Deprecations.Measure(), types.NewCodeLocation(1))
return true
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/formatter/formatter.go b/vendor/github.com/onsi/ginkgo/v2/formatter/formatter.go
index 4d5749114..f61356db1 100644
--- a/vendor/github.com/onsi/ginkgo/v2/formatter/formatter.go
+++ b/vendor/github.com/onsi/ginkgo/v2/formatter/formatter.go
@@ -24,15 +24,15 @@ const (
var SingletonFormatter = New(ColorModeTerminal)
-func F(format string, args ...interface{}) string {
+func F(format string, args ...any) string {
return SingletonFormatter.F(format, args...)
}
-func Fi(indentation uint, format string, args ...interface{}) string {
+func Fi(indentation uint, format string, args ...any) string {
return SingletonFormatter.Fi(indentation, format, args...)
}
-func Fiw(indentation uint, maxWidth uint, format string, args ...interface{}) string {
+func Fiw(indentation uint, maxWidth uint, format string, args ...any) string {
return SingletonFormatter.Fiw(indentation, maxWidth, format, args...)
}
@@ -115,15 +115,15 @@ func New(colorMode ColorMode) Formatter {
return f
}
-func (f Formatter) F(format string, args ...interface{}) string {
+func (f Formatter) F(format string, args ...any) string {
return f.Fi(0, format, args...)
}
-func (f Formatter) Fi(indentation uint, format string, args ...interface{}) string {
+func (f Formatter) Fi(indentation uint, format string, args ...any) string {
return f.Fiw(indentation, 0, format, args...)
}
-func (f Formatter) Fiw(indentation uint, maxWidth uint, format string, args ...interface{}) string {
+func (f Formatter) Fiw(indentation uint, maxWidth uint, format string, args ...any) string {
out := f.style(format)
if len(args) > 0 {
out = fmt.Sprintf(out, args...)
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs.go
new file mode 100644
index 000000000..ee6ac7b5f
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs.go
@@ -0,0 +1,8 @@
+//go:build !go1.25
+// +build !go1.25
+
+package main
+
+import (
+ _ "github.com/onsi/ginkgo/v2/ginkgo/automaxprocs"
+)
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/README.md b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/README.md
new file mode 100644
index 000000000..e249ebe8b
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/README.md
@@ -0,0 +1,3 @@
+This entire directory is a lightly modified clone of https://github.com/uber-go/automaxprocs
+
+It will be removed when Go 1.26 ships and we no longer need to support Go 1.24 (which does not correctly autodetect maxprocs in containers).
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/automaxprocs.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/automaxprocs.go
new file mode 100644
index 000000000..8a762b51d
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/automaxprocs.go
@@ -0,0 +1,71 @@
+// Copyright (c) 2017 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+// Package maxprocs lets Go programs easily configure runtime.GOMAXPROCS to
+// match the configured Linux CPU quota. Unlike the top-level automaxprocs
+// package, it lets the caller configure logging and handle errors.
+package automaxprocs
+
+import (
+ "os"
+ "runtime"
+)
+
+func init() {
+ Set()
+}
+
+const _maxProcsKey = "GOMAXPROCS"
+
+type config struct {
+ procs func(int, func(v float64) int) (int, CPUQuotaStatus, error)
+ minGOMAXPROCS int
+ roundQuotaFunc func(v float64) int
+}
+
+// Set GOMAXPROCS to match the Linux container CPU quota (if any), returning
+// any error encountered and an undo function.
+//
+// Set is a no-op on non-Linux systems and in Linux environments without a
+// configured CPU quota.
+func Set() error {
+ cfg := &config{
+ procs: CPUQuotaToGOMAXPROCS,
+ roundQuotaFunc: DefaultRoundFunc,
+ minGOMAXPROCS: 1,
+ }
+
+ // Honor the GOMAXPROCS environment variable if present. Otherwise, amend
+ // `runtime.GOMAXPROCS()` with the current process' CPU quota if the OS is
+ // Linux, and guarantee a minimum value of 1. The minimum guaranteed value
+ // can be overridden using `maxprocs.Min()`.
+ if _, exists := os.LookupEnv(_maxProcsKey); exists {
+ return nil
+ }
+ maxProcs, status, err := cfg.procs(cfg.minGOMAXPROCS, cfg.roundQuotaFunc)
+ if err != nil {
+ return err
+ }
+ if status == CPUQuotaUndefined {
+ return nil
+ }
+ runtime.GOMAXPROCS(maxProcs)
+ return nil
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroup.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroup.go
new file mode 100644
index 000000000..a4676933e
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroup.go
@@ -0,0 +1,79 @@
+// Copyright (c) 2017 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+//go:build linux
+// +build linux
+
+package automaxprocs
+
+import (
+ "bufio"
+ "io"
+ "os"
+ "path/filepath"
+ "strconv"
+)
+
+// CGroup represents the data structure for a Linux control group.
+type CGroup struct {
+ path string
+}
+
+// NewCGroup returns a new *CGroup from a given path.
+func NewCGroup(path string) *CGroup {
+ return &CGroup{path: path}
+}
+
+// Path returns the path of the CGroup*.
+func (cg *CGroup) Path() string {
+ return cg.path
+}
+
+// ParamPath returns the path of the given cgroup param under itself.
+func (cg *CGroup) ParamPath(param string) string {
+ return filepath.Join(cg.path, param)
+}
+
+// readFirstLine reads the first line from a cgroup param file.
+func (cg *CGroup) readFirstLine(param string) (string, error) {
+ paramFile, err := os.Open(cg.ParamPath(param))
+ if err != nil {
+ return "", err
+ }
+ defer paramFile.Close()
+
+ scanner := bufio.NewScanner(paramFile)
+ if scanner.Scan() {
+ return scanner.Text(), nil
+ }
+ if err := scanner.Err(); err != nil {
+ return "", err
+ }
+ return "", io.ErrUnexpectedEOF
+}
+
+// readInt parses the first line from a cgroup param file as int.
+func (cg *CGroup) readInt(param string) (int, error) {
+ text, err := cg.readFirstLine(param)
+ if err != nil {
+ return 0, err
+ }
+ return strconv.Atoi(text)
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups.go
new file mode 100644
index 000000000..ed384891e
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups.go
@@ -0,0 +1,118 @@
+// Copyright (c) 2017 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+//go:build linux
+// +build linux
+
+package automaxprocs
+
+const (
+ // _cgroupFSType is the Linux CGroup file system type used in
+ // `/proc/$PID/mountinfo`.
+ _cgroupFSType = "cgroup"
+ // _cgroupSubsysCPU is the CPU CGroup subsystem.
+ _cgroupSubsysCPU = "cpu"
+ // _cgroupSubsysCPUAcct is the CPU accounting CGroup subsystem.
+ _cgroupSubsysCPUAcct = "cpuacct"
+ // _cgroupSubsysCPUSet is the CPUSet CGroup subsystem.
+ _cgroupSubsysCPUSet = "cpuset"
+ // _cgroupSubsysMemory is the Memory CGroup subsystem.
+ _cgroupSubsysMemory = "memory"
+
+ // _cgroupCPUCFSQuotaUsParam is the file name for the CGroup CFS quota
+ // parameter.
+ _cgroupCPUCFSQuotaUsParam = "cpu.cfs_quota_us"
+ // _cgroupCPUCFSPeriodUsParam is the file name for the CGroup CFS period
+ // parameter.
+ _cgroupCPUCFSPeriodUsParam = "cpu.cfs_period_us"
+)
+
+const (
+ _procPathCGroup = "/proc/self/cgroup"
+ _procPathMountInfo = "/proc/self/mountinfo"
+)
+
+// CGroups is a map that associates each CGroup with its subsystem name.
+type CGroups map[string]*CGroup
+
+// NewCGroups returns a new *CGroups from given `mountinfo` and `cgroup` files
+// under for some process under `/proc` file system (see also proc(5) for more
+// information).
+func NewCGroups(procPathMountInfo, procPathCGroup string) (CGroups, error) {
+ cgroupSubsystems, err := parseCGroupSubsystems(procPathCGroup)
+ if err != nil {
+ return nil, err
+ }
+
+ cgroups := make(CGroups)
+ newMountPoint := func(mp *MountPoint) error {
+ if mp.FSType != _cgroupFSType {
+ return nil
+ }
+
+ for _, opt := range mp.SuperOptions {
+ subsys, exists := cgroupSubsystems[opt]
+ if !exists {
+ continue
+ }
+
+ cgroupPath, err := mp.Translate(subsys.Name)
+ if err != nil {
+ return err
+ }
+ cgroups[opt] = NewCGroup(cgroupPath)
+ }
+
+ return nil
+ }
+
+ if err := parseMountInfo(procPathMountInfo, newMountPoint); err != nil {
+ return nil, err
+ }
+ return cgroups, nil
+}
+
+// NewCGroupsForCurrentProcess returns a new *CGroups instance for the current
+// process.
+func NewCGroupsForCurrentProcess() (CGroups, error) {
+ return NewCGroups(_procPathMountInfo, _procPathCGroup)
+}
+
+// CPUQuota returns the CPU quota applied with the CPU cgroup controller.
+// It is a result of `cpu.cfs_quota_us / cpu.cfs_period_us`. If the value of
+// `cpu.cfs_quota_us` was not set (-1), the method returns `(-1, nil)`.
+func (cg CGroups) CPUQuota() (float64, bool, error) {
+ cpuCGroup, exists := cg[_cgroupSubsysCPU]
+ if !exists {
+ return -1, false, nil
+ }
+
+ cfsQuotaUs, err := cpuCGroup.readInt(_cgroupCPUCFSQuotaUsParam)
+ if defined := cfsQuotaUs > 0; err != nil || !defined {
+ return -1, defined, err
+ }
+
+ cfsPeriodUs, err := cpuCGroup.readInt(_cgroupCPUCFSPeriodUsParam)
+ if defined := cfsPeriodUs > 0; err != nil || !defined {
+ return -1, defined, err
+ }
+
+ return float64(cfsQuotaUs) / float64(cfsPeriodUs), true, nil
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups2.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups2.go
new file mode 100644
index 000000000..69a0be6b7
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups2.go
@@ -0,0 +1,176 @@
+// Copyright (c) 2022 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+//go:build linux
+// +build linux
+
+package automaxprocs
+
+import (
+ "bufio"
+ "errors"
+ "fmt"
+ "io"
+ "os"
+ "path"
+ "strconv"
+ "strings"
+)
+
+const (
+ // _cgroupv2CPUMax is the file name for the CGroup-V2 CPU max and period
+ // parameter.
+ _cgroupv2CPUMax = "cpu.max"
+ // _cgroupFSType is the Linux CGroup-V2 file system type used in
+ // `/proc/$PID/mountinfo`.
+ _cgroupv2FSType = "cgroup2"
+
+ _cgroupv2MountPoint = "/sys/fs/cgroup"
+
+ _cgroupV2CPUMaxDefaultPeriod = 100000
+ _cgroupV2CPUMaxQuotaMax = "max"
+)
+
+const (
+ _cgroupv2CPUMaxQuotaIndex = iota
+ _cgroupv2CPUMaxPeriodIndex
+)
+
+// ErrNotV2 indicates that the system is not using cgroups2.
+var ErrNotV2 = errors.New("not using cgroups2")
+
+// CGroups2 provides access to cgroups data for systems using cgroups2.
+type CGroups2 struct {
+ mountPoint string
+ groupPath string
+ cpuMaxFile string
+}
+
+// NewCGroups2ForCurrentProcess builds a CGroups2 for the current process.
+//
+// This returns ErrNotV2 if the system is not using cgroups2.
+func NewCGroups2ForCurrentProcess() (*CGroups2, error) {
+ return newCGroups2From(_procPathMountInfo, _procPathCGroup)
+}
+
+func newCGroups2From(mountInfoPath, procPathCGroup string) (*CGroups2, error) {
+ isV2, err := isCGroupV2(mountInfoPath)
+ if err != nil {
+ return nil, err
+ }
+
+ if !isV2 {
+ return nil, ErrNotV2
+ }
+
+ subsystems, err := parseCGroupSubsystems(procPathCGroup)
+ if err != nil {
+ return nil, err
+ }
+
+ // Find v2 subsystem by looking for the `0` id
+ var v2subsys *CGroupSubsys
+ for _, subsys := range subsystems {
+ if subsys.ID == 0 {
+ v2subsys = subsys
+ break
+ }
+ }
+
+ if v2subsys == nil {
+ return nil, ErrNotV2
+ }
+
+ return &CGroups2{
+ mountPoint: _cgroupv2MountPoint,
+ groupPath: v2subsys.Name,
+ cpuMaxFile: _cgroupv2CPUMax,
+ }, nil
+}
+
+func isCGroupV2(procPathMountInfo string) (bool, error) {
+ var (
+ isV2 bool
+ newMountPoint = func(mp *MountPoint) error {
+ isV2 = isV2 || (mp.FSType == _cgroupv2FSType && mp.MountPoint == _cgroupv2MountPoint)
+ return nil
+ }
+ )
+
+ if err := parseMountInfo(procPathMountInfo, newMountPoint); err != nil {
+ return false, err
+ }
+
+ return isV2, nil
+}
+
+// CPUQuota returns the CPU quota applied with the CPU cgroup2 controller.
+// It is a result of reading cpu quota and period from cpu.max file.
+// It will return `cpu.max / cpu.period`. If cpu.max is set to max, it returns
+// (-1, false, nil)
+func (cg *CGroups2) CPUQuota() (float64, bool, error) {
+ cpuMaxParams, err := os.Open(path.Join(cg.mountPoint, cg.groupPath, cg.cpuMaxFile))
+ if err != nil {
+ if os.IsNotExist(err) {
+ return -1, false, nil
+ }
+ return -1, false, err
+ }
+ defer cpuMaxParams.Close()
+
+ scanner := bufio.NewScanner(cpuMaxParams)
+ if scanner.Scan() {
+ fields := strings.Fields(scanner.Text())
+ if len(fields) == 0 || len(fields) > 2 {
+ return -1, false, fmt.Errorf("invalid format")
+ }
+
+ if fields[_cgroupv2CPUMaxQuotaIndex] == _cgroupV2CPUMaxQuotaMax {
+ return -1, false, nil
+ }
+
+ max, err := strconv.Atoi(fields[_cgroupv2CPUMaxQuotaIndex])
+ if err != nil {
+ return -1, false, err
+ }
+
+ var period int
+ if len(fields) == 1 {
+ period = _cgroupV2CPUMaxDefaultPeriod
+ } else {
+ period, err = strconv.Atoi(fields[_cgroupv2CPUMaxPeriodIndex])
+ if err != nil {
+ return -1, false, err
+ }
+
+ if period == 0 {
+ return -1, false, errors.New("zero value for period is not allowed")
+ }
+ }
+
+ return float64(max) / float64(period), true, nil
+ }
+
+ if err := scanner.Err(); err != nil {
+ return -1, false, err
+ }
+
+ return 0, false, io.ErrUnexpectedEOF
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_linux.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_linux.go
new file mode 100644
index 000000000..2d83343bd
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_linux.go
@@ -0,0 +1,73 @@
+// Copyright (c) 2017 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+//go:build linux
+// +build linux
+
+package automaxprocs
+
+import (
+ "errors"
+)
+
+// CPUQuotaToGOMAXPROCS converts the CPU quota applied to the calling process
+// to a valid GOMAXPROCS value. The quota is converted from float to int using round.
+// If round == nil, DefaultRoundFunc is used.
+func CPUQuotaToGOMAXPROCS(minValue int, round func(v float64) int) (int, CPUQuotaStatus, error) {
+ if round == nil {
+ round = DefaultRoundFunc
+ }
+ cgroups, err := _newQueryer()
+ if err != nil {
+ return -1, CPUQuotaUndefined, err
+ }
+
+ quota, defined, err := cgroups.CPUQuota()
+ if !defined || err != nil {
+ return -1, CPUQuotaUndefined, err
+ }
+
+ maxProcs := round(quota)
+ if minValue > 0 && maxProcs < minValue {
+ return minValue, CPUQuotaMinUsed, nil
+ }
+ return maxProcs, CPUQuotaUsed, nil
+}
+
+type queryer interface {
+ CPUQuota() (float64, bool, error)
+}
+
+var (
+ _newCgroups2 = NewCGroups2ForCurrentProcess
+ _newCgroups = NewCGroupsForCurrentProcess
+ _newQueryer = newQueryer
+)
+
+func newQueryer() (queryer, error) {
+ cgroups, err := _newCgroups2()
+ if err == nil {
+ return cgroups, nil
+ }
+ if errors.Is(err, ErrNotV2) {
+ return _newCgroups()
+ }
+ return nil, err
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_unsupported.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_unsupported.go
new file mode 100644
index 000000000..d2d61e894
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_unsupported.go
@@ -0,0 +1,31 @@
+// Copyright (c) 2017 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+//go:build !linux
+// +build !linux
+
+package automaxprocs
+
+// CPUQuotaToGOMAXPROCS converts the CPU quota applied to the calling process
+// to a valid GOMAXPROCS value. This is Linux-specific and not supported in the
+// current OS.
+func CPUQuotaToGOMAXPROCS(_ int, _ func(v float64) int) (int, CPUQuotaStatus, error) {
+ return -1, CPUQuotaUndefined, nil
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/errors.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/errors.go
new file mode 100644
index 000000000..2e235d7d6
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/errors.go
@@ -0,0 +1,52 @@
+// Copyright (c) 2017 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+//go:build linux
+// +build linux
+
+package automaxprocs
+
+import "fmt"
+
+type cgroupSubsysFormatInvalidError struct {
+ line string
+}
+
+type mountPointFormatInvalidError struct {
+ line string
+}
+
+type pathNotExposedFromMountPointError struct {
+ mountPoint string
+ root string
+ path string
+}
+
+func (err cgroupSubsysFormatInvalidError) Error() string {
+ return fmt.Sprintf("invalid format for CGroupSubsys: %q", err.line)
+}
+
+func (err mountPointFormatInvalidError) Error() string {
+ return fmt.Sprintf("invalid format for MountPoint: %q", err.line)
+}
+
+func (err pathNotExposedFromMountPointError) Error() string {
+ return fmt.Sprintf("path %q is not a descendant of mount point root %q and cannot be exposed from %q", err.path, err.root, err.mountPoint)
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/mountpoint.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/mountpoint.go
new file mode 100644
index 000000000..7c3fa306e
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/mountpoint.go
@@ -0,0 +1,171 @@
+// Copyright (c) 2017 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+//go:build linux
+// +build linux
+
+package automaxprocs
+
+import (
+ "bufio"
+ "os"
+ "path/filepath"
+ "strconv"
+ "strings"
+)
+
+const (
+ _mountInfoSep = " "
+ _mountInfoOptsSep = ","
+ _mountInfoOptionalFieldsSep = "-"
+)
+
+const (
+ _miFieldIDMountID = iota
+ _miFieldIDParentID
+ _miFieldIDDeviceID
+ _miFieldIDRoot
+ _miFieldIDMountPoint
+ _miFieldIDOptions
+ _miFieldIDOptionalFields
+
+ _miFieldCountFirstHalf
+)
+
+const (
+ _miFieldOffsetFSType = iota
+ _miFieldOffsetMountSource
+ _miFieldOffsetSuperOptions
+
+ _miFieldCountSecondHalf
+)
+
+const _miFieldCountMin = _miFieldCountFirstHalf + _miFieldCountSecondHalf
+
+// MountPoint is the data structure for the mount points in
+// `/proc/$PID/mountinfo`. See also proc(5) for more information.
+type MountPoint struct {
+ MountID int
+ ParentID int
+ DeviceID string
+ Root string
+ MountPoint string
+ Options []string
+ OptionalFields []string
+ FSType string
+ MountSource string
+ SuperOptions []string
+}
+
+// NewMountPointFromLine parses a line read from `/proc/$PID/mountinfo` and
+// returns a new *MountPoint.
+func NewMountPointFromLine(line string) (*MountPoint, error) {
+ fields := strings.Split(line, _mountInfoSep)
+
+ if len(fields) < _miFieldCountMin {
+ return nil, mountPointFormatInvalidError{line}
+ }
+
+ mountID, err := strconv.Atoi(fields[_miFieldIDMountID])
+ if err != nil {
+ return nil, err
+ }
+
+ parentID, err := strconv.Atoi(fields[_miFieldIDParentID])
+ if err != nil {
+ return nil, err
+ }
+
+ for i, field := range fields[_miFieldIDOptionalFields:] {
+ if field == _mountInfoOptionalFieldsSep {
+ // End of optional fields.
+ fsTypeStart := _miFieldIDOptionalFields + i + 1
+
+ // Now we know where the optional fields end, split the line again with a
+ // limit to avoid issues with spaces in super options as present on WSL.
+ fields = strings.SplitN(line, _mountInfoSep, fsTypeStart+_miFieldCountSecondHalf)
+ if len(fields) != fsTypeStart+_miFieldCountSecondHalf {
+ return nil, mountPointFormatInvalidError{line}
+ }
+
+ miFieldIDFSType := _miFieldOffsetFSType + fsTypeStart
+ miFieldIDMountSource := _miFieldOffsetMountSource + fsTypeStart
+ miFieldIDSuperOptions := _miFieldOffsetSuperOptions + fsTypeStart
+
+ return &MountPoint{
+ MountID: mountID,
+ ParentID: parentID,
+ DeviceID: fields[_miFieldIDDeviceID],
+ Root: fields[_miFieldIDRoot],
+ MountPoint: fields[_miFieldIDMountPoint],
+ Options: strings.Split(fields[_miFieldIDOptions], _mountInfoOptsSep),
+ OptionalFields: fields[_miFieldIDOptionalFields:(fsTypeStart - 1)],
+ FSType: fields[miFieldIDFSType],
+ MountSource: fields[miFieldIDMountSource],
+ SuperOptions: strings.Split(fields[miFieldIDSuperOptions], _mountInfoOptsSep),
+ }, nil
+ }
+ }
+
+ return nil, mountPointFormatInvalidError{line}
+}
+
+// Translate converts an absolute path inside the *MountPoint's file system to
+// the host file system path in the mount namespace the *MountPoint belongs to.
+func (mp *MountPoint) Translate(absPath string) (string, error) {
+ relPath, err := filepath.Rel(mp.Root, absPath)
+
+ if err != nil {
+ return "", err
+ }
+ if relPath == ".." || strings.HasPrefix(relPath, "../") {
+ return "", pathNotExposedFromMountPointError{
+ mountPoint: mp.MountPoint,
+ root: mp.Root,
+ path: absPath,
+ }
+ }
+
+ return filepath.Join(mp.MountPoint, relPath), nil
+}
+
+// parseMountInfo parses procPathMountInfo (usually at `/proc/$PID/mountinfo`)
+// and yields parsed *MountPoint into newMountPoint.
+func parseMountInfo(procPathMountInfo string, newMountPoint func(*MountPoint) error) error {
+ mountInfoFile, err := os.Open(procPathMountInfo)
+ if err != nil {
+ return err
+ }
+ defer mountInfoFile.Close()
+
+ scanner := bufio.NewScanner(mountInfoFile)
+
+ for scanner.Scan() {
+ mountPoint, err := NewMountPointFromLine(scanner.Text())
+ if err != nil {
+ return err
+ }
+ if err := newMountPoint(mountPoint); err != nil {
+ return err
+ }
+ }
+
+ return scanner.Err()
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/runtime.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/runtime.go
new file mode 100644
index 000000000..b8ec7e502
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/runtime.go
@@ -0,0 +1,40 @@
+// Copyright (c) 2017 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+package automaxprocs
+
+import "math"
+
+// CPUQuotaStatus presents the status of how CPU quota is used
+type CPUQuotaStatus int
+
+const (
+ // CPUQuotaUndefined is returned when CPU quota is undefined
+ CPUQuotaUndefined CPUQuotaStatus = iota
+ // CPUQuotaUsed is returned when a valid CPU quota can be used
+ CPUQuotaUsed
+ // CPUQuotaMinUsed is returned when CPU quota is smaller than the min value
+ CPUQuotaMinUsed
+)
+
+// DefaultRoundFunc is the default function to convert CPU quota from float to int. It rounds the value down (floor).
+func DefaultRoundFunc(v float64) int {
+ return int(math.Floor(v))
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/subsys.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/subsys.go
new file mode 100644
index 000000000..881ebd590
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/subsys.go
@@ -0,0 +1,103 @@
+// Copyright (c) 2017 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+//go:build linux
+// +build linux
+
+package automaxprocs
+
+import (
+ "bufio"
+ "os"
+ "strconv"
+ "strings"
+)
+
+const (
+ _cgroupSep = ":"
+ _cgroupSubsysSep = ","
+)
+
+const (
+ _csFieldIDID = iota
+ _csFieldIDSubsystems
+ _csFieldIDName
+ _csFieldCount
+)
+
+// CGroupSubsys represents the data structure for entities in
+// `/proc/$PID/cgroup`. See also proc(5) for more information.
+type CGroupSubsys struct {
+ ID int
+ Subsystems []string
+ Name string
+}
+
+// NewCGroupSubsysFromLine returns a new *CGroupSubsys by parsing a string in
+// the format of `/proc/$PID/cgroup`
+func NewCGroupSubsysFromLine(line string) (*CGroupSubsys, error) {
+ fields := strings.SplitN(line, _cgroupSep, _csFieldCount)
+
+ if len(fields) != _csFieldCount {
+ return nil, cgroupSubsysFormatInvalidError{line}
+ }
+
+ id, err := strconv.Atoi(fields[_csFieldIDID])
+ if err != nil {
+ return nil, err
+ }
+
+ cgroup := &CGroupSubsys{
+ ID: id,
+ Subsystems: strings.Split(fields[_csFieldIDSubsystems], _cgroupSubsysSep),
+ Name: fields[_csFieldIDName],
+ }
+
+ return cgroup, nil
+}
+
+// parseCGroupSubsystems parses procPathCGroup (usually at `/proc/$PID/cgroup`)
+// and returns a new map[string]*CGroupSubsys.
+func parseCGroupSubsystems(procPathCGroup string) (map[string]*CGroupSubsys, error) {
+ cgroupFile, err := os.Open(procPathCGroup)
+ if err != nil {
+ return nil, err
+ }
+ defer cgroupFile.Close()
+
+ scanner := bufio.NewScanner(cgroupFile)
+ subsystems := make(map[string]*CGroupSubsys)
+
+ for scanner.Scan() {
+ cgroup, err := NewCGroupSubsysFromLine(scanner.Text())
+ if err != nil {
+ return nil, err
+ }
+ for _, subsys := range cgroup.Subsystems {
+ subsystems[subsys] = cgroup
+ }
+ }
+
+ if err := scanner.Err(); err != nil {
+ return nil, err
+ }
+
+ return subsystems, nil
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/build/build_command.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/build/build_command.go
index fd1726084..3021dfec2 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/build/build_command.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/build/build_command.go
@@ -29,7 +29,6 @@ func BuildBuildCommand() command.Command {
var errors []error
cliConfig, goFlagsConfig, errors = types.VetAndInitializeCLIAndGoConfig(cliConfig, goFlagsConfig)
command.AbortIfErrors("Ginkgo detected configuration issues:", errors)
-
buildSpecs(args, cliConfig, goFlagsConfig)
},
}
@@ -44,7 +43,7 @@ func buildSpecs(args []string, cliConfig types.CLIConfig, goFlagsConfig types.Go
internal.VerifyCLIAndFrameworkVersion(suites)
opc := internal.NewOrderedParallelCompiler(cliConfig.ComputedNumCompilers())
- opc.StartCompiling(suites, goFlagsConfig)
+ opc.StartCompiling(suites, goFlagsConfig, true)
for {
suiteIdx, suite := opc.Next()
@@ -55,18 +54,22 @@ func buildSpecs(args []string, cliConfig types.CLIConfig, goFlagsConfig types.Go
if suite.State.Is(internal.TestSuiteStateFailedToCompile) {
fmt.Println(suite.CompilationError.Error())
} else {
- if len(goFlagsConfig.O) == 0 {
- goFlagsConfig.O = path.Join(suite.Path, suite.PackageName+".test")
- } else {
+ var testBinPath string
+ if len(goFlagsConfig.O) != 0 {
stat, err := os.Stat(goFlagsConfig.O)
if err != nil {
panic(err)
}
if stat.IsDir() {
- goFlagsConfig.O += "/" + suite.PackageName + ".test"
+ testBinPath = goFlagsConfig.O + "/" + suite.PackageName + ".test"
+ } else {
+ testBinPath = goFlagsConfig.O
}
}
- fmt.Printf("Compiled %s\n", goFlagsConfig.O)
+ if len(testBinPath) == 0 {
+ testBinPath = path.Join(suite.Path, suite.PackageName+".test")
+ }
+ fmt.Printf("Compiled %s\n", testBinPath)
}
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/abort.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/abort.go
index 2efd28608..f0e7331f7 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/abort.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/abort.go
@@ -12,7 +12,7 @@ func Abort(details AbortDetails) {
panic(details)
}
-func AbortGracefullyWith(format string, args ...interface{}) {
+func AbortGracefullyWith(format string, args ...any) {
Abort(AbortDetails{
ExitCode: 0,
Error: fmt.Errorf(format, args...),
@@ -20,7 +20,7 @@ func AbortGracefullyWith(format string, args ...interface{}) {
})
}
-func AbortWith(format string, args ...interface{}) {
+func AbortWith(format string, args ...any) {
Abort(AbortDetails{
ExitCode: 1,
Error: fmt.Errorf(format, args...),
@@ -28,7 +28,7 @@ func AbortWith(format string, args ...interface{}) {
})
}
-func AbortWithUsage(format string, args ...interface{}) {
+func AbortWithUsage(format string, args ...any) {
Abort(AbortDetails{
ExitCode: 1,
Error: fmt.Errorf(format, args...),
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/command.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/command.go
index 12e0e5659..a30a2ecc9 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/command.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/command.go
@@ -22,9 +22,13 @@ type Command struct {
func (c Command) Run(args []string, additionalArgs []string) {
args, err := c.Flags.Parse(args)
if err != nil {
- AbortWithUsage(err.Error())
+ AbortWithUsage("%s", err.Error())
+ }
+ for _, arg := range args {
+ if len(arg) > 1 && strings.HasPrefix(arg, "-") {
+ AbortWith("%s", types.GinkgoErrors.FlagAfterPositionalParameter().Error())
+ }
}
-
c.Command(args, additionalArgs)
}
@@ -45,6 +49,6 @@ func (c Command) EmitUsage(writer io.Writer) {
}
flagUsage := c.Flags.Usage()
if flagUsage != "" {
- fmt.Fprintf(writer, formatter.F(flagUsage))
+ fmt.Fprint(writer, formatter.F(flagUsage))
}
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go
index 88dd8d6b0..c3f6d3a11 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go
@@ -68,7 +68,6 @@ func (p Program) RunAndExit(osArgs []string) {
fmt.Fprintln(p.ErrWriter, deprecationTracker.DeprecationsReport())
}
p.Exiter(exitCode)
- return
}()
args, additionalArgs := []string{}, []string{}
@@ -157,7 +156,6 @@ func (p Program) handleHelpRequestsAndExit(writer io.Writer, args []string) {
p.EmitUsage(writer)
Abort(AbortDetails{ExitCode: 1})
}
- return
}
func (p Program) EmitUsage(writer io.Writer) {
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go
index 48827cc5e..7bbe6be0f 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go
@@ -11,7 +11,7 @@ import (
"github.com/onsi/ginkgo/v2/types"
)
-func CompileSuite(suite TestSuite, goFlagsConfig types.GoFlagsConfig) TestSuite {
+func CompileSuite(suite TestSuite, goFlagsConfig types.GoFlagsConfig, preserveSymbols bool) TestSuite {
if suite.PathToCompiledTest != "" {
return suite
}
@@ -46,7 +46,7 @@ func CompileSuite(suite TestSuite, goFlagsConfig types.GoFlagsConfig) TestSuite
suite.CompilationError = fmt.Errorf("Failed to get relative path from package to the current working directory:\n%s", err.Error())
return suite
}
- args, err := types.GenerateGoTestCompileArgs(goFlagsConfig, "./", pathToInvocationPath)
+ args, err := types.GenerateGoTestCompileArgs(goFlagsConfig, "./", pathToInvocationPath, preserveSymbols)
if err != nil {
suite.State = TestSuiteStateFailedToCompile
suite.CompilationError = fmt.Errorf("Failed to generate go test compile flags:\n%s", err.Error())
@@ -120,7 +120,7 @@ func NewOrderedParallelCompiler(numCompilers int) *OrderedParallelCompiler {
}
}
-func (opc *OrderedParallelCompiler) StartCompiling(suites TestSuites, goFlagsConfig types.GoFlagsConfig) {
+func (opc *OrderedParallelCompiler) StartCompiling(suites TestSuites, goFlagsConfig types.GoFlagsConfig, preserveSymbols bool) {
opc.stopped = false
opc.idx = 0
opc.numSuites = len(suites)
@@ -135,7 +135,7 @@ func (opc *OrderedParallelCompiler) StartCompiling(suites TestSuites, goFlagsCon
stopped := opc.stopped
opc.mutex.Unlock()
if !stopped {
- suite = CompileSuite(suite, goFlagsConfig)
+ suite = CompileSuite(suite, goFlagsConfig, preserveSymbols)
}
c <- suite
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/gocovmerge.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/gocovmerge.go
index 3c5079ff4..87cfa1119 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/gocovmerge.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/gocovmerge.go
@@ -89,7 +89,7 @@ func mergeProfileBlock(p *cover.Profile, pb cover.ProfileBlock, startIndex int)
}
i := 0
- if sortFunc(i) != true {
+ if !sortFunc(i) {
i = sort.Search(len(p.Blocks)-startIndex, sortFunc)
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/profiles_and_reports.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/profiles_and_reports.go
index 8e16d2bb0..f3439a3f0 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/profiles_and_reports.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/profiles_and_reports.go
@@ -90,6 +90,9 @@ func FinalizeProfilesAndReportsForSuites(suites TestSuites, cliConfig types.CLIC
if reporterConfig.JSONReport != "" {
reportFormats = append(reportFormats, reportFormat{ReportName: reporterConfig.JSONReport, GenerateFunc: reporters.GenerateJSONReport, MergeFunc: reporters.MergeAndCleanupJSONReports})
}
+ if reporterConfig.GoJSONReport != "" {
+ reportFormats = append(reportFormats, reportFormat{ReportName: reporterConfig.GoJSONReport, GenerateFunc: reporters.GenerateGoTestJSONReport, MergeFunc: reporters.MergeAndCleanupGoTestJSONReports})
+ }
if reporterConfig.JUnitReport != "" {
reportFormats = append(reportFormats, reportFormat{ReportName: reporterConfig.JUnitReport, GenerateFunc: reporters.GenerateJUnitReport, MergeFunc: reporters.MergeAndCleanupJUnitReports})
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/run.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/run.go
index 41052ea19..68830d9ae 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/run.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/run.go
@@ -9,6 +9,7 @@ import (
"path/filepath"
"regexp"
"strings"
+ "sync/atomic"
"syscall"
"time"
@@ -107,6 +108,9 @@ func runSerial(suite TestSuite, ginkgoConfig types.SuiteConfig, reporterConfig t
if reporterConfig.JSONReport != "" {
reporterConfig.JSONReport = AbsPathForGeneratedAsset(reporterConfig.JSONReport, suite, cliConfig, 0)
}
+ if reporterConfig.GoJSONReport != "" {
+ reporterConfig.GoJSONReport = AbsPathForGeneratedAsset(reporterConfig.GoJSONReport, suite, cliConfig, 0)
+ }
if reporterConfig.JUnitReport != "" {
reporterConfig.JUnitReport = AbsPathForGeneratedAsset(reporterConfig.JUnitReport, suite, cliConfig, 0)
}
@@ -156,12 +160,15 @@ func runSerial(suite TestSuite, ginkgoConfig types.SuiteConfig, reporterConfig t
func runParallel(suite TestSuite, ginkgoConfig types.SuiteConfig, reporterConfig types.ReporterConfig, cliConfig types.CLIConfig, goFlagsConfig types.GoFlagsConfig, additionalArgs []string) TestSuite {
type procResult struct {
+ proc int
+ exitResult string
passed bool
hasProgrammaticFocus bool
}
numProcs := cliConfig.ComputedProcs()
procOutput := make([]*bytes.Buffer, numProcs)
+ procExitResult := make([]string, numProcs)
coverProfiles := []string{}
blockProfiles := []string{}
@@ -179,6 +186,9 @@ func runParallel(suite TestSuite, ginkgoConfig types.SuiteConfig, reporterConfig
if reporterConfig.JSONReport != "" {
reporterConfig.JSONReport = AbsPathForGeneratedAsset(reporterConfig.JSONReport, suite, cliConfig, 0)
}
+ if reporterConfig.GoJSONReport != "" {
+ reporterConfig.GoJSONReport = AbsPathForGeneratedAsset(reporterConfig.GoJSONReport, suite, cliConfig, 0)
+ }
if reporterConfig.JUnitReport != "" {
reporterConfig.JUnitReport = AbsPathForGeneratedAsset(reporterConfig.JUnitReport, suite, cliConfig, 0)
}
@@ -218,16 +228,20 @@ func runParallel(suite TestSuite, ginkgoConfig types.SuiteConfig, reporterConfig
args = append(args, additionalArgs...)
cmd, buf := buildAndStartCommand(suite, args, false)
+ var exited atomic.Bool
procOutput[proc-1] = buf
- server.RegisterAlive(proc, func() bool { return cmd.ProcessState == nil || !cmd.ProcessState.Exited() })
+ server.RegisterAlive(proc, func() bool { return !exited.Load() })
go func() {
cmd.Wait()
exitStatus := cmd.ProcessState.Sys().(syscall.WaitStatus).ExitStatus()
procResults <- procResult{
+ proc: proc,
+ exitResult: cmd.ProcessState.String(),
passed: (exitStatus == 0) || (exitStatus == types.GINKGO_FOCUS_EXIT_CODE),
hasProgrammaticFocus: exitStatus == types.GINKGO_FOCUS_EXIT_CODE,
}
+ exited.Store(true)
}()
}
@@ -236,6 +250,7 @@ func runParallel(suite TestSuite, ginkgoConfig types.SuiteConfig, reporterConfig
result := <-procResults
passed = passed && result.passed
suite.HasProgrammaticFocus = suite.HasProgrammaticFocus || result.hasProgrammaticFocus
+ procExitResult[result.proc-1] = result.exitResult
}
if passed {
suite.State = TestSuiteStatePassed
@@ -253,8 +268,10 @@ func runParallel(suite TestSuite, ginkgoConfig types.SuiteConfig, reporterConfig
fmt.Fprint(formatter.ColorableStdErr, formatter.Fiw(0, formatter.COLS, "This occurs if a parallel process exits before it reports its results to the Ginkgo CLI. The CLI will now print out all the stdout/stderr output it's collected from the running processes. However you may not see anything useful in these logs because the individual test processes usually intercept output to stdout/stderr in order to capture it in the spec reports.\n\nYou may want to try rerunning your test suite with {{light-gray}}--output-interceptor-mode=none{{/}} to see additional output here and debug your suite.\n"))
fmt.Fprintln(formatter.ColorableStdErr, " ")
for proc := 1; proc <= cliConfig.ComputedProcs(); proc++ {
- fmt.Fprintf(formatter.ColorableStdErr, formatter.F("{{bold}}Output from proc %d:{{/}}\n", proc))
+ fmt.Fprint(formatter.ColorableStdErr, formatter.F("{{bold}}Output from proc %d:{{/}}\n", proc))
fmt.Fprintln(os.Stderr, formatter.Fi(1, "%s", procOutput[proc-1].String()))
+ fmt.Fprint(formatter.ColorableStdErr, formatter.F("{{bold}}Exit result of proc %d:{{/}}\n", proc))
+ fmt.Fprintln(os.Stderr, formatter.Fi(1, "%s\n", procExitResult[proc-1]))
}
fmt.Fprintf(os.Stderr, "** End **")
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go
index e9abb27d8..419589b48 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go
@@ -3,7 +3,6 @@ package main
import (
"fmt"
"os"
-
"github.com/onsi/ginkgo/v2/ginkgo/build"
"github.com/onsi/ginkgo/v2/ginkgo/command"
"github.com/onsi/ginkgo/v2/ginkgo/generators"
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.go
index c2327cda8..e99d557d1 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.go
@@ -1,10 +1,13 @@
package outline
import (
+ "bytes"
+ "encoding/csv"
"encoding/json"
"fmt"
"go/ast"
"go/token"
+ "strconv"
"strings"
"golang.org/x/tools/go/ast/inspector"
@@ -84,9 +87,11 @@ func (o *outline) String() string {
// StringIndent returns a CSV-formated outline, but every line is indented by
// one 'width' of spaces for every level of nesting.
func (o *outline) StringIndent(width int) string {
- var b strings.Builder
+ var b bytes.Buffer
b.WriteString("Name,Text,Start,End,Spec,Focused,Pending,Labels\n")
+ csvWriter := csv.NewWriter(&b)
+
currentIndent := 0
pre := func(n *ginkgoNode) {
b.WriteString(fmt.Sprintf("%*s", currentIndent, ""))
@@ -96,8 +101,22 @@ func (o *outline) StringIndent(width int) string {
} else {
labels = strings.Join(n.Labels, ", ")
}
- //enclosing labels in a double quoted comma separate listed so that when inmported into a CSV app the Labels column has comma separate strings
- b.WriteString(fmt.Sprintf("%s,%s,%d,%d,%t,%t,%t,\"%s\"\n", n.Name, n.Text, n.Start, n.End, n.Spec, n.Focused, n.Pending, labels))
+
+ row := []string{
+ n.Name,
+ n.Text,
+ strconv.Itoa(n.Start),
+ strconv.Itoa(n.End),
+ strconv.FormatBool(n.Spec),
+ strconv.FormatBool(n.Focused),
+ strconv.FormatBool(n.Pending),
+ labels,
+ }
+ csvWriter.Write(row)
+
+ // Ensure we write to `b' before the next `b.WriteString()', which might be adding indentation
+ csvWriter.Flush()
+
currentIndent += width
}
post := func(n *ginkgoNode) {
@@ -106,5 +125,6 @@ func (o *outline) StringIndent(width int) string {
for _, n := range o.Nodes {
n.Walk(pre, post)
}
+
return b.String()
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go
index aaed4d570..c5091e6de 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go
@@ -33,7 +33,7 @@ func BuildRunCommand() command.Command {
Usage: "ginkgo run -- ",
ShortDoc: "Run the tests in the passed in (or the package in the current directory if left blank)",
Documentation: "Any arguments after -- will be passed to the test.",
- DocLink: "running-tests",
+ DocLink: "running-specs",
Command: func(args []string, additionalArgs []string) {
var errors []error
cliConfig, goFlagsConfig, errors = types.VetAndInitializeCLIAndGoConfig(cliConfig, goFlagsConfig)
@@ -107,7 +107,7 @@ OUTER_LOOP:
}
opc := internal.NewOrderedParallelCompiler(r.cliConfig.ComputedNumCompilers())
- opc.StartCompiling(suites, r.goFlagsConfig)
+ opc.StartCompiling(suites, r.goFlagsConfig, false)
SUITE_LOOP:
for {
@@ -142,7 +142,7 @@ OUTER_LOOP:
}
if !endTime.IsZero() {
- r.suiteConfig.Timeout = endTime.Sub(time.Now())
+ r.suiteConfig.Timeout = time.Until(endTime)
if r.suiteConfig.Timeout <= 0 {
suites[suiteIdx].State = internal.TestSuiteStateFailedDueToTimeout
opc.StopAndDrain()
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/dependencies.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/dependencies.go
index a34d94354..75cbdb496 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/dependencies.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/dependencies.go
@@ -2,12 +2,9 @@ package watch
import (
"go/build"
- "regexp"
+ "strings"
)
-var ginkgoAndGomegaFilter = regexp.MustCompile(`github\.com/onsi/ginkgo|github\.com/onsi/gomega`)
-var ginkgoIntegrationTestFilter = regexp.MustCompile(`github\.com/onsi/ginkgo/integration`) //allow us to integration test this thing
-
type Dependencies struct {
deps map[string]int
}
@@ -78,7 +75,7 @@ func (d Dependencies) resolveAndAdd(deps []string, depth int) {
if err != nil {
continue
}
- if !pkg.Goroot && (!ginkgoAndGomegaFilter.MatchString(pkg.Dir) || ginkgoIntegrationTestFilter.MatchString(pkg.Dir)) {
+ if !pkg.Goroot && (!matchesGinkgoOrGomega(pkg.Dir) || matchesGinkgoIntegration(pkg.Dir)) {
d.addDepIfNotPresent(pkg.Dir, depth)
}
}
@@ -90,3 +87,11 @@ func (d Dependencies) addDepIfNotPresent(dep string, depth int) {
d.deps[dep] = depth
}
}
+
+func matchesGinkgoOrGomega(s string) bool {
+ return strings.Contains(s, "github.com/onsi/ginkgo") || strings.Contains(s, "github.com/onsi/gomega")
+}
+
+func matchesGinkgoIntegration(s string) bool {
+ return strings.Contains(s, "github.com/onsi/ginkgo/integration") // allow us to integration test this thing
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go
index bde4193ce..fe1ca3051 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go
@@ -153,7 +153,7 @@ func (w *SpecWatcher) WatchSpecs(args []string, additionalArgs []string) {
}
func (w *SpecWatcher) compileAndRun(suite internal.TestSuite, additionalArgs []string) internal.TestSuite {
- suite = internal.CompileSuite(suite, w.goFlagsConfig)
+ suite = internal.CompileSuite(suite, w.goFlagsConfig, false)
if suite.State.Is(internal.TestSuiteStateFailedToCompile) {
fmt.Println(suite.CompilationError.Error())
return suite
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go
index 02c6739e5..40d1e1ab5 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go
@@ -1,6 +1,8 @@
package ginkgo
import (
+ "context"
+ "io"
"testing"
"github.com/onsi/ginkgo/v2/internal/testingtproxy"
@@ -48,6 +50,8 @@ The portion of the interface returned by GinkgoT() that maps onto methods in the
*/
type GinkgoTInterface interface {
Cleanup(func())
+ Chdir(dir string)
+ Context() context.Context
Setenv(kev, value string)
Error(args ...any)
Errorf(format string, args ...any)
@@ -66,6 +70,8 @@ type GinkgoTInterface interface {
Skipf(format string, args ...any)
Skipped() bool
TempDir() string
+ Attr(key, value string)
+ Output() io.Writer
}
/*
@@ -127,6 +133,12 @@ type GinkgoTBWrapper struct {
func (g *GinkgoTBWrapper) Cleanup(f func()) {
g.GinkgoT.Cleanup(f)
}
+func (g *GinkgoTBWrapper) Chdir(dir string) {
+ g.GinkgoT.Chdir(dir)
+}
+func (g *GinkgoTBWrapper) Context() context.Context {
+ return g.GinkgoT.Context()
+}
func (g *GinkgoTBWrapper) Error(args ...any) {
g.GinkgoT.Error(args...)
}
@@ -178,3 +190,9 @@ func (g *GinkgoTBWrapper) Skipped() bool {
func (g *GinkgoTBWrapper) TempDir() string {
return g.GinkgoT.TempDir()
}
+func (g *GinkgoTBWrapper) Attr(key, value string) {
+ g.GinkgoT.Attr(key, value)
+}
+func (g *GinkgoTBWrapper) Output() io.Writer {
+ return g.GinkgoT.Output()
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/around_node.go b/vendor/github.com/onsi/ginkgo/v2/internal/around_node.go
new file mode 100644
index 000000000..c96571020
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/around_node.go
@@ -0,0 +1,34 @@
+package internal
+
+import (
+ "github.com/onsi/ginkgo/v2/types"
+)
+
+func ComputeAroundNodes(specs Specs) Specs {
+ out := Specs{}
+ for _, spec := range specs {
+ nodes := Nodes{}
+ currentNestingLevel := 0
+ aroundNodes := types.AroundNodes{}
+ nestingLevelIndices := []int{}
+ for _, node := range spec.Nodes {
+ switch node.NodeType {
+ case types.NodeTypeContainer:
+ currentNestingLevel = node.NestingLevel + 1
+ nestingLevelIndices = append(nestingLevelIndices, len(aroundNodes))
+ aroundNodes = aroundNodes.Append(node.AroundNodes...)
+ nodes = append(nodes, node)
+ default:
+ if currentNestingLevel > node.NestingLevel {
+ currentNestingLevel = node.NestingLevel
+ aroundNodes = aroundNodes[:nestingLevelIndices[currentNestingLevel]]
+ }
+ node.AroundNodes = types.AroundNodes{}.Append(aroundNodes...).Append(node.AroundNodes...)
+ nodes = append(nodes, node)
+ }
+ }
+ spec.Nodes = nodes
+ out = append(out, spec)
+ }
+ return out
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/failer.go b/vendor/github.com/onsi/ginkgo/v2/internal/failer.go
index e9bd9565f..8c5de9c16 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/failer.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/failer.go
@@ -32,7 +32,7 @@ func (f *Failer) GetFailure() types.Failure {
return f.failure
}
-func (f *Failer) Panic(location types.CodeLocation, forwardedPanic interface{}) {
+func (f *Failer) Panic(location types.CodeLocation, forwardedPanic any) {
f.lock.Lock()
defer f.lock.Unlock()
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/focus.go b/vendor/github.com/onsi/ginkgo/v2/internal/focus.go
index e3da7d14d..498e707db 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/focus.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/focus.go
@@ -56,7 +56,7 @@ This function sets the `Skip` property on specs by applying Ginkgo's focus polic
*Note:* specs with pending nodes are Skipped when created by NewSpec.
*/
-func ApplyFocusToSpecs(specs Specs, description string, suiteLabels Labels, suiteConfig types.SuiteConfig) (Specs, bool) {
+func ApplyFocusToSpecs(specs Specs, description string, suiteLabels Labels, suiteSemVerConstraints SemVerConstraints, suiteComponentSemVerConstraints ComponentSemVerConstraints, suiteConfig types.SuiteConfig) (Specs, bool) {
focusString := strings.Join(suiteConfig.FocusStrings, "|")
skipString := strings.Join(suiteConfig.SkipStrings, "|")
@@ -84,6 +84,30 @@ func ApplyFocusToSpecs(specs Specs, description string, suiteLabels Labels, suit
})
}
+ if suiteConfig.SemVerFilter != "" {
+ semVerFilter, _ := types.ParseSemVerFilter(suiteConfig.SemVerFilter)
+ skipChecks = append(skipChecks, func(spec Spec) bool {
+ noRun := false
+
+ // non-component-specific constraints
+ constraints := UnionOfSemVerConstraints(suiteSemVerConstraints, spec.Nodes.UnionOfSemVerConstraints())
+ if len(constraints) != 0 && semVerFilter("", constraints) == false {
+ noRun = true
+ }
+
+ // component-specific constraints
+ componentConstraints := UnionOfComponentSemVerConstraints(suiteComponentSemVerConstraints, spec.Nodes.UnionOfComponentSemVerConstraints())
+ for component, constraints := range componentConstraints {
+ if semVerFilter(component, constraints) == false {
+ noRun = true
+ break
+ }
+ }
+
+ return noRun
+ })
+ }
+
if len(suiteConfig.FocusFiles) > 0 {
focusFilters, _ := types.ParseFileFilters(suiteConfig.FocusFiles)
skipChecks = append(skipChecks, func(spec Spec) bool { return !focusFilters.Matches(spec.Nodes.CodeLocations()) })
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/group.go b/vendor/github.com/onsi/ginkgo/v2/internal/group.go
index 02c9fe4fc..5e6611334 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/group.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/group.go
@@ -110,21 +110,56 @@ func newGroup(suite *Suite) *group {
}
}
+// initialReportForSpec constructs a new SpecReport right before running the spec.
func (g *group) initialReportForSpec(spec Spec) types.SpecReport {
return types.SpecReport{
- ContainerHierarchyTexts: spec.Nodes.WithType(types.NodeTypeContainer).Texts(),
- ContainerHierarchyLocations: spec.Nodes.WithType(types.NodeTypeContainer).CodeLocations(),
- ContainerHierarchyLabels: spec.Nodes.WithType(types.NodeTypeContainer).Labels(),
- LeafNodeLocation: spec.FirstNodeWithType(types.NodeTypeIt).CodeLocation,
- LeafNodeType: types.NodeTypeIt,
- LeafNodeText: spec.FirstNodeWithType(types.NodeTypeIt).Text,
- LeafNodeLabels: []string(spec.FirstNodeWithType(types.NodeTypeIt).Labels),
- ParallelProcess: g.suite.config.ParallelProcess,
- RunningInParallel: g.suite.isRunningInParallel(),
- IsSerial: spec.Nodes.HasNodeMarkedSerial(),
- IsInOrderedContainer: !spec.Nodes.FirstNodeMarkedOrdered().IsZero(),
- MaxFlakeAttempts: spec.Nodes.GetMaxFlakeAttempts(),
- MaxMustPassRepeatedly: spec.Nodes.GetMaxMustPassRepeatedly(),
+ ContainerHierarchyTexts: spec.Nodes.WithType(types.NodeTypeContainer).Texts(),
+ ContainerHierarchyLocations: spec.Nodes.WithType(types.NodeTypeContainer).CodeLocations(),
+ ContainerHierarchyLabels: spec.Nodes.WithType(types.NodeTypeContainer).Labels(),
+ ContainerHierarchySemVerConstraints: spec.Nodes.WithType(types.NodeTypeContainer).SemVerConstraints(),
+ ContainerHierarchyComponentSemVerConstraints: spec.Nodes.WithType(types.NodeTypeContainer).ComponentSemVerConstraints(),
+ LeafNodeLocation: spec.FirstNodeWithType(types.NodeTypeIt).CodeLocation,
+ LeafNodeType: types.NodeTypeIt,
+ LeafNodeText: spec.FirstNodeWithType(types.NodeTypeIt).Text,
+ LeafNodeLabels: []string(spec.FirstNodeWithType(types.NodeTypeIt).Labels),
+ LeafNodeSemVerConstraints: []string(spec.FirstNodeWithType(types.NodeTypeIt).SemVerConstraints),
+ LeafNodeComponentSemVerConstraints: map[string][]string(spec.FirstNodeWithType(types.NodeTypeIt).ComponentSemVerConstraints),
+ ParallelProcess: g.suite.config.ParallelProcess,
+ RunningInParallel: g.suite.isRunningInParallel(),
+ IsSerial: spec.Nodes.HasNodeMarkedSerial(),
+ IsInOrderedContainer: !spec.Nodes.FirstNodeMarkedOrdered().IsZero(),
+ MaxFlakeAttempts: spec.Nodes.GetMaxFlakeAttempts(),
+ MaxMustPassRepeatedly: spec.Nodes.GetMaxMustPassRepeatedly(),
+ SpecPriority: spec.Nodes.GetSpecPriority(),
+ }
+}
+
+// constructionNodeReportForTreeNode constructs a new SpecReport right before invoking the body
+// of a container node during construction of the full tree.
+func constructionNodeReportForTreeNode(node *TreeNode) *types.ConstructionNodeReport {
+ var report types.ConstructionNodeReport
+ // Walk up the tree and set attributes accordingly.
+ addNodeToReportForNode(&report, node)
+ return &report
+}
+
+// addNodeToReportForNode is conceptually similar to initialReportForSpec and therefore placed here
+// although it doesn't do anything with a group.
+func addNodeToReportForNode(report *types.ConstructionNodeReport, node *TreeNode) {
+ if node.Parent != nil {
+ // First add the parent node, then the current one.
+ addNodeToReportForNode(report, node.Parent)
+ }
+ report.ContainerHierarchyTexts = append(report.ContainerHierarchyTexts, node.Node.Text)
+ report.ContainerHierarchyLocations = append(report.ContainerHierarchyLocations, node.Node.CodeLocation)
+ report.ContainerHierarchyLabels = append(report.ContainerHierarchyLabels, node.Node.Labels)
+ report.ContainerHierarchySemVerConstraints = append(report.ContainerHierarchySemVerConstraints, node.Node.SemVerConstraints)
+ report.ContainerHierarchyComponentSemVerConstraints = append(report.ContainerHierarchyComponentSemVerConstraints, node.Node.ComponentSemVerConstraints)
+ if node.Node.MarkedSerial {
+ report.IsSerial = true
+ }
+ if node.Node.MarkedOrdered {
+ report.IsInOrderedContainer = true
}
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go b/vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go
index 8ed86111f..79bfa87db 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go
@@ -40,7 +40,7 @@ func (ic InterruptCause) String() string {
}
type InterruptStatus struct {
- Channel chan interface{}
+ Channel chan any
Level InterruptLevel
Cause InterruptCause
}
@@ -62,14 +62,14 @@ type InterruptHandlerInterface interface {
}
type InterruptHandler struct {
- c chan interface{}
+ c chan any
lock *sync.Mutex
level InterruptLevel
cause InterruptCause
client parallel_support.Client
- stop chan interface{}
+ stop chan any
signals []os.Signal
- requestAbortCheck chan interface{}
+ requestAbortCheck chan any
}
func NewInterruptHandler(client parallel_support.Client, signals ...os.Signal) *InterruptHandler {
@@ -77,10 +77,10 @@ func NewInterruptHandler(client parallel_support.Client, signals ...os.Signal) *
signals = []os.Signal{os.Interrupt, syscall.SIGTERM}
}
handler := &InterruptHandler{
- c: make(chan interface{}),
+ c: make(chan any),
lock: &sync.Mutex{},
- stop: make(chan interface{}),
- requestAbortCheck: make(chan interface{}),
+ stop: make(chan any),
+ requestAbortCheck: make(chan any),
client: client,
signals: signals,
}
@@ -98,9 +98,9 @@ func (handler *InterruptHandler) registerForInterrupts() {
signal.Notify(signalChannel, handler.signals...)
// cross-process abort handling
- var abortChannel chan interface{}
+ var abortChannel chan any
if handler.client != nil {
- abortChannel = make(chan interface{})
+ abortChannel = make(chan any)
go func() {
pollTicker := time.NewTicker(ABORT_POLLING_INTERVAL)
for {
@@ -125,7 +125,7 @@ func (handler *InterruptHandler) registerForInterrupts() {
}()
}
- go func(abortChannel chan interface{}) {
+ go func(abortChannel chan any) {
var interruptCause InterruptCause
for {
select {
@@ -151,7 +151,7 @@ func (handler *InterruptHandler) registerForInterrupts() {
}
if handler.level != oldLevel {
close(handler.c)
- handler.c = make(chan interface{})
+ handler.c = make(chan any)
}
handler.lock.Unlock()
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/node.go b/vendor/github.com/onsi/ginkgo/v2/internal/node.go
index 6a15f19ae..b0c8de8d6 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/node.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/node.go
@@ -4,6 +4,7 @@ import (
"context"
"fmt"
"reflect"
+ "slices"
"sort"
"sync"
"time"
@@ -46,20 +47,25 @@ type Node struct {
ReportEachBody func(SpecContext, types.SpecReport)
ReportSuiteBody func(SpecContext, types.Report)
- MarkedFocus bool
- MarkedPending bool
- MarkedSerial bool
- MarkedOrdered bool
- MarkedContinueOnFailure bool
- MarkedOncePerOrdered bool
- FlakeAttempts int
- MustPassRepeatedly int
- Labels Labels
- PollProgressAfter time.Duration
- PollProgressInterval time.Duration
- NodeTimeout time.Duration
- SpecTimeout time.Duration
- GracePeriod time.Duration
+ MarkedFocus bool
+ MarkedPending bool
+ MarkedSerial bool
+ MarkedOrdered bool
+ MarkedContinueOnFailure bool
+ MarkedOncePerOrdered bool
+ FlakeAttempts int
+ MustPassRepeatedly int
+ Labels Labels
+ SemVerConstraints SemVerConstraints
+ ComponentSemVerConstraints ComponentSemVerConstraints
+ PollProgressAfter time.Duration
+ PollProgressInterval time.Duration
+ NodeTimeout time.Duration
+ SpecTimeout time.Duration
+ GracePeriod time.Duration
+ AroundNodes types.AroundNodes
+ HasExplicitlySetSpecPriority bool
+ SpecPriority int
NodeIDWhereCleanupWasGenerated uint
}
@@ -84,35 +90,78 @@ const SuppressProgressReporting = suppressProgressReporting(true)
type FlakeAttempts uint
type MustPassRepeatedly uint
type Offset uint
-type Done chan<- interface{} // Deprecated Done Channel for asynchronous testing
-type Labels []string
+type Done chan<- any // Deprecated Done Channel for asynchronous testing
type PollProgressInterval time.Duration
type PollProgressAfter time.Duration
type NodeTimeout time.Duration
type SpecTimeout time.Duration
type GracePeriod time.Duration
+type SpecPriority int
+
+type Labels []string
func (l Labels) MatchesLabelFilter(query string) bool {
return types.MustParseLabelFilter(query)(l)
}
-func UnionOfLabels(labels ...Labels) Labels {
- out := Labels{}
- seen := map[string]bool{}
- for _, labelSet := range labels {
- for _, label := range labelSet {
- if !seen[label] {
- seen[label] = true
- out = append(out, label)
+type SemVerConstraints []string
+
+func (svc SemVerConstraints) MatchesSemVerFilter(version string) bool {
+ return types.MustParseSemVerFilter(version)("", svc)
+}
+
+type ComponentSemVerConstraints map[string][]string
+
+func (csvc ComponentSemVerConstraints) MatchesSemVerFilter(component, version string) bool {
+ for comp, constraints := range csvc {
+ if comp != component {
+ continue
+ }
+
+ input := version
+ if len(component) > 0 {
+ input = fmt.Sprintf("%s=%s", component, version)
+ }
+ return types.MustParseSemVerFilter(input)(component, constraints)
+ }
+ return false
+}
+
+func unionOf[S ~[]E, E comparable](slices ...S) S {
+ out := S{}
+ seen := map[E]bool{}
+ for _, slice := range slices {
+ for _, item := range slice {
+ if !seen[item] {
+ seen[item] = true
+ out = append(out, item)
}
}
}
return out
}
-func PartitionDecorations(args ...interface{}) ([]interface{}, []interface{}) {
- decorations := []interface{}{}
- remainingArgs := []interface{}{}
+func UnionOfLabels(labels ...Labels) Labels {
+ return unionOf(labels...)
+}
+
+func UnionOfSemVerConstraints(semVerConstraints ...SemVerConstraints) SemVerConstraints {
+ return unionOf(semVerConstraints...)
+}
+
+func UnionOfComponentSemVerConstraints(componentSemVerConstraintsSlice ...ComponentSemVerConstraints) ComponentSemVerConstraints {
+ unionComponentSemVerConstraints := ComponentSemVerConstraints{}
+ for _, componentSemVerConstraints := range componentSemVerConstraintsSlice {
+ for component, constraints := range componentSemVerConstraints {
+ unionComponentSemVerConstraints[component] = unionOf(unionComponentSemVerConstraints[component], constraints)
+ }
+ }
+ return unionComponentSemVerConstraints
+}
+
+func PartitionDecorations(args ...any) ([]any, []any) {
+ decorations := []any{}
+ remainingArgs := []any{}
for _, arg := range args {
if isDecoration(arg) {
decorations = append(decorations, arg)
@@ -123,7 +172,7 @@ func PartitionDecorations(args ...interface{}) ([]interface{}, []interface{}) {
return decorations, remainingArgs
}
-func isDecoration(arg interface{}) bool {
+func isDecoration(arg any) bool {
switch t := reflect.TypeOf(arg); {
case t == nil:
return false
@@ -151,6 +200,10 @@ func isDecoration(arg interface{}) bool {
return true
case t == reflect.TypeOf(Labels{}):
return true
+ case t == reflect.TypeOf(SemVerConstraints{}):
+ return true
+ case t == reflect.TypeOf(ComponentSemVerConstraints{}):
+ return true
case t == reflect.TypeOf(PollProgressInterval(0)):
return true
case t == reflect.TypeOf(PollProgressAfter(0)):
@@ -161,6 +214,10 @@ func isDecoration(arg interface{}) bool {
return true
case t == reflect.TypeOf(GracePeriod(0)):
return true
+ case t == reflect.TypeOf(types.AroundNodeDecorator{}):
+ return true
+ case t == reflect.TypeOf(SpecPriority(0)):
+ return true
case t.Kind() == reflect.Slice && isSliceOfDecorations(arg):
return true
default:
@@ -168,7 +225,7 @@ func isDecoration(arg interface{}) bool {
}
}
-func isSliceOfDecorations(slice interface{}) bool {
+func isSliceOfDecorations(slice any) bool {
vSlice := reflect.ValueOf(slice)
if vSlice.Len() == 0 {
return false
@@ -184,18 +241,20 @@ func isSliceOfDecorations(slice interface{}) bool {
var contextType = reflect.TypeOf(new(context.Context)).Elem()
var specContextType = reflect.TypeOf(new(SpecContext)).Elem()
-func NewNode(deprecationTracker *types.DeprecationTracker, nodeType types.NodeType, text string, args ...interface{}) (Node, []error) {
+func NewNode(deprecationTracker *types.DeprecationTracker, nodeType types.NodeType, text string, args ...any) (Node, []error) {
baseOffset := 2
node := Node{
- ID: UniqueNodeID(),
- NodeType: nodeType,
- Text: text,
- Labels: Labels{},
- CodeLocation: types.NewCodeLocation(baseOffset),
- NestingLevel: -1,
- PollProgressAfter: -1,
- PollProgressInterval: -1,
- GracePeriod: -1,
+ ID: UniqueNodeID(),
+ NodeType: nodeType,
+ Text: text,
+ Labels: Labels{},
+ SemVerConstraints: SemVerConstraints{},
+ ComponentSemVerConstraints: ComponentSemVerConstraints{},
+ CodeLocation: types.NewCodeLocation(baseOffset),
+ NestingLevel: -1,
+ PollProgressAfter: -1,
+ PollProgressInterval: -1,
+ GracePeriod: -1,
}
errors := []error{}
@@ -205,9 +264,9 @@ func NewNode(deprecationTracker *types.DeprecationTracker, nodeType types.NodeTy
}
}
- args = unrollInterfaceSlice(args)
+ args = UnrollInterfaceSlice(args)
- remainingArgs := []interface{}{}
+ remainingArgs := []any{}
// First get the CodeLocation up-to-date
for _, arg := range args {
switch v := arg.(type) {
@@ -221,9 +280,10 @@ func NewNode(deprecationTracker *types.DeprecationTracker, nodeType types.NodeTy
}
labelsSeen := map[string]bool{}
+ semVerConstraintsSeen := map[string]bool{}
trackedFunctionError := false
args = remainingArgs
- remainingArgs = []interface{}{}
+ remainingArgs = []any{}
// now process the rest of the args
for _, arg := range args {
switch t := reflect.TypeOf(arg); {
@@ -241,6 +301,9 @@ func NewNode(deprecationTracker *types.DeprecationTracker, nodeType types.NodeTy
}
case t == reflect.TypeOf(Serial):
node.MarkedSerial = bool(arg.(serialType))
+ if !labelsSeen["Serial"] {
+ node.Labels = append(node.Labels, "Serial")
+ }
if !nodeType.Is(types.NodeTypesForContainerAndIt) {
appendError(types.GinkgoErrors.InvalidDecoratorForNodeType(node.CodeLocation, nodeType, "Serial"))
}
@@ -296,6 +359,14 @@ func NewNode(deprecationTracker *types.DeprecationTracker, nodeType types.NodeTy
if nodeType.Is(types.NodeTypeContainer) {
appendError(types.GinkgoErrors.InvalidDecoratorForNodeType(node.CodeLocation, nodeType, "GracePeriod"))
}
+ case t == reflect.TypeOf(SpecPriority(0)):
+ if !nodeType.Is(types.NodeTypesForContainerAndIt) {
+ appendError(types.GinkgoErrors.InvalidDecoratorForNodeType(node.CodeLocation, nodeType, "SpecPriority"))
+ }
+ node.SpecPriority = int(arg.(SpecPriority))
+ node.HasExplicitlySetSpecPriority = true
+ case t == reflect.TypeOf(types.AroundNodeDecorator{}):
+ node.AroundNodes = append(node.AroundNodes, arg.(types.AroundNodeDecorator))
case t == reflect.TypeOf(Labels{}):
if !nodeType.Is(types.NodeTypesForContainerAndIt) {
appendError(types.GinkgoErrors.InvalidDecoratorForNodeType(node.CodeLocation, nodeType, "Label"))
@@ -308,6 +379,48 @@ func NewNode(deprecationTracker *types.DeprecationTracker, nodeType types.NodeTy
appendError(err)
}
}
+ case t == reflect.TypeOf(SemVerConstraints{}):
+ if !nodeType.Is(types.NodeTypesForContainerAndIt) {
+ appendError(types.GinkgoErrors.InvalidDecoratorForNodeType(node.CodeLocation, nodeType, "SemVerConstraint"))
+ }
+ for _, semVerConstraint := range arg.(SemVerConstraints) {
+ if !semVerConstraintsSeen[semVerConstraint] {
+ semVerConstraintsSeen[semVerConstraint] = true
+ semVerConstraint, err := types.ValidateAndCleanupSemVerConstraint(semVerConstraint, node.CodeLocation)
+ node.SemVerConstraints = append(node.SemVerConstraints, semVerConstraint)
+ appendError(err)
+ }
+ }
+ case t == reflect.TypeOf(ComponentSemVerConstraints{}):
+ if !nodeType.Is(types.NodeTypesForContainerAndIt) {
+ appendError(types.GinkgoErrors.InvalidDecoratorForNodeType(node.CodeLocation, nodeType, "ComponentSemVerConstraint"))
+ }
+ for component, semVerConstraints := range arg.(ComponentSemVerConstraints) {
+ // while using ComponentSemVerConstraints, we should not allow empty component names.
+ // you should use SemVerConstraints for that.
+ hasErr := false
+ if len(component) == 0 {
+ appendError(types.GinkgoErrors.InvalidEmptyComponentForSemVerConstraint(node.CodeLocation))
+ hasErr = true
+ }
+ for _, semVerConstraint := range semVerConstraints {
+ _, err := types.ValidateAndCleanupSemVerConstraint(semVerConstraint, node.CodeLocation)
+ if err != nil {
+ appendError(err)
+ hasErr = true
+ }
+ }
+
+ if !hasErr {
+ // merge constraints if the component already exists
+ constraints := slices.Clone(semVerConstraints)
+ if existingConstraints, exists := node.ComponentSemVerConstraints[component]; exists {
+ constraints = UnionOfSemVerConstraints([]string(existingConstraints), constraints)
+ }
+
+ node.ComponentSemVerConstraints[component] = slices.Clone(constraints)
+ }
+ }
case t.Kind() == reflect.Func:
if nodeType.Is(types.NodeTypeContainer) {
if node.Body != nil {
@@ -448,7 +561,7 @@ func NewNode(deprecationTracker *types.DeprecationTracker, nodeType types.NodeTy
var doneType = reflect.TypeOf(make(Done))
-func extractBodyFunction(deprecationTracker *types.DeprecationTracker, cl types.CodeLocation, arg interface{}) (func(SpecContext), bool) {
+func extractBodyFunction(deprecationTracker *types.DeprecationTracker, cl types.CodeLocation, arg any) (func(SpecContext), bool) {
t := reflect.TypeOf(arg)
if t.NumOut() > 0 || t.NumIn() > 1 {
return nil, false
@@ -474,7 +587,7 @@ func extractBodyFunction(deprecationTracker *types.DeprecationTracker, cl types.
var byteType = reflect.TypeOf([]byte{})
-func extractSynchronizedBeforeSuiteProc1Body(arg interface{}) (func(SpecContext) []byte, bool) {
+func extractSynchronizedBeforeSuiteProc1Body(arg any) (func(SpecContext) []byte, bool) {
t := reflect.TypeOf(arg)
v := reflect.ValueOf(arg)
@@ -502,7 +615,7 @@ func extractSynchronizedBeforeSuiteProc1Body(arg interface{}) (func(SpecContext)
}, hasContext
}
-func extractSynchronizedBeforeSuiteAllProcsBody(arg interface{}) (func(SpecContext, []byte), bool) {
+func extractSynchronizedBeforeSuiteAllProcsBody(arg any) (func(SpecContext, []byte), bool) {
t := reflect.TypeOf(arg)
v := reflect.ValueOf(arg)
hasContext, hasByte := false, false
@@ -533,11 +646,11 @@ func extractSynchronizedBeforeSuiteAllProcsBody(arg interface{}) (func(SpecConte
var errInterface = reflect.TypeOf((*error)(nil)).Elem()
-func NewCleanupNode(deprecationTracker *types.DeprecationTracker, fail func(string, types.CodeLocation), args ...interface{}) (Node, []error) {
+func NewCleanupNode(deprecationTracker *types.DeprecationTracker, fail func(string, types.CodeLocation), args ...any) (Node, []error) {
decorations, remainingArgs := PartitionDecorations(args...)
baseOffset := 2
cl := types.NewCodeLocation(baseOffset)
- finalArgs := []interface{}{}
+ finalArgs := []any{}
for _, arg := range decorations {
switch t := reflect.TypeOf(arg); {
case t == reflect.TypeOf(Offset(0)):
@@ -596,7 +709,7 @@ func NewCleanupNode(deprecationTracker *types.DeprecationTracker, fail func(stri
})
}
- return NewNode(deprecationTracker, types.NodeTypeCleanupInvalid, "", finalArgs...)
+ return NewNode(deprecationTracker, types.NodeTypeCleanupInvalid, "", finalArgs)
}
func (n Node) IsZero() bool {
@@ -821,6 +934,60 @@ func (n Nodes) UnionOfLabels() []string {
return out
}
+func (n Nodes) SemVerConstraints() [][]string {
+ out := make([][]string, len(n))
+ for i := range n {
+ if n[i].SemVerConstraints == nil {
+ out[i] = []string{}
+ } else {
+ out[i] = []string(n[i].SemVerConstraints)
+ }
+ }
+ return out
+}
+
+func (n Nodes) UnionOfSemVerConstraints() []string {
+ out := []string{}
+ seen := map[string]bool{}
+ for i := range n {
+ for _, constraint := range n[i].SemVerConstraints {
+ if !seen[constraint] {
+ seen[constraint] = true
+ out = append(out, constraint)
+ }
+ }
+ }
+ return out
+}
+
+func (n Nodes) ComponentSemVerConstraints() []map[string][]string {
+ out := make([]map[string][]string, len(n))
+ for i := range n {
+ if n[i].ComponentSemVerConstraints == nil {
+ out[i] = map[string][]string{}
+ } else {
+ out[i] = map[string][]string(n[i].ComponentSemVerConstraints)
+ }
+ }
+ return out
+}
+
+func (n Nodes) UnionOfComponentSemVerConstraints() map[string][]string {
+ out := map[string][]string{}
+ seen := map[string]bool{}
+ for i := range n {
+ for component := range n[i].ComponentSemVerConstraints {
+ if !seen[component] {
+ seen[component] = true
+ out[component] = n[i].ComponentSemVerConstraints[component]
+ } else {
+ out[component] = UnionOfSemVerConstraints(out[component], n[i].ComponentSemVerConstraints[component])
+ }
+ }
+ }
+ return out
+}
+
func (n Nodes) CodeLocations() []types.CodeLocation {
out := make([]types.CodeLocation, len(n))
for i := range n {
@@ -917,19 +1084,84 @@ func (n Nodes) GetMaxMustPassRepeatedly() int {
return maxMustPassRepeatedly
}
-func unrollInterfaceSlice(args interface{}) []interface{} {
+func (n Nodes) GetSpecPriority() int {
+ for i := len(n) - 1; i >= 0; i-- {
+ if n[i].HasExplicitlySetSpecPriority {
+ return n[i].SpecPriority
+ }
+ }
+ return 0
+}
+
+func UnrollInterfaceSlice(args any) []any {
v := reflect.ValueOf(args)
if v.Kind() != reflect.Slice {
- return []interface{}{args}
+ return []any{args}
}
- out := []interface{}{}
+ out := []any{}
for i := 0; i < v.Len(); i++ {
el := reflect.ValueOf(v.Index(i).Interface())
- if el.Kind() == reflect.Slice && el.Type() != reflect.TypeOf(Labels{}) {
- out = append(out, unrollInterfaceSlice(el.Interface())...)
+ if el.Kind() == reflect.Slice && el.Type() != reflect.TypeOf(Labels{}) && el.Type() != reflect.TypeOf(SemVerConstraints{}) {
+ out = append(out, UnrollInterfaceSlice(el.Interface())...)
} else {
out = append(out, v.Index(i).Interface())
}
}
return out
}
+
+type NodeArgsTransformer func(nodeType types.NodeType, offset Offset, text string, args []any) (string, []any, []error)
+
+func AddTreeConstructionNodeArgsTransformer(transformer NodeArgsTransformer) func() {
+ id := nodeArgsTransformerCounter
+ nodeArgsTransformerCounter++
+ nodeArgsTransformers = append(nodeArgsTransformers, registeredNodeArgsTransformer{id, transformer})
+ return func() {
+ nodeArgsTransformers = slices.DeleteFunc(nodeArgsTransformers, func(transformer registeredNodeArgsTransformer) bool {
+ return transformer.id == id
+ })
+ }
+}
+
+var (
+ nodeArgsTransformerCounter int64
+ nodeArgsTransformers []registeredNodeArgsTransformer
+)
+
+type registeredNodeArgsTransformer struct {
+ id int64
+ transformer NodeArgsTransformer
+}
+
+// TransformNewNodeArgs is the helper for DSL functions which handles NodeArgsTransformers.
+//
+// Its return valus are intentionally the same as the internal.NewNode parameters,
+// which makes it possible to chain the invocations:
+//
+// NewNode(transformNewNodeArgs(...))
+func TransformNewNodeArgs(exitIfErrors func([]error), deprecationTracker *types.DeprecationTracker, nodeType types.NodeType, text string, args ...any) (*types.DeprecationTracker, types.NodeType, string, []any) {
+ var errs []error
+
+ // Most recent first...
+ //
+ // This intentionally doesn't use slices.Backward because
+ // using iterators influences stack unwinding.
+ for i := len(nodeArgsTransformers) - 1; i >= 0; i-- {
+ transformer := nodeArgsTransformers[i].transformer
+ args = UnrollInterfaceSlice(args)
+
+ // We do not really need to recompute this on additional loop iterations,
+ // but its fast and simpler this way.
+ var offset Offset
+ for _, arg := range args {
+ if o, ok := arg.(Offset); ok {
+ offset = o
+ }
+ }
+ offset += 3 // The DSL function, this helper, and the TransformNodeArgs implementation.
+
+ text, args, errs = transformer(nodeType, offset, text, args)
+ exitIfErrors(errs)
+ }
+ return deprecationTracker, nodeType, text, args
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/ordering.go b/vendor/github.com/onsi/ginkgo/v2/internal/ordering.go
index 84eea0a59..da58d54f9 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/ordering.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/ordering.go
@@ -125,7 +125,7 @@ func OrderSpecs(specs Specs, suiteConfig types.SuiteConfig) (GroupedSpecIndices,
// pick out a representative spec
representativeSpec := specs[executionGroups[groupID][0]]
- // and grab the node on the spec that will represent which shufflable group this execution group belongs tu
+ // and grab the node on the spec that will represent which shufflable group this execution group belongs to
shufflableGroupingNode := representativeSpec.Nodes.FirstNodeWithType(nodeTypesToShuffle)
//add the execution group to its shufflable group
@@ -138,14 +138,35 @@ func OrderSpecs(specs Specs, suiteConfig types.SuiteConfig) (GroupedSpecIndices,
}
}
+ // now, for each shuffleable group, we compute the priority
+ shufflableGroupingIDPriorities := map[uint]int{}
+ for shufflableGroupingID, groupIDs := range shufflableGroupingIDToGroupIDs {
+ // the priority of a shufflable grouping is the max priority of any spec in any execution group in the shufflable grouping
+ maxPriority := -1 << 31 // min int
+ for _, groupID := range groupIDs {
+ for _, specIdx := range executionGroups[groupID] {
+ specPriority := specs[specIdx].Nodes.GetSpecPriority()
+ maxPriority = max(specPriority, maxPriority)
+ }
+ }
+ shufflableGroupingIDPriorities[shufflableGroupingID] = maxPriority
+ }
+
// now we permute the sorted shufflable grouping IDs and build the ordered Groups
- orderedGroups := GroupedSpecIndices{}
permutation := r.Perm(len(shufflableGroupingIDs))
- for _, j := range permutation {
- //let's get the execution group IDs for this shufflable group:
- executionGroupIDsForJ := shufflableGroupingIDToGroupIDs[shufflableGroupingIDs[j]]
- // and we'll add their associated specindices to the orderedGroups slice:
- for _, executionGroupID := range executionGroupIDsForJ {
+ shuffledGroupingIds := make([]uint, len(shufflableGroupingIDs))
+ for i, j := range permutation {
+ shuffledGroupingIds[i] = shufflableGroupingIDs[j]
+ }
+ // now, we need to stable sort the shuffledGroupingIds by priority (higher priority first)
+ sort.SliceStable(shuffledGroupingIds, func(i, j int) bool {
+ return shufflableGroupingIDPriorities[shuffledGroupingIds[i]] > shufflableGroupingIDPriorities[shuffledGroupingIds[j]]
+ })
+
+ // we can now take these prioritized, shuffled, groupings and form the final set of ordered spec groups
+ orderedGroups := GroupedSpecIndices{}
+ for _, id := range shuffledGroupingIds {
+ for _, executionGroupID := range shufflableGroupingIDToGroupIDs[id] {
orderedGroups = append(orderedGroups, executionGroups[executionGroupID])
}
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor.go b/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor.go
index 4a1c09461..5598f15cb 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor.go
@@ -69,7 +69,7 @@ type pipePair struct {
writer *os.File
}
-func startPipeFactory(pipeChannel chan pipePair, shutdown chan interface{}) {
+func startPipeFactory(pipeChannel chan pipePair, shutdown chan any) {
for {
//make the next pipe...
pair := pipePair{}
@@ -101,8 +101,8 @@ type genericOutputInterceptor struct {
stderrClone *os.File
pipe pipePair
- shutdown chan interface{}
- emergencyBailout chan interface{}
+ shutdown chan any
+ emergencyBailout chan any
pipeChannel chan pipePair
interceptedContent chan string
@@ -139,7 +139,7 @@ func (interceptor *genericOutputInterceptor) ResumeIntercepting() {
interceptor.intercepting = true
if interceptor.stdoutClone == nil {
interceptor.stdoutClone, interceptor.stderrClone = interceptor.implementation.CreateStdoutStderrClones()
- interceptor.shutdown = make(chan interface{})
+ interceptor.shutdown = make(chan any)
go startPipeFactory(interceptor.pipeChannel, interceptor.shutdown)
}
@@ -147,13 +147,13 @@ func (interceptor *genericOutputInterceptor) ResumeIntercepting() {
// we get the pipe from our pipe factory. it runs in the background so we can request the next pipe while the spec being intercepted is running
interceptor.pipe = <-interceptor.pipeChannel
- interceptor.emergencyBailout = make(chan interface{})
+ interceptor.emergencyBailout = make(chan any)
//Spin up a goroutine to copy data from the pipe into a buffer, this is how we capture any output the user is emitting
go func() {
buffer := &bytes.Buffer{}
destination := io.MultiWriter(buffer, interceptor.forwardTo)
- copyFinished := make(chan interface{})
+ copyFinished := make(chan any)
reader := interceptor.pipe.reader
go func() {
io.Copy(destination, reader)
@@ -224,7 +224,7 @@ func NewOSGlobalReassigningOutputInterceptor() OutputInterceptor {
return &genericOutputInterceptor{
interceptedContent: make(chan string),
pipeChannel: make(chan pipePair),
- shutdown: make(chan interface{}),
+ shutdown: make(chan any),
implementation: &osGlobalReassigningOutputInterceptorImpl{},
}
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go b/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go
index 8a237f446..319278ded 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go
@@ -9,11 +9,29 @@ import (
"golang.org/x/sys/unix"
)
+// dupStdout creates a clone of stdout's file descriptor that can be used
+// to write to the original terminal even after stdout has been redirected.
+// Returns nil if the clone cannot be created.
+func dupStdout() *os.File {
+ stdoutCloneFD, err := unix.Dup(1)
+ if err != nil {
+ return nil
+ }
+
+ // Set FD_CLOEXEC to prevent leaking into child processes
+ flags, err := unix.FcntlInt(uintptr(stdoutCloneFD), unix.F_GETFD, 0)
+ if err == nil {
+ unix.FcntlInt(uintptr(stdoutCloneFD), unix.F_SETFD, flags|unix.FD_CLOEXEC)
+ }
+
+ return os.NewFile(uintptr(stdoutCloneFD), "stdout-clone-for-forwarding")
+}
+
func NewOutputInterceptor() OutputInterceptor {
return &genericOutputInterceptor{
interceptedContent: make(chan string),
pipeChannel: make(chan pipePair),
- shutdown: make(chan interface{}),
+ shutdown: make(chan any),
implementation: &dupSyscallOutputInterceptorImpl{},
}
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_wasm.go b/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_wasm.go
index 4c374935b..3cffcb534 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_wasm.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_wasm.go
@@ -2,6 +2,13 @@
package internal
+import "os"
+
+// dupStdout returns nil on WASM since output interception is not supported.
+func dupStdout() *os.File {
+ return nil
+}
+
func NewOutputInterceptor() OutputInterceptor {
return &NoopOutputInterceptor{}
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_win.go b/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_win.go
index 30c2851a8..710cbe04a 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_win.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_win.go
@@ -2,6 +2,15 @@
package internal
+import "os"
+
+// dupStdout returns the current os.Stdout. On Windows, the output interceptor
+// uses osGlobalReassigning which only changes the Go variable, so capturing
+// the current os.Stdout before interception starts is sufficient.
+func dupStdout() *os.File {
+ return os.Stdout
+}
+
func NewOutputInterceptor() OutputInterceptor {
return NewOSGlobalReassigningOutputInterceptor()
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/client_server.go b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/client_server.go
index b3cd64292..4234d802c 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/client_server.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/client_server.go
@@ -30,7 +30,7 @@ type Server interface {
Close()
Address() string
RegisterAlive(node int, alive func() bool)
- GetSuiteDone() chan interface{}
+ GetSuiteDone() chan any
GetOutputDestination() io.Writer
SetOutputDestination(io.Writer)
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_client.go b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_client.go
index 6547c7a66..4aa10ae4f 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_client.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_client.go
@@ -34,7 +34,7 @@ func (client *httpClient) Close() error {
return nil
}
-func (client *httpClient) post(path string, data interface{}) error {
+func (client *httpClient) post(path string, data any) error {
var body io.Reader
if data != nil {
encoded, err := json.Marshal(data)
@@ -54,7 +54,7 @@ func (client *httpClient) post(path string, data interface{}) error {
return nil
}
-func (client *httpClient) poll(path string, data interface{}) error {
+func (client *httpClient) poll(path string, data any) error {
for {
resp, err := http.Get(client.serverHost + path)
if err != nil {
@@ -153,10 +153,7 @@ func (client *httpClient) PostAbort() error {
func (client *httpClient) ShouldAbort() bool {
err := client.poll("/abort", nil)
- if err == ErrorGone {
- return true
- }
- return false
+ return err == ErrorGone
}
func (client *httpClient) Write(p []byte) (int, error) {
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_server.go b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_server.go
index d2c71ab1b..8a1b7a5bb 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_server.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_server.go
@@ -75,7 +75,7 @@ func (server *httpServer) Address() string {
return "http://" + server.listener.Addr().String()
}
-func (server *httpServer) GetSuiteDone() chan interface{} {
+func (server *httpServer) GetSuiteDone() chan any {
return server.handler.done
}
@@ -96,7 +96,7 @@ func (server *httpServer) RegisterAlive(node int, alive func() bool) {
//
// The server will forward all received messages to Ginkgo reporters registered with `RegisterReporters`
-func (server *httpServer) decode(writer http.ResponseWriter, request *http.Request, object interface{}) bool {
+func (server *httpServer) decode(writer http.ResponseWriter, request *http.Request, object any) bool {
defer request.Body.Close()
if json.NewDecoder(request.Body).Decode(object) != nil {
writer.WriteHeader(http.StatusBadRequest)
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_client.go b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_client.go
index 59e8e6fd0..bb4675a02 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_client.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_client.go
@@ -35,7 +35,7 @@ func (client *rpcClient) Close() error {
return client.client.Close()
}
-func (client *rpcClient) poll(method string, data interface{}) error {
+func (client *rpcClient) poll(method string, data any) error {
for {
err := client.client.Call(method, voidSender, data)
if err == nil {
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_server.go b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_server.go
index 2620fd562..1574f99ac 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_server.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_server.go
@@ -25,7 +25,7 @@ type RPCServer struct {
handler *ServerHandler
}
-//Create a new server, automatically selecting a port
+// Create a new server, automatically selecting a port
func newRPCServer(parallelTotal int, reporter reporters.Reporter) (*RPCServer, error) {
listener, err := net.Listen("tcp", "127.0.0.1:0")
if err != nil {
@@ -37,7 +37,7 @@ func newRPCServer(parallelTotal int, reporter reporters.Reporter) (*RPCServer, e
}, nil
}
-//Start the server. You don't need to `go s.Start()`, just `s.Start()`
+// Start the server. You don't need to `go s.Start()`, just `s.Start()`
func (server *RPCServer) Start() {
rpcServer := rpc.NewServer()
rpcServer.RegisterName("Server", server.handler) //register the handler's methods as the server
@@ -48,17 +48,17 @@ func (server *RPCServer) Start() {
go httpServer.Serve(server.listener)
}
-//Stop the server
+// Stop the server
func (server *RPCServer) Close() {
server.listener.Close()
}
-//The address the server can be reached it. Pass this into the `ForwardingReporter`.
+// The address the server can be reached it. Pass this into the `ForwardingReporter`.
func (server *RPCServer) Address() string {
return server.listener.Addr().String()
}
-func (server *RPCServer) GetSuiteDone() chan interface{} {
+func (server *RPCServer) GetSuiteDone() chan any {
return server.handler.done
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/server_handler.go b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/server_handler.go
index a6d98793e..ab9e11372 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/server_handler.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/server_handler.go
@@ -18,7 +18,7 @@ var voidSender Void
// It handles all the business logic to avoid duplication between the two servers
type ServerHandler struct {
- done chan interface{}
+ done chan any
outputDestination io.Writer
reporter reporters.Reporter
alives []func() bool
@@ -46,7 +46,7 @@ func newServerHandler(parallelTotal int, reporter reporters.Reporter) *ServerHan
parallelTotal: parallelTotal,
outputDestination: os.Stdout,
- done: make(chan interface{}),
+ done: make(chan any),
}
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/progress_report.go b/vendor/github.com/onsi/ginkgo/v2/internal/progress_report.go
index 11269cf1f..165cbc4b6 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/progress_report.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/progress_report.go
@@ -236,7 +236,7 @@ func extractRunningGoroutines() ([]types.Goroutine, error) {
}
functionCall.Filename = line[:delimiterIdx]
line = strings.Split(line[delimiterIdx+1:], " ")[0]
- lineNumber, err := strconv.ParseInt(line, 10, 64)
+ lineNumber, err := strconv.ParseInt(line, 10, 32)
functionCall.Line = int(lineNumber)
if err != nil {
return nil, types.GinkgoErrors.FailedToParseStackTrace(fmt.Sprintf("Invalid function call line number: %s\n%s", line, err.Error()))
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/report_entry.go b/vendor/github.com/onsi/ginkgo/v2/internal/report_entry.go
index cc351a39b..9c18dc8e5 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/report_entry.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/report_entry.go
@@ -8,7 +8,7 @@ import (
type ReportEntry = types.ReportEntry
-func NewReportEntry(name string, cl types.CodeLocation, args ...interface{}) (ReportEntry, error) {
+func NewReportEntry(name string, cl types.CodeLocation, args ...any) (ReportEntry, error) {
out := ReportEntry{
Visibility: types.ReportEntryVisibilityAlways,
Name: name,
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson.go b/vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson.go
new file mode 100644
index 000000000..751543ea7
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson.go
@@ -0,0 +1,171 @@
+package reporters
+
+import (
+ "errors"
+ "fmt"
+ "strings"
+ "time"
+
+ "github.com/onsi/ginkgo/v2/types"
+ "golang.org/x/tools/go/packages"
+)
+
+func ptr[T any](in T) *T {
+ return &in
+}
+
+type encoder interface {
+ Encode(v any) error
+}
+
+// gojsonEvent matches the format from go internals
+// https://github.com/golang/go/blob/master/src/cmd/internal/test2json/test2json.go#L31-L41
+// https://pkg.go.dev/cmd/test2json
+type gojsonEvent struct {
+ Time *time.Time `json:",omitempty"`
+ Action GoJSONAction
+ Package string `json:",omitempty"`
+ Test string `json:",omitempty"`
+ Elapsed *float64 `json:",omitempty"`
+ Output *string `json:",omitempty"`
+ FailedBuild string `json:",omitempty"`
+}
+
+type GoJSONAction string
+
+const (
+ // start - the test binary is about to be executed
+ GoJSONStart GoJSONAction = "start"
+ // run - the test has started running
+ GoJSONRun GoJSONAction = "run"
+ // pause - the test has been paused
+ GoJSONPause GoJSONAction = "pause"
+ // cont - the test has continued running
+ GoJSONCont GoJSONAction = "cont"
+ // pass - the test passed
+ GoJSONPass GoJSONAction = "pass"
+ // bench - the benchmark printed log output but did not fail
+ GoJSONBench GoJSONAction = "bench"
+ // fail - the test or benchmark failed
+ GoJSONFail GoJSONAction = "fail"
+ // output - the test printed output
+ GoJSONOutput GoJSONAction = "output"
+ // skip - the test was skipped or the package contained no tests
+ GoJSONSkip GoJSONAction = "skip"
+)
+
+func goJSONActionFromSpecState(state types.SpecState) GoJSONAction {
+ switch state {
+ case types.SpecStateInvalid:
+ return GoJSONFail
+ case types.SpecStatePending:
+ return GoJSONSkip
+ case types.SpecStateSkipped:
+ return GoJSONSkip
+ case types.SpecStatePassed:
+ return GoJSONPass
+ case types.SpecStateFailed:
+ return GoJSONFail
+ case types.SpecStateAborted:
+ return GoJSONFail
+ case types.SpecStatePanicked:
+ return GoJSONFail
+ case types.SpecStateInterrupted:
+ return GoJSONFail
+ case types.SpecStateTimedout:
+ return GoJSONFail
+ default:
+ panic("unexpected state should not happen")
+ }
+}
+
+// gojsonReport wraps types.Report and calcualtes extra fields requires by gojson
+type gojsonReport struct {
+ o types.Report
+ // Extra calculated fields
+ goPkg string
+ elapsed float64
+}
+
+func newReport(in types.Report) *gojsonReport {
+ return &gojsonReport{
+ o: in,
+ }
+}
+
+func (r *gojsonReport) Fill() error {
+ // NOTE: could the types.Report include the go package name?
+ goPkg, err := suitePathToPkg(r.o.SuitePath)
+ if err != nil {
+ return err
+ }
+ r.goPkg = goPkg
+ r.elapsed = r.o.RunTime.Seconds()
+ return nil
+}
+
+// gojsonSpecReport wraps types.SpecReport and calculates extra fields required by gojson
+type gojsonSpecReport struct {
+ o types.SpecReport
+ // extra calculated fields
+ testName string
+ elapsed float64
+ action GoJSONAction
+}
+
+func newSpecReport(in types.SpecReport) *gojsonSpecReport {
+ return &gojsonSpecReport{
+ o: in,
+ }
+}
+
+func (sr *gojsonSpecReport) Fill() error {
+ sr.elapsed = sr.o.RunTime.Seconds()
+ sr.testName = createTestName(sr.o)
+ sr.action = goJSONActionFromSpecState(sr.o.State)
+ return nil
+}
+
+func suitePathToPkg(dir string) (string, error) {
+ cfg := &packages.Config{
+ Mode: packages.NeedFiles | packages.NeedSyntax,
+ }
+ pkgs, err := packages.Load(cfg, dir)
+ if err != nil {
+ return "", err
+ }
+ if len(pkgs) != 1 {
+ return "", errors.New("error")
+ }
+ return pkgs[0].ID, nil
+}
+
+func createTestName(spec types.SpecReport) string {
+ name := fmt.Sprintf("[%s]", spec.LeafNodeType)
+ if spec.FullText() != "" {
+ name = name + " " + spec.FullText()
+ }
+ labels := spec.Labels()
+ if len(labels) > 0 {
+ name = name + " [" + strings.Join(labels, ", ") + "]"
+ }
+ semVerConstraints := spec.SemVerConstraints()
+ if len(semVerConstraints) > 0 {
+ name = name + " [" + strings.Join(semVerConstraints, ", ") + "]"
+ }
+ componentSemVerConstraints := spec.ComponentSemVerConstraints()
+ if len(componentSemVerConstraints) > 0 {
+ name = name + " [" + formatComponentSemVerConstraintsToString(componentSemVerConstraints) + "]"
+ }
+ name = strings.TrimSpace(name)
+ return name
+}
+
+func formatComponentSemVerConstraintsToString(componentSemVerConstraints map[string][]string) string {
+ var tmpStr string
+ for component, semVerConstraints := range componentSemVerConstraints {
+ tmpStr = tmpStr + fmt.Sprintf("%s: %s, ", component, semVerConstraints)
+ }
+ tmpStr = strings.TrimSuffix(tmpStr, ", ")
+ return tmpStr
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_event_writer.go b/vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_event_writer.go
new file mode 100644
index 000000000..ec5311d06
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_event_writer.go
@@ -0,0 +1,111 @@
+package reporters
+
+type GoJSONEventWriter struct {
+ enc encoder
+ specSystemErrFn specSystemExtractFn
+ specSystemOutFn specSystemExtractFn
+}
+
+func NewGoJSONEventWriter(enc encoder, errFn specSystemExtractFn, outFn specSystemExtractFn) *GoJSONEventWriter {
+ return &GoJSONEventWriter{
+ enc: enc,
+ specSystemErrFn: errFn,
+ specSystemOutFn: outFn,
+ }
+}
+
+func (r *GoJSONEventWriter) writeEvent(e *gojsonEvent) error {
+ return r.enc.Encode(e)
+}
+
+func (r *GoJSONEventWriter) WriteSuiteStart(report *gojsonReport) error {
+ e := &gojsonEvent{
+ Time: &report.o.StartTime,
+ Action: GoJSONStart,
+ Package: report.goPkg,
+ Output: nil,
+ FailedBuild: "",
+ }
+ return r.writeEvent(e)
+}
+
+func (r *GoJSONEventWriter) WriteSuiteResult(report *gojsonReport) error {
+ var action GoJSONAction
+ switch {
+ case report.o.PreRunStats.SpecsThatWillRun == 0:
+ action = GoJSONSkip
+ case report.o.SuiteSucceeded:
+ action = GoJSONPass
+ default:
+ action = GoJSONFail
+ }
+ e := &gojsonEvent{
+ Time: &report.o.EndTime,
+ Action: action,
+ Package: report.goPkg,
+ Output: nil,
+ FailedBuild: "",
+ Elapsed: ptr(report.elapsed),
+ }
+ return r.writeEvent(e)
+}
+
+func (r *GoJSONEventWriter) WriteSpecStart(report *gojsonReport, specReport *gojsonSpecReport) error {
+ e := &gojsonEvent{
+ Time: &specReport.o.StartTime,
+ Action: GoJSONRun,
+ Test: specReport.testName,
+ Package: report.goPkg,
+ Output: nil,
+ FailedBuild: "",
+ }
+ return r.writeEvent(e)
+}
+
+func (r *GoJSONEventWriter) WriteSpecOut(report *gojsonReport, specReport *gojsonSpecReport) error {
+ events := []*gojsonEvent{}
+
+ stdErr := r.specSystemErrFn(specReport.o)
+ if stdErr != "" {
+ events = append(events, &gojsonEvent{
+ Time: &specReport.o.EndTime,
+ Action: GoJSONOutput,
+ Test: specReport.testName,
+ Package: report.goPkg,
+ Output: ptr(stdErr),
+ FailedBuild: "",
+ })
+ }
+ stdOut := r.specSystemOutFn(specReport.o)
+ if stdOut != "" {
+ events = append(events, &gojsonEvent{
+ Time: &specReport.o.EndTime,
+ Action: GoJSONOutput,
+ Test: specReport.testName,
+ Package: report.goPkg,
+ Output: ptr(stdOut),
+ FailedBuild: "",
+ })
+ }
+
+ for _, ev := range events {
+ err := r.writeEvent(ev)
+ if err != nil {
+ return err
+ }
+ }
+ return nil
+}
+
+func (r *GoJSONEventWriter) WriteSpecResult(report *gojsonReport, specReport *gojsonSpecReport) error {
+ e := &gojsonEvent{
+ Time: &specReport.o.EndTime,
+ Action: specReport.action,
+ Test: specReport.testName,
+ Package: report.goPkg,
+ Elapsed: ptr(specReport.elapsed),
+ Output: nil,
+ FailedBuild: "",
+ }
+ return r.writeEvent(e)
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_reporter.go b/vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_reporter.go
new file mode 100644
index 000000000..633e49b88
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_reporter.go
@@ -0,0 +1,45 @@
+package reporters
+
+import (
+ "github.com/onsi/ginkgo/v2/types"
+)
+
+type GoJSONReporter struct {
+ ev *GoJSONEventWriter
+}
+
+type specSystemExtractFn func (spec types.SpecReport) string
+
+func NewGoJSONReporter(enc encoder, errFn specSystemExtractFn, outFn specSystemExtractFn) *GoJSONReporter {
+ return &GoJSONReporter{
+ ev: NewGoJSONEventWriter(enc, errFn, outFn),
+ }
+}
+
+func (r *GoJSONReporter) Write(originalReport types.Report) error {
+ // suite start events
+ report := newReport(originalReport)
+ err := report.Fill()
+ if err != nil {
+ return err
+ }
+ r.ev.WriteSuiteStart(report)
+ for _, originalSpecReport := range originalReport.SpecReports {
+ specReport := newSpecReport(originalSpecReport)
+ err := specReport.Fill()
+ if err != nil {
+ return err
+ }
+ if specReport.o.LeafNodeType == types.NodeTypeIt {
+ // handle any It leaf node as a spec
+ r.ev.WriteSpecStart(report, specReport)
+ r.ev.WriteSpecOut(report, specReport)
+ r.ev.WriteSpecResult(report, specReport)
+ } else {
+ // handle any other leaf node as generic output
+ r.ev.WriteSpecOut(report, specReport)
+ }
+ }
+ r.ev.WriteSuiteResult(report)
+ return nil
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go b/vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go
index 2d2ea2fc3..99c9c5f5b 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go
@@ -2,6 +2,7 @@ package internal
import (
"context"
+ "reflect"
"github.com/onsi/ginkgo/v2/types"
)
@@ -11,6 +12,7 @@ type SpecContext interface {
SpecReport() types.SpecReport
AttachProgressReporter(func() string) func()
+ WrappedContext() context.Context
}
type specContext struct {
@@ -45,3 +47,28 @@ func NewSpecContext(suite *Suite) *specContext {
func (sc *specContext) SpecReport() types.SpecReport {
return sc.suite.CurrentSpecReport()
}
+
+func (sc *specContext) WrappedContext() context.Context {
+ return sc.Context
+}
+
+/*
+The user is allowed to wrap `SpecContext` in a new context.Context when using AroundNodes. But body functions expect SpecContext.
+We support this by taking their context.Context and returning a SpecContext that wraps it.
+*/
+func wrapContextChain(ctx context.Context) SpecContext {
+ if ctx == nil {
+ return nil
+ }
+ if reflect.TypeOf(ctx) == reflect.TypeOf(&specContext{}) {
+ return ctx.(*specContext)
+ } else if sc, ok := ctx.Value("GINKGO_SPEC_CONTEXT").(*specContext); ok {
+ return &specContext{
+ Context: ctx,
+ ProgressReporterManager: sc.ProgressReporterManager,
+ cancel: sc.cancel,
+ suite: sc.suite,
+ }
+ }
+ return nil
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/suite.go b/vendor/github.com/onsi/ginkgo/v2/internal/suite.go
index 12e50b8a9..c22d4e40e 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/suite.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/suite.go
@@ -1,6 +1,7 @@
package internal
import (
+ "context"
"fmt"
"sync"
"time"
@@ -9,7 +10,6 @@ import (
"github.com/onsi/ginkgo/v2/internal/parallel_support"
"github.com/onsi/ginkgo/v2/reporters"
"github.com/onsi/ginkgo/v2/types"
- "golang.org/x/net/context"
)
type Phase uint
@@ -20,7 +20,7 @@ const (
PhaseRun
)
-var PROGRESS_REPORTER_DEADLING = 5 * time.Second
+const ProgressReporterDeadline = 5 * time.Second
type Suite struct {
tree *TreeNode
@@ -32,6 +32,7 @@ type Suite struct {
suiteNodes Nodes
cleanupNodes Nodes
+ aroundNodes types.AroundNodes
failer *Failer
reporter reporters.Reporter
@@ -41,6 +42,8 @@ type Suite struct {
config types.SuiteConfig
deadline time.Time
+ currentConstructionNodeReport *types.ConstructionNodeReport
+
skipAll bool
report types.Report
currentSpecReport types.SpecReport
@@ -89,6 +92,7 @@ func (suite *Suite) Clone() (*Suite, error) {
ProgressReporterManager: NewProgressReporterManager(),
topLevelContainers: suite.topLevelContainers.Clone(),
suiteNodes: suite.suiteNodes.Clone(),
+ aroundNodes: suite.aroundNodes.Clone(),
selectiveLock: &sync.Mutex{},
}, nil
}
@@ -106,7 +110,7 @@ func (suite *Suite) BuildTree() error {
return nil
}
-func (suite *Suite) Run(description string, suiteLabels Labels, suitePath string, failer *Failer, reporter reporters.Reporter, writer WriterInterface, outputInterceptor OutputInterceptor, interruptHandler interrupt_handler.InterruptHandlerInterface, client parallel_support.Client, progressSignalRegistrar ProgressSignalRegistrar, suiteConfig types.SuiteConfig) (bool, bool) {
+func (suite *Suite) Run(description string, suiteLabels Labels, suiteSemVerConstraints SemVerConstraints, suiteComponentSemVerConstraints ComponentSemVerConstraints, suiteAroundNodes types.AroundNodes, suitePath string, failer *Failer, reporter reporters.Reporter, writer WriterInterface, outputInterceptor OutputInterceptor, interruptHandler interrupt_handler.InterruptHandlerInterface, client parallel_support.Client, progressSignalRegistrar ProgressSignalRegistrar, suiteConfig types.SuiteConfig) (bool, bool) {
if suite.phase != PhaseBuildTree {
panic("cannot run before building the tree = call suite.BuildTree() first")
}
@@ -117,7 +121,8 @@ func (suite *Suite) Run(description string, suiteLabels Labels, suitePath string
suite.annotateFn(spec.Text(), spec)
}
}
- specs, hasProgrammaticFocus := ApplyFocusToSpecs(specs, description, suiteLabels, suiteConfig)
+ specs, hasProgrammaticFocus := ApplyFocusToSpecs(specs, description, suiteLabels, suiteSemVerConstraints, suiteComponentSemVerConstraints, suiteConfig)
+ specs = ComputeAroundNodes(specs)
suite.phase = PhaseRun
suite.client = client
@@ -127,6 +132,7 @@ func (suite *Suite) Run(description string, suiteLabels Labels, suitePath string
suite.outputInterceptor = outputInterceptor
suite.interruptHandler = interruptHandler
suite.config = suiteConfig
+ suite.aroundNodes = suiteAroundNodes
if suite.config.Timeout > 0 {
suite.deadline = time.Now().Add(suite.config.Timeout)
@@ -134,7 +140,7 @@ func (suite *Suite) Run(description string, suiteLabels Labels, suitePath string
cancelProgressHandler := progressSignalRegistrar(suite.handleProgressSignal)
- success := suite.runSpecs(description, suiteLabels, suitePath, hasProgrammaticFocus, specs)
+ success := suite.runSpecs(description, suiteLabels, suiteSemVerConstraints, suiteComponentSemVerConstraints, suitePath, hasProgrammaticFocus, specs)
cancelProgressHandler()
@@ -206,6 +212,17 @@ func (suite *Suite) PushNode(node Node) error {
err = types.GinkgoErrors.CaughtPanicDuringABuildPhase(e, node.CodeLocation)
}
}()
+
+ // Ensure that code running in the body of the container node
+ // has access to information about the current container node(s).
+ // The current one (nil in top-level container nodes, non-nil in an
+ // embedded container node) gets restored when the node is done.
+ oldConstructionNodeReport := suite.currentConstructionNodeReport
+ suite.currentConstructionNodeReport = constructionNodeReportForTreeNode(suite.tree)
+ defer func() {
+ suite.currentConstructionNodeReport = oldConstructionNodeReport
+ }()
+
node.Body(nil)
return err
}()
@@ -266,6 +283,7 @@ func (suite *Suite) pushCleanupNode(node Node) error {
node.NodeIDWhereCleanupWasGenerated = suite.currentNode.ID
node.NestingLevel = suite.currentNode.NestingLevel
+ node.AroundNodes = types.AroundNodes{}.Append(suite.currentNode.AroundNodes...).Append(node.AroundNodes...)
suite.selectiveLock.Lock()
suite.cleanupNodes = append(suite.cleanupNodes, node)
suite.selectiveLock.Unlock()
@@ -334,6 +352,16 @@ func (suite *Suite) By(text string, callback ...func()) error {
return nil
}
+func (suite *Suite) CurrentConstructionNodeReport() types.ConstructionNodeReport {
+ suite.selectiveLock.Lock()
+ defer suite.selectiveLock.Unlock()
+ report := suite.currentConstructionNodeReport
+ if report == nil {
+ panic("CurrentConstructionNodeReport may only be called during construction of the spec tree")
+ }
+ return *report
+}
+
/*
Spec Running methods - used during PhaseRun
*/
@@ -377,7 +405,7 @@ func (suite *Suite) generateProgressReport(fullReport bool) types.ProgressReport
suite.selectiveLock.Lock()
defer suite.selectiveLock.Unlock()
- deadline, cancel := context.WithTimeout(context.Background(), PROGRESS_REPORTER_DEADLING)
+ deadline, cancel := context.WithTimeout(context.Background(), ProgressReporterDeadline)
defer cancel()
var additionalReports []string
if suite.currentSpecContext != nil {
@@ -435,15 +463,17 @@ func (suite *Suite) processCurrentSpecReport() {
}
}
-func (suite *Suite) runSpecs(description string, suiteLabels Labels, suitePath string, hasProgrammaticFocus bool, specs Specs) bool {
+func (suite *Suite) runSpecs(description string, suiteLabels Labels, suiteSemVerConstraints SemVerConstraints, suiteComponentSemVerConstraints ComponentSemVerConstraints, suitePath string, hasProgrammaticFocus bool, specs Specs) bool {
numSpecsThatWillBeRun := specs.CountWithoutSkip()
suite.report = types.Report{
- SuitePath: suitePath,
- SuiteDescription: description,
- SuiteLabels: suiteLabels,
- SuiteConfig: suite.config,
- SuiteHasProgrammaticFocus: hasProgrammaticFocus,
+ SuitePath: suitePath,
+ SuiteDescription: description,
+ SuiteLabels: suiteLabels,
+ SuiteSemVerConstraints: suiteSemVerConstraints,
+ SuiteComponentSemVerConstraints: suiteComponentSemVerConstraints,
+ SuiteConfig: suite.config,
+ SuiteHasProgrammaticFocus: hasProgrammaticFocus,
PreRunStats: types.PreRunStats{
TotalSpecs: len(specs),
SpecsThatWillRun: numSpecsThatWillBeRun,
@@ -898,7 +928,30 @@ func (suite *Suite) runNode(node Node, specDeadline time.Time, text string) (typ
failureC <- failureFromRun
}()
- node.Body(sc)
+ aroundNodes := types.AroundNodes{}.Append(suite.aroundNodes...).Append(node.AroundNodes...)
+ if len(aroundNodes) > 0 {
+ i := 0
+ var f func(context.Context)
+ f = func(c context.Context) {
+ sc := wrapContextChain(c)
+ if sc == nil {
+ suite.failer.Fail("An AroundNode failed to pass a valid Ginkgo SpecContext in. You must always pass in a context derived from the context passed to you.", aroundNodes[i].CodeLocation)
+ return
+ }
+ i++
+ if i < len(aroundNodes) {
+ aroundNodes[i].Body(sc, f)
+ } else {
+ node.Body(sc)
+ }
+ }
+ aroundNodes[0].Body(sc, f)
+ if i != len(aroundNodes) {
+ suite.failer.Fail("An AroundNode failed to call the passed in function.", aroundNodes[i].CodeLocation)
+ }
+ } else {
+ node.Body(sc)
+ }
finished = true
}()
@@ -997,7 +1050,7 @@ func (suite *Suite) runNode(node Node, specDeadline time.Time, text string) (typ
}
progressReport = progressReport.WithoutOtherGoroutines()
- sc.cancel(fmt.Errorf(interruptStatus.Message()))
+ sc.cancel(fmt.Errorf("%s", interruptStatus.Message()))
if interruptStatus.Level == interrupt_handler.InterruptLevelBailOut {
if interruptStatus.ShouldIncludeProgressReport() {
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/suite_patch.go b/vendor/github.com/onsi/ginkgo/v2/internal/suite_patch.go
index 29eae0283..83eb1f8d5 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/suite_patch.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/suite_patch.go
@@ -1,6 +1,9 @@
package internal
import (
+ "io"
+ "os"
+ "strings"
"time"
"github.com/onsi/ginkgo/v2/internal/interrupt_handler"
@@ -8,6 +11,70 @@ import (
"github.com/onsi/ginkgo/v2/types"
)
+// ForwardingOutputInterceptor wraps a real OutputInterceptor but forwards
+// captured output to stdout in real-time. This allows stdout/stderr to be
+// captured in test results while still showing output during test execution.
+type ForwardingOutputInterceptor struct {
+ interceptor OutputInterceptor
+ stdoutClone *os.File
+}
+
+// NewForwardingOutputInterceptor creates an output interceptor that captures
+// stdout/stderr while also forwarding it to a clone of stdout in real-time.
+// The stdout clone is created using dupStdout() (platform-specific) before
+// the interceptor redirects output, ensuring output is always forwarded to
+// the original terminal.
+func NewForwardingOutputInterceptor() *ForwardingOutputInterceptor {
+ // Create a clone of stdout BEFORE the interceptor can redirect it.
+ // This ensures we always have a handle to the original terminal for
+ // forwarding output. The dupStdout() function is platform-specific.
+ stdoutClone := dupStdout()
+ if stdoutClone == nil {
+ // If we can't dup stdout, fall back to NoopOutputInterceptor behavior
+ return &ForwardingOutputInterceptor{
+ interceptor: NoopOutputInterceptor{},
+ stdoutClone: nil,
+ }
+ }
+
+ return &ForwardingOutputInterceptor{
+ interceptor: NewOutputInterceptor(),
+ stdoutClone: stdoutClone,
+ }
+}
+
+func (f *ForwardingOutputInterceptor) StartInterceptingOutput() {
+ if f.stdoutClone != nil {
+ f.interceptor.StartInterceptingOutputAndForwardTo(f.stdoutClone)
+ } else {
+ f.interceptor.StartInterceptingOutput()
+ }
+}
+
+func (f *ForwardingOutputInterceptor) StartInterceptingOutputAndForwardTo(w io.Writer) {
+ f.interceptor.StartInterceptingOutputAndForwardTo(w)
+}
+
+func (f *ForwardingOutputInterceptor) StopInterceptingAndReturnOutput() string {
+ return f.interceptor.StopInterceptingAndReturnOutput()
+}
+
+func (f *ForwardingOutputInterceptor) PauseIntercepting() {
+ f.interceptor.PauseIntercepting()
+}
+
+func (f *ForwardingOutputInterceptor) ResumeIntercepting() {
+ f.interceptor.ResumeIntercepting()
+}
+
+func (f *ForwardingOutputInterceptor) Shutdown() {
+ f.interceptor.Shutdown()
+ if f.stdoutClone != nil {
+ f.stdoutClone.Close()
+ f.stdoutClone = nil
+ }
+}
+
type AnnotateFunc func(testName string, test types.TestSpec)
func (suite *Suite) SetAnnotateFn(fn AnnotateFunc) {
@@ -58,14 +125,18 @@ func (suite *Suite) RunSpec(spec types.TestSpec, suiteLabels Labels, suiteDescri
suite.failer = failer
suite.reporter = reporters.NewDefaultReporter(reporterConfig, writer)
suite.writer = writer
- suite.outputInterceptor = NoopOutputInterceptor{}
+ if strings.ToLower(suiteConfig.OutputInterceptorMode) == "none" {
+ suite.outputInterceptor = NoopOutputInterceptor{}
+ } else {
+ suite.outputInterceptor = NewForwardingOutputInterceptor()
+ }
if suite.config.Timeout > 0 {
suite.deadline = time.Now().Add(suiteConfig.Timeout)
}
suite.interruptHandler = interrupt_handler.NewInterruptHandler(nil)
suite.config = suiteConfig
- success := suite.runSpecs(suiteDescription, suiteLabels, suitePath, false, []Spec{spec.(Spec)})
+ success := suite.runSpecs(suiteDescription, suiteLabels, SemVerConstraints{}, ComponentSemVerConstraints{}, suitePath, false, []Spec{spec.(Spec)})
return success, false
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go b/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go
index 73e265565..5704f0fdf 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go
@@ -1,6 +1,7 @@
package testingtproxy
import (
+ "context"
"fmt"
"io"
"os"
@@ -19,13 +20,18 @@ type addReportEntryFunc func(names string, args ...any)
type ginkgoWriterInterface interface {
io.Writer
- Print(a ...interface{})
- Printf(format string, a ...interface{})
- Println(a ...interface{})
+ Print(a ...any)
+ Printf(format string, a ...any)
+ Println(a ...any)
}
type ginkgoRecoverFunc func()
type attachProgressReporterFunc func(func() string) func()
+var formatters = map[bool]formatter.Formatter{
+ true: formatter.NewWithNoColorBool(true),
+ false: formatter.NewWithNoColorBool(false),
+}
+
func New(writer ginkgoWriterInterface, fail failFunc, skip skipFunc, cleanup cleanupFunc, report reportFunc, addReportEntry addReportEntryFunc, ginkgoRecover ginkgoRecoverFunc, attachProgressReporter attachProgressReporterFunc, randomSeed int64, parallelProcess int, parallelTotal int, noColor bool, offset int) *ginkgoTestingTProxy {
return &ginkgoTestingTProxy{
fail: fail,
@@ -40,7 +46,7 @@ func New(writer ginkgoWriterInterface, fail failFunc, skip skipFunc, cleanup cle
randomSeed: randomSeed,
parallelProcess: parallelProcess,
parallelTotal: parallelTotal,
- f: formatter.NewWithNoColorBool(noColor),
+ f: formatters[noColor], //minimize allocations by reusing formatters
}
}
@@ -80,11 +86,31 @@ func (t *ginkgoTestingTProxy) Setenv(key, value string) {
}
}
-func (t *ginkgoTestingTProxy) Error(args ...interface{}) {
+func (t *ginkgoTestingTProxy) Chdir(dir string) {
+ currentDir, err := os.Getwd()
+ if err != nil {
+ t.fail(fmt.Sprintf("Failed to get current directory: %v", err), 1)
+ }
+
+ t.cleanup(os.Chdir, currentDir, internal.Offset(1))
+
+ err = os.Chdir(dir)
+ if err != nil {
+ t.fail(fmt.Sprintf("Failed to change directory: %v", err), 1)
+ }
+}
+
+func (t *ginkgoTestingTProxy) Context() context.Context {
+ ctx, cancel := context.WithCancel(context.Background())
+ t.cleanup(cancel, internal.Offset(1))
+ return ctx
+}
+
+func (t *ginkgoTestingTProxy) Error(args ...any) {
t.fail(fmt.Sprintln(args...), t.offset)
}
-func (t *ginkgoTestingTProxy) Errorf(format string, args ...interface{}) {
+func (t *ginkgoTestingTProxy) Errorf(format string, args ...any) {
t.fail(fmt.Sprintf(format, args...), t.offset)
}
@@ -100,11 +126,11 @@ func (t *ginkgoTestingTProxy) Failed() bool {
return t.report().Failed()
}
-func (t *ginkgoTestingTProxy) Fatal(args ...interface{}) {
+func (t *ginkgoTestingTProxy) Fatal(args ...any) {
t.fail(fmt.Sprintln(args...), t.offset)
}
-func (t *ginkgoTestingTProxy) Fatalf(format string, args ...interface{}) {
+func (t *ginkgoTestingTProxy) Fatalf(format string, args ...any) {
t.fail(fmt.Sprintf(format, args...), t.offset)
}
@@ -112,11 +138,11 @@ func (t *ginkgoTestingTProxy) Helper() {
types.MarkAsHelper(1)
}
-func (t *ginkgoTestingTProxy) Log(args ...interface{}) {
+func (t *ginkgoTestingTProxy) Log(args ...any) {
fmt.Fprintln(t.writer, args...)
}
-func (t *ginkgoTestingTProxy) Logf(format string, args ...interface{}) {
+func (t *ginkgoTestingTProxy) Logf(format string, args ...any) {
t.Log(fmt.Sprintf(format, args...))
}
@@ -128,7 +154,7 @@ func (t *ginkgoTestingTProxy) Parallel() {
// No-op
}
-func (t *ginkgoTestingTProxy) Skip(args ...interface{}) {
+func (t *ginkgoTestingTProxy) Skip(args ...any) {
t.skip(fmt.Sprintln(args...), t.offset)
}
@@ -136,7 +162,7 @@ func (t *ginkgoTestingTProxy) SkipNow() {
t.skip("skip", t.offset)
}
-func (t *ginkgoTestingTProxy) Skipf(format string, args ...interface{}) {
+func (t *ginkgoTestingTProxy) Skipf(format string, args ...any) {
t.skip(fmt.Sprintf(format, args...), t.offset)
}
@@ -208,3 +234,9 @@ func (t *ginkgoTestingTProxy) ParallelTotal() int {
func (t *ginkgoTestingTProxy) AttachProgressReporter(f func() string) func() {
return t.attachProgressReporter(f)
}
+func (t *ginkgoTestingTProxy) Output() io.Writer {
+ return t.writer
+}
+func (t *ginkgoTestingTProxy) Attr(key, value string) {
+ t.addReportEntry(key, value, internal.Offset(1), types.ReportEntryVisibilityFailureOrVerbose)
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/writer.go b/vendor/github.com/onsi/ginkgo/v2/internal/writer.go
index aab42d5fb..1c4e0534e 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/writer.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/writer.go
@@ -121,15 +121,15 @@ func (w *Writer) ClearTeeWriters() {
w.teeWriters = []io.Writer{}
}
-func (w *Writer) Print(a ...interface{}) {
+func (w *Writer) Print(a ...any) {
fmt.Fprint(w, a...)
}
-func (w *Writer) Printf(format string, a ...interface{}) {
+func (w *Writer) Printf(format string, a ...any) {
fmt.Fprintf(w, format, a...)
}
-func (w *Writer) Println(a ...interface{}) {
+func (w *Writer) Println(a ...any) {
fmt.Fprintln(w, a...)
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go b/vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go
index 480730486..ef66b2289 100644
--- a/vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go
+++ b/vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go
@@ -72,6 +72,12 @@ func (r *DefaultReporter) SuiteWillBegin(report types.Report) {
if len(report.SuiteLabels) > 0 {
r.emit(r.f("{{coral}}[%s]{{/}} ", strings.Join(report.SuiteLabels, ", ")))
}
+ if len(report.SuiteSemVerConstraints) > 0 {
+ r.emit(r.f("{{coral}}[%s]{{/}} ", strings.Join(report.SuiteSemVerConstraints, ", ")))
+ }
+ if len(report.SuiteComponentSemVerConstraints) > 0 {
+ r.emit(r.f("{{coral}}[Components: %s]{{/}} ", formatComponentSemVerConstraintsToString(report.SuiteComponentSemVerConstraints)))
+ }
r.emit(r.f("- %d/%d specs ", report.PreRunStats.SpecsThatWillRun, report.PreRunStats.TotalSpecs))
if report.SuiteConfig.ParallelTotal > 1 {
r.emit(r.f("- %d procs ", report.SuiteConfig.ParallelTotal))
@@ -87,6 +93,20 @@ func (r *DefaultReporter) SuiteWillBegin(report types.Report) {
bannerWidth = len(labels) + 2
}
}
+ if len(report.SuiteSemVerConstraints) > 0 {
+ semVerConstraints := strings.Join(report.SuiteSemVerConstraints, ", ")
+ r.emitBlock(r.f("{{coral}}[%s]{{/}} ", semVerConstraints))
+ if len(semVerConstraints)+2 > bannerWidth {
+ bannerWidth = len(semVerConstraints) + 2
+ }
+ }
+ if len(report.SuiteComponentSemVerConstraints) > 0 {
+ componentSemVerConstraints := formatComponentSemVerConstraintsToString(report.SuiteComponentSemVerConstraints)
+ r.emitBlock(r.f("{{coral}}[Components: %s]{{/}} ", componentSemVerConstraints))
+ if len(componentSemVerConstraints)+2 > bannerWidth {
+ bannerWidth = len(componentSemVerConstraints) + 2
+ }
+ }
r.emitBlock(strings.Repeat("=", bannerWidth))
out := r.f("Random Seed: {{bold}}%d{{/}}", report.SuiteConfig.RandomSeed)
@@ -371,13 +391,22 @@ func (r *DefaultReporter) emitTimeline(indent uint, report types.SpecReport, tim
cursor := 0
for _, entry := range timeline {
tl := entry.GetTimelineLocation()
- if tl.Offset < len(gw) {
- r.emit(r.fi(indent, "%s", gw[cursor:tl.Offset]))
- cursor = tl.Offset
- } else if cursor < len(gw) {
+
+ end := tl.Offset
+ if end > len(gw) {
+ end = len(gw)
+ }
+ if end < cursor {
+ end = cursor
+ }
+ if cursor < end && cursor <= len(gw) && end <= len(gw) {
+ r.emit(r.fi(indent, "%s", gw[cursor:end]))
+ cursor = end
+ } else if cursor < len(gw) && end == len(gw) {
r.emit(r.fi(indent, "%s", gw[cursor:]))
cursor = len(gw)
}
+
switch x := entry.(type) {
case types.Failure:
if isVeryVerbose {
@@ -394,7 +423,7 @@ func (r *DefaultReporter) emitTimeline(indent uint, report types.SpecReport, tim
case types.ReportEntry:
r.emitReportEntry(indent, x)
case types.ProgressReport:
- r.emitProgressReport(indent, false, x)
+ r.emitProgressReport(indent, false, isVeryVerbose, x)
case types.SpecEvent:
if isVeryVerbose || !x.IsOnlyVisibleAtVeryVerbose() || r.conf.ShowNodeEvents {
r.emitSpecEvent(indent, x, isVeryVerbose)
@@ -448,7 +477,7 @@ func (r *DefaultReporter) emitFailure(indent uint, state types.SpecState, failur
if !failure.ProgressReport.IsZero() {
r.emitBlock("\n")
- r.emitProgressReport(indent, false, failure.ProgressReport)
+ r.emitProgressReport(indent, false, false, failure.ProgressReport)
}
if failure.AdditionalFailure != nil && includeAdditionalFailure {
@@ -464,11 +493,11 @@ func (r *DefaultReporter) EmitProgressReport(report types.ProgressReport) {
r.emit(r.fi(1, "{{coral}}Progress Report for Ginkgo Process #{{bold}}%d{{/}}\n", report.ParallelProcess))
}
shouldEmitGW := report.RunningInParallel || r.conf.Verbosity().LT(types.VerbosityLevelVerbose)
- r.emitProgressReport(1, shouldEmitGW, report)
+ r.emitProgressReport(1, shouldEmitGW, true, report)
r.emitDelimiter(1)
}
-func (r *DefaultReporter) emitProgressReport(indent uint, emitGinkgoWriterOutput bool, report types.ProgressReport) {
+func (r *DefaultReporter) emitProgressReport(indent uint, emitGinkgoWriterOutput, emitGroup bool, report types.ProgressReport) {
if report.Message != "" {
r.emitBlock(r.fi(indent, report.Message+"\n"))
indent += 1
@@ -504,6 +533,10 @@ func (r *DefaultReporter) emitProgressReport(indent uint, emitGinkgoWriterOutput
indent -= 1
}
+ if r.conf.GithubOutput && emitGroup {
+ r.emitBlock(r.fi(indent, "::group::Progress Report"))
+ }
+
if emitGinkgoWriterOutput && report.CapturedGinkgoWriterOutput != "" {
r.emit("\n")
r.emitBlock(r.fi(indent, "{{gray}}Begin Captured GinkgoWriter Output >>{{/}}"))
@@ -550,6 +583,10 @@ func (r *DefaultReporter) emitProgressReport(indent uint, emitGinkgoWriterOutput
r.emit(r.fi(indent, "{{gray}}{{bold}}{{underline}}Other Goroutines{{/}}\n"))
r.emitGoroutines(indent, otherGoroutines...)
}
+
+ if r.conf.GithubOutput && emitGroup {
+ r.emitBlock(r.fi(indent, "::endgroup::"))
+ }
}
func (r *DefaultReporter) EmitReportEntry(entry types.ReportEntry) {
@@ -685,11 +722,11 @@ func (r *DefaultReporter) _emit(s string, block bool, isDelimiter bool) {
}
/* Rendering text */
-func (r *DefaultReporter) f(format string, args ...interface{}) string {
+func (r *DefaultReporter) f(format string, args ...any) string {
return r.formatter.F(format, args...)
}
-func (r *DefaultReporter) fi(indentation uint, format string, args ...interface{}) string {
+func (r *DefaultReporter) fi(indentation uint, format string, args ...any) string {
return r.formatter.Fi(indentation, format, args...)
}
@@ -698,8 +735,12 @@ func (r *DefaultReporter) cycleJoin(elements []string, joiner string) string {
}
func (r *DefaultReporter) codeLocationBlock(report types.SpecReport, highlightColor string, veryVerbose bool, usePreciseFailureLocation bool) string {
- texts, locations, labels := []string{}, []types.CodeLocation{}, [][]string{}
- texts, locations, labels = append(texts, report.ContainerHierarchyTexts...), append(locations, report.ContainerHierarchyLocations...), append(labels, report.ContainerHierarchyLabels...)
+ texts, locations, labels, semVerConstraints, componentSemVerConstraints := []string{}, []types.CodeLocation{}, [][]string{}, [][]string{}, []map[string][]string{}
+ texts = append(texts, report.ContainerHierarchyTexts...)
+ locations = append(locations, report.ContainerHierarchyLocations...)
+ labels = append(labels, report.ContainerHierarchyLabels...)
+ semVerConstraints = append(semVerConstraints, report.ContainerHierarchySemVerConstraints...)
+ componentSemVerConstraints = append(componentSemVerConstraints, report.ContainerHierarchyComponentSemVerConstraints...)
if report.LeafNodeType.Is(types.NodeTypesForSuiteLevelNodes) {
texts = append(texts, r.f("[%s] %s", report.LeafNodeType, report.LeafNodeText))
@@ -707,6 +748,8 @@ func (r *DefaultReporter) codeLocationBlock(report types.SpecReport, highlightCo
texts = append(texts, r.f(report.LeafNodeText))
}
labels = append(labels, report.LeafNodeLabels)
+ semVerConstraints = append(semVerConstraints, report.LeafNodeSemVerConstraints)
+ componentSemVerConstraints = append(componentSemVerConstraints, report.LeafNodeComponentSemVerConstraints)
locations = append(locations, report.LeafNodeLocation)
failureLocation := report.Failure.FailureNodeLocation
@@ -720,6 +763,8 @@ func (r *DefaultReporter) codeLocationBlock(report types.SpecReport, highlightCo
texts = append([]string{fmt.Sprintf("TOP-LEVEL [%s]", report.Failure.FailureNodeType)}, texts...)
locations = append([]types.CodeLocation{failureLocation}, locations...)
labels = append([][]string{{}}, labels...)
+ semVerConstraints = append([][]string{{}}, semVerConstraints...)
+ componentSemVerConstraints = append([]map[string][]string{{}}, componentSemVerConstraints...)
highlightIndex = 0
case types.FailureNodeInContainer:
i := report.Failure.FailureNodeContainerIndex
@@ -747,6 +792,12 @@ func (r *DefaultReporter) codeLocationBlock(report types.SpecReport, highlightCo
if len(labels[i]) > 0 {
out += r.f(" {{coral}}[%s]{{/}}", strings.Join(labels[i], ", "))
}
+ if len(semVerConstraints[i]) > 0 {
+ out += r.f(" {{coral}}[%s]{{/}}", strings.Join(semVerConstraints[i], ", "))
+ }
+ if len(componentSemVerConstraints[i]) > 0 {
+ out += r.f(" {{coral}}[%s]{{/}}", formatComponentSemVerConstraintsToString(componentSemVerConstraints[i]))
+ }
out += "\n"
out += r.fi(uint(i), "{{gray}}%s{{/}}\n", locations[i])
}
@@ -770,6 +821,14 @@ func (r *DefaultReporter) codeLocationBlock(report types.SpecReport, highlightCo
if len(flattenedLabels) > 0 {
out += r.f(" {{coral}}[%s]{{/}}", strings.Join(flattenedLabels, ", "))
}
+ flattenedSemVerConstraints := report.SemVerConstraints()
+ if len(flattenedSemVerConstraints) > 0 {
+ out += r.f(" {{coral}}[%s]{{/}}", strings.Join(flattenedSemVerConstraints, ", "))
+ }
+ flattenedComponentSemVerConstraints := report.ComponentSemVerConstraints()
+ if len(flattenedComponentSemVerConstraints) > 0 {
+ out += r.f(" {{coral}}[%s]{{/}}", formatComponentSemVerConstraintsToString(flattenedComponentSemVerConstraints))
+ }
out += "\n"
if usePreciseFailureLocation {
out += r.f("{{gray}}%s{{/}}", failureLocation)
diff --git a/vendor/github.com/onsi/ginkgo/v2/reporters/gojson_report.go b/vendor/github.com/onsi/ginkgo/v2/reporters/gojson_report.go
new file mode 100644
index 000000000..d02fb7a1a
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/reporters/gojson_report.go
@@ -0,0 +1,61 @@
+package reporters
+
+import (
+ "encoding/json"
+ "fmt"
+ "os"
+ "path"
+
+ "github.com/onsi/ginkgo/v2/internal/reporters"
+ "github.com/onsi/ginkgo/v2/types"
+)
+
+// GenerateGoTestJSONReport produces a JSON-formatted in the test2json format used by `go test -json`
+func GenerateGoTestJSONReport(report types.Report, destination string) error {
+ // walk report and generate test2json-compatible objects
+ // JSON-encode the objects into filename
+ if err := os.MkdirAll(path.Dir(destination), 0770); err != nil {
+ return err
+ }
+ f, err := os.Create(destination)
+ if err != nil {
+ return err
+ }
+ defer f.Close()
+ enc := json.NewEncoder(f)
+ r := reporters.NewGoJSONReporter(
+ enc,
+ systemErrForUnstructuredReporters,
+ systemOutForUnstructuredReporters,
+ )
+ return r.Write(report)
+}
+
+// MergeJSONReports produces a single JSON-formatted report at the passed in destination by merging the JSON-formatted reports provided in sources
+// It skips over reports that fail to decode but reports on them via the returned messages []string
+func MergeAndCleanupGoTestJSONReports(sources []string, destination string) ([]string, error) {
+ messages := []string{}
+ if err := os.MkdirAll(path.Dir(destination), 0770); err != nil {
+ return messages, err
+ }
+ f, err := os.Create(destination)
+ if err != nil {
+ return messages, err
+ }
+ defer f.Close()
+
+ for _, source := range sources {
+ data, err := os.ReadFile(source)
+ if err != nil {
+ messages = append(messages, fmt.Sprintf("Could not open %s:\n%s", source, err.Error()))
+ continue
+ }
+ _, err = f.Write(data)
+ if err != nil {
+ messages = append(messages, fmt.Sprintf("Could not write to %s:\n%s", destination, err.Error()))
+ continue
+ }
+ os.Remove(source)
+ }
+ return messages, nil
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go b/vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go
index 562e0f62b..d4720ee94 100644
--- a/vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go
+++ b/vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go
@@ -13,9 +13,11 @@ package reporters
import (
"encoding/xml"
"fmt"
+ "maps"
"os"
"path"
"regexp"
+ "slices"
"strings"
"github.com/onsi/ginkgo/v2/config"
@@ -36,6 +38,12 @@ type JunitReportConfig struct {
// Enable OmitSpecLabels to prevent labels from appearing in the spec name
OmitSpecLabels bool
+ // Enable OmitSpecSemVerConstraints to prevent semantic version constraints from appearing in the spec name
+ OmitSpecSemVerConstraints bool
+
+ // Enable OmitSpecComponentSemVerConstraints to prevent component semantic version constraints from appearing in the spec name
+ OmitSpecComponentSemVerConstraints bool
+
// Enable OmitLeafNodeType to prevent the spec leaf node type from appearing in the spec name
OmitLeafNodeType bool
@@ -169,9 +177,12 @@ func GenerateJUnitReportWithConfig(report types.Report, dst string, config Junit
{"SuiteHasProgrammaticFocus", fmt.Sprintf("%t", report.SuiteHasProgrammaticFocus)},
{"SpecialSuiteFailureReason", strings.Join(report.SpecialSuiteFailureReasons, ",")},
{"SuiteLabels", fmt.Sprintf("[%s]", strings.Join(report.SuiteLabels, ","))},
+ {"SuiteSemVerConstraints", fmt.Sprintf("[%s]", strings.Join(report.SuiteSemVerConstraints, ","))},
+ {"SuiteComponentSemVerConstraints", fmt.Sprintf("[%s]", formatComponentSemVerConstraintsToString(report.SuiteComponentSemVerConstraints))},
{"RandomSeed", fmt.Sprintf("%d", report.SuiteConfig.RandomSeed)},
{"RandomizeAllSpecs", fmt.Sprintf("%t", report.SuiteConfig.RandomizeAllSpecs)},
{"LabelFilter", report.SuiteConfig.LabelFilter},
+ {"SemVerFilter", report.SuiteConfig.SemVerFilter},
{"FocusStrings", strings.Join(report.SuiteConfig.FocusStrings, ",")},
{"SkipStrings", strings.Join(report.SuiteConfig.SkipStrings, ",")},
{"FocusFiles", strings.Join(report.SuiteConfig.FocusFiles, ";")},
@@ -207,6 +218,14 @@ func GenerateJUnitReportWithConfig(report types.Report, dst string, config Junit
owner = matches[1]
}
}
+ semVerConstraints := spec.SemVerConstraints()
+ if len(semVerConstraints) > 0 && !config.OmitSpecSemVerConstraints {
+ name = name + " [" + strings.Join(semVerConstraints, ", ") + "]"
+ }
+ componentSemVerConstraints := spec.ComponentSemVerConstraints()
+ if len(componentSemVerConstraints) > 0 && !config.OmitSpecComponentSemVerConstraints {
+ name = name + " [" + formatComponentSemVerConstraintsToString(componentSemVerConstraints) + "]"
+ }
name = strings.TrimSpace(name)
test := JUnitTestCase{
@@ -378,6 +397,16 @@ func systemOutForUnstructuredReporters(spec types.SpecReport) string {
return spec.CapturedStdOutErr
}
+func formatComponentSemVerConstraintsToString(componentSemVerConstraints map[string][]string) string {
+ var tmpStr string
+ for _, key := range slices.Sorted(maps.Keys(componentSemVerConstraints)) {
+ tmpStr = tmpStr + fmt.Sprintf("%s: %s, ", key, componentSemVerConstraints[key])
+ }
+
+ tmpStr = strings.TrimSuffix(tmpStr, ", ")
+ return tmpStr
+}
+
// Deprecated JUnitReporter (so folks can still compile their suites)
type JUnitReporter struct{}
diff --git a/vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go b/vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go
index e990ad82e..ed3e3a2bb 100644
--- a/vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go
+++ b/vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go
@@ -38,9 +38,17 @@ func GenerateTeamcityReport(report types.Report, dst string) error {
name := report.SuiteDescription
labels := report.SuiteLabels
+ semVerConstraints := report.SuiteSemVerConstraints
+ componentSemVerConstraints := report.SuiteComponentSemVerConstraints
if len(labels) > 0 {
name = name + " [" + strings.Join(labels, ", ") + "]"
}
+ if len(semVerConstraints) > 0 {
+ name = name + " [" + strings.Join(semVerConstraints, ", ") + "]"
+ }
+ if len(componentSemVerConstraints) > 0 {
+ name = name + " [" + formatComponentSemVerConstraintsToString(componentSemVerConstraints) + "]"
+ }
fmt.Fprintf(f, "##teamcity[testSuiteStarted name='%s']\n", tcEscape(name))
for _, spec := range report.SpecReports {
name := fmt.Sprintf("[%s]", spec.LeafNodeType)
@@ -51,6 +59,14 @@ func GenerateTeamcityReport(report types.Report, dst string) error {
if len(labels) > 0 {
name = name + " [" + strings.Join(labels, ", ") + "]"
}
+ semVerConstraints := spec.SemVerConstraints()
+ if len(semVerConstraints) > 0 {
+ name = name + " [" + strings.Join(semVerConstraints, ", ") + "]"
+ }
+ componentSemVerConstraints := spec.ComponentSemVerConstraints()
+ if len(componentSemVerConstraints) > 0 {
+ name = name + " [" + formatComponentSemVerConstraintsToString(componentSemVerConstraints) + "]"
+ }
name = tcEscape(name)
fmt.Fprintf(f, "##teamcity[testStarted name='%s']\n", name)
diff --git a/vendor/github.com/onsi/ginkgo/v2/reporting_dsl.go b/vendor/github.com/onsi/ginkgo/v2/reporting_dsl.go
index aa1a35176..4e86dba84 100644
--- a/vendor/github.com/onsi/ginkgo/v2/reporting_dsl.go
+++ b/vendor/github.com/onsi/ginkgo/v2/reporting_dsl.go
@@ -27,6 +27,8 @@ CurrentSpecReport returns information about the current running spec.
The returned object is a types.SpecReport which includes helper methods
to make extracting information about the spec easier.
+During construction of the test tree the result is empty.
+
You can learn more about SpecReport here: https://pkg.go.dev/github.com/onsi/ginkgo/types#SpecReport
You can learn more about CurrentSpecReport() here: https://onsi.github.io/ginkgo/#getting-a-report-for-the-current-spec
*/
@@ -34,6 +36,31 @@ func CurrentSpecReport() SpecReport {
return global.Suite.CurrentSpecReport()
}
+/*
+ConstructionNodeReport describes the container nodes during construction of
+the spec tree. It provides a subset of the information that is provided
+by SpecReport at runtime.
+
+It is documented here: [types.ConstructionNodeReport]
+*/
+type ConstructionNodeReport = types.ConstructionNodeReport
+
+/*
+CurrentConstructionNodeReport returns information about the current container nodes
+that are leading to the current path in the spec tree.
+The returned object is a types.ConstructionNodeReport which includes helper methods
+to make extracting information about the spec easier.
+
+May only be called during construction of the spec tree. It panics when
+called while tests are running. Use CurrentSpecReport instead in that
+phase.
+
+You can learn more about ConstructionNodeReport here: [types.ConstructionNodeReport]
+*/
+func CurrentTreeConstructionNodeReport() ConstructionNodeReport {
+ return global.Suite.CurrentConstructionNodeReport()
+}
+
/*
ReportEntryVisibility governs the visibility of ReportEntries in Ginkgo's console reporter
@@ -60,7 +87,7 @@ AddReportEntry() must be called within a Subject or Setup node - not in a Contai
You can learn more about Report Entries here: https://onsi.github.io/ginkgo/#attaching-data-to-reports
*/
-func AddReportEntry(name string, args ...interface{}) {
+func AddReportEntry(name string, args ...any) {
cl := types.NewCodeLocation(1)
reportEntry, err := internal.NewReportEntry(name, cl, args...)
if err != nil {
@@ -89,10 +116,10 @@ You can learn more about ReportBeforeEach here: https://onsi.github.io/ginkgo/#g
You can learn about interruptible nodes here: https://onsi.github.io/ginkgo/#spec-timeouts-and-interruptible-nodes
*/
func ReportBeforeEach(body any, args ...any) bool {
- combinedArgs := []interface{}{body}
+ combinedArgs := []any{body}
combinedArgs = append(combinedArgs, args...)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeReportBeforeEach, "", combinedArgs...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeReportBeforeEach, "", combinedArgs...)))
}
/*
@@ -113,10 +140,10 @@ You can learn more about ReportAfterEach here: https://onsi.github.io/ginkgo/#ge
You can learn about interruptible nodes here: https://onsi.github.io/ginkgo/#spec-timeouts-and-interruptible-nodes
*/
func ReportAfterEach(body any, args ...any) bool {
- combinedArgs := []interface{}{body}
+ combinedArgs := []any{body}
combinedArgs = append(combinedArgs, args...)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeReportAfterEach, "", combinedArgs...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeReportAfterEach, "", combinedArgs...)))
}
/*
@@ -143,9 +170,9 @@ You can learn more about Ginkgo's reporting infrastructure, including generating
You can learn about interruptible nodes here: https://onsi.github.io/ginkgo/#spec-timeouts-and-interruptible-nodes
*/
func ReportBeforeSuite(body any, args ...any) bool {
- combinedArgs := []interface{}{body}
+ combinedArgs := []any{body}
combinedArgs = append(combinedArgs, args...)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeReportBeforeSuite, "", combinedArgs...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeReportBeforeSuite, "", combinedArgs...)))
}
/*
@@ -165,7 +192,7 @@ ReportAfterSuite nodes must be created at the top-level (i.e. not nested in a Co
When running in parallel, Ginkgo ensures that only one of the parallel nodes runs the ReportAfterSuite and that it is passed a report that is aggregated across
all parallel nodes
-In addition to using ReportAfterSuite to programmatically generate suite reports, you can also generate JSON, JUnit, and Teamcity formatted reports using the --json-report, --junit-report, and --teamcity-report ginkgo CLI flags.
+In addition to using ReportAfterSuite to programmatically generate suite reports, you can also generate JSON, GoJSON, JUnit, and Teamcity formatted reports using the --json-report, --gojson-report, --junit-report, and --teamcity-report ginkgo CLI flags.
You cannot nest any other Ginkgo nodes within a ReportAfterSuite node's closure.
You can learn more about ReportAfterSuite here: https://onsi.github.io/ginkgo/#generating-reports-programmatically
@@ -174,10 +201,10 @@ You can learn more about Ginkgo's reporting infrastructure, including generating
You can learn about interruptible nodes here: https://onsi.github.io/ginkgo/#spec-timeouts-and-interruptible-nodes
*/
-func ReportAfterSuite(text string, body any, args ...interface{}) bool {
- combinedArgs := []interface{}{body}
+func ReportAfterSuite(text string, body any, args ...any) bool {
+ combinedArgs := []any{body}
combinedArgs = append(combinedArgs, args...)
- return pushNode(internal.NewNode(deprecationTracker, types.NodeTypeReportAfterSuite, text, combinedArgs...))
+ return pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeReportAfterSuite, text, combinedArgs...)))
}
func registerReportAfterSuiteNodeForAutogeneratedReports(reporterConfig types.ReporterConfig) {
@@ -188,6 +215,12 @@ func registerReportAfterSuiteNodeForAutogeneratedReports(reporterConfig types.Re
Fail(fmt.Sprintf("Failed to generate JSON report:\n%s", err.Error()))
}
}
+ if reporterConfig.GoJSONReport != "" {
+ err := reporters.GenerateGoTestJSONReport(report, reporterConfig.GoJSONReport)
+ if err != nil {
+ Fail(fmt.Sprintf("Failed to generate Go JSON report:\n%s", err.Error()))
+ }
+ }
if reporterConfig.JUnitReport != "" {
err := reporters.GenerateJUnitReport(report, reporterConfig.JUnitReport)
if err != nil {
@@ -206,6 +239,9 @@ func registerReportAfterSuiteNodeForAutogeneratedReports(reporterConfig types.Re
if reporterConfig.JSONReport != "" {
flags = append(flags, "--json-report")
}
+ if reporterConfig.GoJSONReport != "" {
+ flags = append(flags, "--gojson-report")
+ }
if reporterConfig.JUnitReport != "" {
flags = append(flags, "--junit-report")
}
@@ -213,9 +249,11 @@ func registerReportAfterSuiteNodeForAutogeneratedReports(reporterConfig types.Re
flags = append(flags, "--teamcity-report")
}
pushNode(internal.NewNode(
- deprecationTracker, types.NodeTypeReportAfterSuite,
- fmt.Sprintf("Autogenerated ReportAfterSuite for %s", strings.Join(flags, " ")),
- body,
- types.NewCustomCodeLocation("autogenerated by Ginkgo"),
+ internal.TransformNewNodeArgs(
+ exitIfErrors, deprecationTracker, types.NodeTypeReportAfterSuite,
+ fmt.Sprintf("Autogenerated ReportAfterSuite for %s", strings.Join(flags, " ")),
+ body,
+ types.NewCustomCodeLocation("autogenerated by Ginkgo"),
+ ),
))
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/table_dsl.go b/vendor/github.com/onsi/ginkgo/v2/table_dsl.go
index c7de7a8be..1031aa855 100644
--- a/vendor/github.com/onsi/ginkgo/v2/table_dsl.go
+++ b/vendor/github.com/onsi/ginkgo/v2/table_dsl.go
@@ -23,7 +23,7 @@ You can learn more about generating EntryDescriptions here: https://onsi.github.
*/
type EntryDescription string
-func (ed EntryDescription) render(args ...interface{}) string {
+func (ed EntryDescription) render(args ...any) string {
return fmt.Sprintf(string(ed), args...)
}
@@ -44,7 +44,7 @@ For example:
You can learn more about DescribeTable here: https://onsi.github.io/ginkgo/#table-specs
And can explore some Table patterns here: https://onsi.github.io/ginkgo/#table-specs-patterns
*/
-func DescribeTable(description string, args ...interface{}) bool {
+func DescribeTable(description string, args ...any) bool {
GinkgoHelper()
generateTable(description, false, args...)
return true
@@ -53,7 +53,7 @@ func DescribeTable(description string, args ...interface{}) bool {
/*
You can focus a table with `FDescribeTable`. This is equivalent to `FDescribe`.
*/
-func FDescribeTable(description string, args ...interface{}) bool {
+func FDescribeTable(description string, args ...any) bool {
GinkgoHelper()
args = append(args, internal.Focus)
generateTable(description, false, args...)
@@ -63,7 +63,7 @@ func FDescribeTable(description string, args ...interface{}) bool {
/*
You can mark a table as pending with `PDescribeTable`. This is equivalent to `PDescribe`.
*/
-func PDescribeTable(description string, args ...interface{}) bool {
+func PDescribeTable(description string, args ...any) bool {
GinkgoHelper()
args = append(args, internal.Pending)
generateTable(description, false, args...)
@@ -95,7 +95,7 @@ For example:
})
It("should return the expected message", func() {
- body, err := ioutil.ReadAll(resp.Body)
+ body, err := io.ReadAll(resp.Body)
Expect(err).NotTo(HaveOccurred())
Expect(string(body)).To(Equal(message))
})
@@ -109,7 +109,7 @@ Note that you **must** place define an It inside the body function.
You can learn more about DescribeTableSubtree here: https://onsi.github.io/ginkgo/#table-specs
And can explore some Table patterns here: https://onsi.github.io/ginkgo/#table-specs-patterns
*/
-func DescribeTableSubtree(description string, args ...interface{}) bool {
+func DescribeTableSubtree(description string, args ...any) bool {
GinkgoHelper()
generateTable(description, true, args...)
return true
@@ -118,7 +118,7 @@ func DescribeTableSubtree(description string, args ...interface{}) bool {
/*
You can focus a table with `FDescribeTableSubtree`. This is equivalent to `FDescribe`.
*/
-func FDescribeTableSubtree(description string, args ...interface{}) bool {
+func FDescribeTableSubtree(description string, args ...any) bool {
GinkgoHelper()
args = append(args, internal.Focus)
generateTable(description, true, args...)
@@ -128,7 +128,7 @@ func FDescribeTableSubtree(description string, args ...interface{}) bool {
/*
You can mark a table as pending with `PDescribeTableSubtree`. This is equivalent to `PDescribe`.
*/
-func PDescribeTableSubtree(description string, args ...interface{}) bool {
+func PDescribeTableSubtree(description string, args ...any) bool {
GinkgoHelper()
args = append(args, internal.Pending)
generateTable(description, true, args...)
@@ -144,9 +144,9 @@ var XDescribeTableSubtree = PDescribeTableSubtree
TableEntry represents an entry in a table test. You generally use the `Entry` constructor.
*/
type TableEntry struct {
- description interface{}
- decorations []interface{}
- parameters []interface{}
+ description any
+ decorations []any
+ parameters []any
codeLocation types.CodeLocation
}
@@ -162,7 +162,7 @@ If you want to generate interruptible specs simply write a Table function that a
You can learn more about Entry here: https://onsi.github.io/ginkgo/#table-specs
*/
-func Entry(description interface{}, args ...interface{}) TableEntry {
+func Entry(description any, args ...any) TableEntry {
GinkgoHelper()
decorations, parameters := internal.PartitionDecorations(args...)
return TableEntry{description: description, decorations: decorations, parameters: parameters, codeLocation: types.NewCodeLocation(0)}
@@ -171,7 +171,7 @@ func Entry(description interface{}, args ...interface{}) TableEntry {
/*
You can focus a particular entry with FEntry. This is equivalent to FIt.
*/
-func FEntry(description interface{}, args ...interface{}) TableEntry {
+func FEntry(description any, args ...any) TableEntry {
GinkgoHelper()
decorations, parameters := internal.PartitionDecorations(args...)
decorations = append(decorations, internal.Focus)
@@ -181,7 +181,7 @@ func FEntry(description interface{}, args ...interface{}) TableEntry {
/*
You can mark a particular entry as pending with PEntry. This is equivalent to PIt.
*/
-func PEntry(description interface{}, args ...interface{}) TableEntry {
+func PEntry(description any, args ...any) TableEntry {
GinkgoHelper()
decorations, parameters := internal.PartitionDecorations(args...)
decorations = append(decorations, internal.Pending)
@@ -196,17 +196,17 @@ var XEntry = PEntry
var contextType = reflect.TypeOf(new(context.Context)).Elem()
var specContextType = reflect.TypeOf(new(SpecContext)).Elem()
-func generateTable(description string, isSubtree bool, args ...interface{}) {
+func generateTable(description string, isSubtree bool, args ...any) {
GinkgoHelper()
cl := types.NewCodeLocation(0)
- containerNodeArgs := []interface{}{cl}
+ containerNodeArgs := []any{cl}
entries := []TableEntry{}
- var internalBody interface{}
+ var internalBody any
var internalBodyType reflect.Type
- var tableLevelEntryDescription interface{}
- tableLevelEntryDescription = func(args ...interface{}) string {
+ var tableLevelEntryDescription any
+ tableLevelEntryDescription = func(args ...any) string {
out := []string{}
for _, arg := range args {
out = append(out, fmt.Sprint(arg))
@@ -265,7 +265,7 @@ func generateTable(description string, isSubtree bool, args ...interface{}) {
err = types.GinkgoErrors.InvalidEntryDescription(entry.codeLocation)
}
- internalNodeArgs := []interface{}{entry.codeLocation}
+ internalNodeArgs := []any{entry.codeLocation}
internalNodeArgs = append(internalNodeArgs, entry.decorations...)
hasContext := false
@@ -290,7 +290,7 @@ func generateTable(description string, isSubtree bool, args ...interface{}) {
if err != nil {
panic(err)
}
- invokeFunction(internalBody, append([]interface{}{c}, entry.parameters...))
+ invokeFunction(internalBody, append([]any{c}, entry.parameters...))
})
if isSubtree {
exitIfErr(types.GinkgoErrors.ContextsCannotBeUsedInSubtreeTables(cl))
@@ -309,14 +309,14 @@ func generateTable(description string, isSubtree bool, args ...interface{}) {
internalNodeType = types.NodeTypeContainer
}
- pushNode(internal.NewNode(deprecationTracker, internalNodeType, description, internalNodeArgs...))
+ pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, internalNodeType, description, internalNodeArgs...)))
}
})
- pushNode(internal.NewNode(deprecationTracker, types.NodeTypeContainer, description, containerNodeArgs...))
+ pushNode(internal.NewNode(internal.TransformNewNodeArgs(exitIfErrors, deprecationTracker, types.NodeTypeContainer, description, containerNodeArgs...)))
}
-func invokeFunction(function interface{}, parameters []interface{}) []reflect.Value {
+func invokeFunction(function any, parameters []any) []reflect.Value {
inValues := make([]reflect.Value, len(parameters))
funcType := reflect.TypeOf(function)
@@ -339,7 +339,7 @@ func invokeFunction(function interface{}, parameters []interface{}) []reflect.Va
return reflect.ValueOf(function).Call(inValues)
}
-func validateParameters(function interface{}, parameters []interface{}, kind string, cl types.CodeLocation, hasContext bool) error {
+func validateParameters(function any, parameters []any, kind string, cl types.CodeLocation, hasContext bool) error {
funcType := reflect.TypeOf(function)
limit := funcType.NumIn()
offset := 0
@@ -377,7 +377,7 @@ func validateParameters(function interface{}, parameters []interface{}, kind str
return nil
}
-func computeValue(parameter interface{}, t reflect.Type) reflect.Value {
+func computeValue(parameter any, t reflect.Type) reflect.Value {
if parameter == nil {
return reflect.Zero(t)
} else {
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/around_node.go b/vendor/github.com/onsi/ginkgo/v2/types/around_node.go
new file mode 100644
index 000000000..a069e0623
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/types/around_node.go
@@ -0,0 +1,56 @@
+package types
+
+import (
+ "context"
+)
+
+type AroundNodeAllowedFuncs interface {
+ ~func(context.Context, func(context.Context)) | ~func(context.Context) context.Context | ~func()
+}
+type AroundNodeFunc func(ctx context.Context, body func(ctx context.Context))
+
+func AroundNode[F AroundNodeAllowedFuncs](f F, cl CodeLocation) AroundNodeDecorator {
+ if f == nil {
+ panic("BuildAroundNode cannot be called with a nil function.")
+ }
+ var aroundNodeFunc func(context.Context, func(context.Context))
+ switch x := any(f).(type) {
+ case func(context.Context, func(context.Context)):
+ aroundNodeFunc = x
+ case func(context.Context) context.Context:
+ aroundNodeFunc = func(ctx context.Context, body func(context.Context)) {
+ ctx = x(ctx)
+ body(ctx)
+ }
+ case func():
+ aroundNodeFunc = func(ctx context.Context, body func(context.Context)) {
+ x()
+ body(ctx)
+ }
+ }
+
+ return AroundNodeDecorator{
+ Body: aroundNodeFunc,
+ CodeLocation: cl,
+ }
+}
+
+type AroundNodeDecorator struct {
+ Body AroundNodeFunc
+ CodeLocation CodeLocation
+}
+
+type AroundNodes []AroundNodeDecorator
+
+func (an AroundNodes) Clone() AroundNodes {
+ out := make(AroundNodes, len(an))
+ copy(out, an)
+ return out
+}
+
+func (an AroundNodes) Append(other ...AroundNodeDecorator) AroundNodes {
+ out := make(AroundNodes, len(an)+len(other))
+ copy(out, an)
+ copy(out[len(an):], other)
+ return out
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/config.go b/vendor/github.com/onsi/ginkgo/v2/types/config.go
index 8c0dfab8c..f84703604 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/config.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/config.go
@@ -24,6 +24,7 @@ type SuiteConfig struct {
FocusFiles []string
SkipFiles []string
LabelFilter string
+ SemVerFilter string
FailOnPending bool
FailOnEmpty bool
FailFast bool
@@ -95,6 +96,7 @@ type ReporterConfig struct {
ForceNewlines bool
JSONReport string
+ GoJSONReport string
JUnitReport string
TeamcityReport string
}
@@ -111,7 +113,7 @@ func (rc ReporterConfig) Verbosity() VerbosityLevel {
}
func (rc ReporterConfig) WillGenerateReport() bool {
- return rc.JSONReport != "" || rc.JUnitReport != "" || rc.TeamcityReport != ""
+ return rc.JSONReport != "" || rc.GoJSONReport != "" || rc.JUnitReport != "" || rc.TeamcityReport != ""
}
func NewDefaultReporterConfig() ReporterConfig {
@@ -159,7 +161,7 @@ func (g CLIConfig) ComputedProcs() int {
n := 1
if g.Parallel {
- n = runtime.NumCPU()
+ n = runtime.GOMAXPROCS(-1)
if n > 4 {
n = n - 1
}
@@ -172,7 +174,7 @@ func (g CLIConfig) ComputedNumCompilers() int {
return g.NumCompilers
}
- return runtime.NumCPU()
+ return runtime.GOMAXPROCS(-1)
}
// Configuration for the Ginkgo CLI capturing available go flags
@@ -231,6 +233,10 @@ func (g GoFlagsConfig) BinaryMustBePreserved() bool {
return g.BlockProfile != "" || g.CPUProfile != "" || g.MemProfile != "" || g.MutexProfile != ""
}
+func (g GoFlagsConfig) NeedsSymbols() bool {
+ return g.BinaryMustBePreserved()
+}
+
// Configuration that were deprecated in 2.0
type deprecatedConfig struct {
DebugParallel bool
@@ -257,8 +263,12 @@ var FlagSections = GinkgoFlagSections{
{Key: "filter", Style: "{{cyan}}", Heading: "Filtering Tests"},
{Key: "failure", Style: "{{red}}", Heading: "Failure Handling"},
{Key: "output", Style: "{{magenta}}", Heading: "Controlling Output Formatting"},
- {Key: "code-and-coverage-analysis", Style: "{{orange}}", Heading: "Code and Coverage Analysis"},
- {Key: "performance-analysis", Style: "{{coral}}", Heading: "Performance Analysis"},
+ {Key: "code-and-coverage-analysis", Style: "{{orange}}", Heading: "Code and Coverage Analysis",
+ Description: "When generating a cover files, please pass a filename {{bold}}not{{/}} a path. To specify a different directory use {{magenta}}--output-dir{{/}}.",
+ },
+ {Key: "performance-analysis", Style: "{{coral}}", Heading: "Performance Analysis",
+ Description: "When generating profile files, please pass filenames {{bold}}not{{/}} a path. Ginkgo will generate a profile file with the given name in the package's directory. To specify a different directory use {{magenta}}--output-dir{{/}}.",
+ },
{Key: "debug", Style: "{{blue}}", Heading: "Debugging Tests",
Description: "In addition to these flags, Ginkgo supports a few debugging environment variables. To change the parallel server protocol set {{blue}}GINKGO_PARALLEL_PROTOCOL{{/}} to {{bold}}HTTP{{/}}. To avoid pruning callstacks set {{blue}}GINKGO_PRUNE_STACK{{/}} to {{bold}}FALSE{{/}}."},
{Key: "watch", Style: "{{light-yellow}}", Heading: "Controlling Ginkgo Watch"},
@@ -300,6 +310,8 @@ var SuiteConfigFlags = GinkgoFlags{
{KeyPath: "S.LabelFilter", Name: "label-filter", SectionKey: "filter", UsageArgument: "expression",
Usage: "If set, ginkgo will only run specs with labels that match the label-filter. The passed-in expression can include boolean operations (!, &&, ||, ','), groupings via '()', and regular expressions '/regexp/'. e.g. '(cat || dog) && !fruit'"},
+ {KeyPath: "S.SemVerFilter", Name: "sem-ver-filter", SectionKey: "filter", UsageArgument: "version",
+ Usage: "If set, ginkgo will only run specs with semantic version constraints that are satisfied by the provided version. e.g. '2.1.0'"},
{KeyPath: "S.FocusStrings", Name: "focus", SectionKey: "filter",
Usage: "If set, ginkgo will only run specs that match this regular expression. Can be specified multiple times, values are ORed."},
{KeyPath: "S.SkipStrings", Name: "skip", SectionKey: "filter",
@@ -348,6 +360,8 @@ var ReporterConfigFlags = GinkgoFlags{
{KeyPath: "R.JSONReport", Name: "json-report", UsageArgument: "filename.json", SectionKey: "output",
Usage: "If set, Ginkgo will generate a JSON-formatted test report at the specified location."},
+ {KeyPath: "R.GoJSONReport", Name: "gojson-report", UsageArgument: "filename.json", SectionKey: "output",
+ Usage: "If set, Ginkgo will generate a Go JSON-formatted test report at the specified location."},
{KeyPath: "R.JUnitReport", Name: "junit-report", UsageArgument: "filename.xml", SectionKey: "output", DeprecatedName: "reportFile", DeprecatedDocLink: "improved-reporting-infrastructure",
Usage: "If set, Ginkgo will generate a conformant junit test report in the specified file."},
{KeyPath: "R.TeamcityReport", Name: "teamcity-report", UsageArgument: "filename", SectionKey: "output",
@@ -365,7 +379,7 @@ var ReporterConfigFlags = GinkgoFlags{
func BuildTestSuiteFlagSet(suiteConfig *SuiteConfig, reporterConfig *ReporterConfig) (GinkgoFlagSet, error) {
flags := SuiteConfigFlags.CopyAppend(ParallelConfigFlags...).CopyAppend(ReporterConfigFlags...)
flags = flags.WithPrefix("ginkgo")
- bindings := map[string]interface{}{
+ bindings := map[string]any{
"S": suiteConfig,
"R": reporterConfig,
"D": &deprecatedConfig{},
@@ -435,6 +449,13 @@ func VetConfig(flagSet GinkgoFlagSet, suiteConfig SuiteConfig, reporterConfig Re
}
}
+ if suiteConfig.SemVerFilter != "" {
+ _, err := ParseSemVerFilter(suiteConfig.SemVerFilter)
+ if err != nil {
+ errors = append(errors, err)
+ }
+ }
+
switch strings.ToLower(suiteConfig.OutputInterceptorMode) {
case "", "dup", "swap", "none":
default:
@@ -515,7 +536,7 @@ var GoBuildFlags = GinkgoFlags{
{KeyPath: "Go.Race", Name: "race", SectionKey: "code-and-coverage-analysis",
Usage: "enable data race detection. Supported on linux/amd64, linux/ppc64le, linux/arm64, linux/s390x, freebsd/amd64, netbsd/amd64, darwin/amd64, darwin/arm64, and windows/amd64."},
{KeyPath: "Go.Vet", Name: "vet", UsageArgument: "list", SectionKey: "code-and-coverage-analysis",
- Usage: `Configure the invocation of "go vet" during "go test" to use the comma-separated list of vet checks. If list is empty, "go test" runs "go vet" with a curated list of checks believed to be always worth addressing. If list is "off", "go test" does not run "go vet" at all. Available checks can be found by running 'go doc cmd/vet'`},
+ Usage: `Configure the invocation of "go vet" during "go test" to use the comma-separated list of vet checks. If list is empty (by explicitly passing --vet=""), "go test" runs "go vet" with a curated list of checks believed to be always worth addressing. If list is "off", "go test" does not run "go vet" at all. Available checks can be found by running 'go doc cmd/vet'`},
{KeyPath: "Go.Cover", Name: "cover", SectionKey: "code-and-coverage-analysis",
Usage: "Enable coverage analysis. Note that because coverage works by annotating the source code before compilation, compilation and test failures with coverage enabled may report line numbers that don't correspond to the original sources."},
{KeyPath: "Go.CoverMode", Name: "covermode", UsageArgument: "set,count,atomic", SectionKey: "code-and-coverage-analysis",
@@ -565,6 +586,9 @@ var GoBuildFlags = GinkgoFlags{
Usage: "print the name of the temporary work directory and do not delete it when exiting."},
{KeyPath: "Go.X", Name: "x", SectionKey: "go-build",
Usage: "print the commands."},
+}
+
+var GoBuildOFlags = GinkgoFlags{
{KeyPath: "Go.O", Name: "o", SectionKey: "go-build",
Usage: "output binary path (including name)."},
}
@@ -572,7 +596,7 @@ var GoBuildFlags = GinkgoFlags{
// GoRunFlags provides flags for the Ginkgo CLI run, and watch commands that capture go's run-time flags. These are passed to the compiled test binary by the ginkgo CLI
var GoRunFlags = GinkgoFlags{
{KeyPath: "Go.CoverProfile", Name: "coverprofile", UsageArgument: "file", SectionKey: "code-and-coverage-analysis",
- Usage: `Write a coverage profile to the file after all tests have passed. Sets -cover.`},
+ Usage: `Write a coverage profile to the file after all tests have passed. Sets -cover. Must be passed a filename, not a path. Use output-dir to control the location of the output.`},
{KeyPath: "Go.BlockProfile", Name: "blockprofile", UsageArgument: "file", SectionKey: "performance-analysis",
Usage: `Write a goroutine blocking profile to the specified file when all tests are complete. Preserves test binary.`},
{KeyPath: "Go.BlockProfileRate", Name: "blockprofilerate", UsageArgument: "rate", SectionKey: "performance-analysis",
@@ -600,6 +624,22 @@ func VetAndInitializeCLIAndGoConfig(cliConfig CLIConfig, goFlagsConfig GoFlagsCo
errors = append(errors, GinkgoErrors.BothRepeatAndUntilItFails())
}
+ if strings.ContainsRune(goFlagsConfig.CoverProfile, os.PathSeparator) {
+ errors = append(errors, GinkgoErrors.ExpectFilenameNotPath("--coverprofile", goFlagsConfig.CoverProfile))
+ }
+ if strings.ContainsRune(goFlagsConfig.CPUProfile, os.PathSeparator) {
+ errors = append(errors, GinkgoErrors.ExpectFilenameNotPath("--cpuprofile", goFlagsConfig.CPUProfile))
+ }
+ if strings.ContainsRune(goFlagsConfig.MemProfile, os.PathSeparator) {
+ errors = append(errors, GinkgoErrors.ExpectFilenameNotPath("--memprofile", goFlagsConfig.MemProfile))
+ }
+ if strings.ContainsRune(goFlagsConfig.BlockProfile, os.PathSeparator) {
+ errors = append(errors, GinkgoErrors.ExpectFilenameNotPath("--blockprofile", goFlagsConfig.BlockProfile))
+ }
+ if strings.ContainsRune(goFlagsConfig.MutexProfile, os.PathSeparator) {
+ errors = append(errors, GinkgoErrors.ExpectFilenameNotPath("--mutexprofile", goFlagsConfig.MutexProfile))
+ }
+
//initialize the output directory
if cliConfig.OutputDir != "" {
err := os.MkdirAll(cliConfig.OutputDir, 0777)
@@ -620,7 +660,7 @@ func VetAndInitializeCLIAndGoConfig(cliConfig CLIConfig, goFlagsConfig GoFlagsCo
}
// GenerateGoTestCompileArgs is used by the Ginkgo CLI to generate command line arguments to pass to the go test -c command when compiling the test
-func GenerateGoTestCompileArgs(goFlagsConfig GoFlagsConfig, packageToBuild string, pathToInvocationPath string) ([]string, error) {
+func GenerateGoTestCompileArgs(goFlagsConfig GoFlagsConfig, packageToBuild string, pathToInvocationPath string, preserveSymbols bool) ([]string, error) {
// if the user has set the CoverProfile run-time flag make sure to set the build-time cover flag to make sure
// the built test binary can generate a coverprofile
if goFlagsConfig.CoverProfile != "" {
@@ -643,10 +683,14 @@ func GenerateGoTestCompileArgs(goFlagsConfig GoFlagsConfig, packageToBuild strin
goFlagsConfig.CoverPkg = strings.Join(adjustedCoverPkgs, ",")
}
+ if !goFlagsConfig.NeedsSymbols() && goFlagsConfig.LDFlags == "" && !preserveSymbols {
+ goFlagsConfig.LDFlags = "-w -s"
+ }
+
args := []string{"test", "-c", packageToBuild}
goArgs, err := GenerateFlagArgs(
- GoBuildFlags,
- map[string]interface{}{
+ GoBuildFlags.CopyAppend(GoBuildOFlags...),
+ map[string]any{
"Go": &goFlagsConfig,
},
)
@@ -665,7 +709,7 @@ func GenerateGinkgoTestRunArgs(suiteConfig SuiteConfig, reporterConfig ReporterC
flags = flags.CopyAppend(ParallelConfigFlags.WithPrefix("ginkgo")...)
flags = flags.CopyAppend(ReporterConfigFlags.WithPrefix("ginkgo")...)
flags = flags.CopyAppend(GoRunFlags.WithPrefix("test")...)
- bindings := map[string]interface{}{
+ bindings := map[string]any{
"S": &suiteConfig,
"R": &reporterConfig,
"Go": &goFlagsConfig,
@@ -677,7 +721,7 @@ func GenerateGinkgoTestRunArgs(suiteConfig SuiteConfig, reporterConfig ReporterC
// GenerateGoTestRunArgs is used by the Ginkgo CLI to generate command line arguments to pass to the compiled non-Ginkgo test binary
func GenerateGoTestRunArgs(goFlagsConfig GoFlagsConfig) ([]string, error) {
flags := GoRunFlags.WithPrefix("test")
- bindings := map[string]interface{}{
+ bindings := map[string]any{
"Go": &goFlagsConfig,
}
@@ -699,7 +743,7 @@ func BuildRunCommandFlagSet(suiteConfig *SuiteConfig, reporterConfig *ReporterCo
flags = flags.CopyAppend(GoBuildFlags...)
flags = flags.CopyAppend(GoRunFlags...)
- bindings := map[string]interface{}{
+ bindings := map[string]any{
"S": suiteConfig,
"R": reporterConfig,
"C": cliConfig,
@@ -720,7 +764,7 @@ func BuildWatchCommandFlagSet(suiteConfig *SuiteConfig, reporterConfig *Reporter
flags = flags.CopyAppend(GoBuildFlags...)
flags = flags.CopyAppend(GoRunFlags...)
- bindings := map[string]interface{}{
+ bindings := map[string]any{
"S": suiteConfig,
"R": reporterConfig,
"C": cliConfig,
@@ -735,8 +779,9 @@ func BuildWatchCommandFlagSet(suiteConfig *SuiteConfig, reporterConfig *Reporter
func BuildBuildCommandFlagSet(cliConfig *CLIConfig, goFlagsConfig *GoFlagsConfig) (GinkgoFlagSet, error) {
flags := GinkgoCLISharedFlags
flags = flags.CopyAppend(GoBuildFlags...)
+ flags = flags.CopyAppend(GoBuildOFlags...)
- bindings := map[string]interface{}{
+ bindings := map[string]any{
"C": cliConfig,
"Go": goFlagsConfig,
"D": &deprecatedConfig{},
@@ -760,7 +805,7 @@ func BuildBuildCommandFlagSet(cliConfig *CLIConfig, goFlagsConfig *GoFlagsConfig
func BuildLabelsCommandFlagSet(cliConfig *CLIConfig) (GinkgoFlagSet, error) {
flags := GinkgoCLISharedFlags.SubsetWithNames("r", "skip-package")
- bindings := map[string]interface{}{
+ bindings := map[string]any{
"C": cliConfig,
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/deprecated_types.go b/vendor/github.com/onsi/ginkgo/v2/types/deprecated_types.go
index 17922304b..518989a84 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/deprecated_types.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/deprecated_types.go
@@ -113,7 +113,7 @@ type DeprecatedSpecFailure struct {
type DeprecatedSpecMeasurement struct {
Name string
- Info interface{}
+ Info any
Order int
Results []float64
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/errors.go b/vendor/github.com/onsi/ginkgo/v2/types/errors.go
index 6bb72d00c..623e54b66 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/errors.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/errors.go
@@ -88,7 +88,7 @@ body of a {{bold}}Describe{{/}}, {{bold}}Context{{/}}, or {{bold}}When{{/}}.`, n
}
}
-func (g ginkgoErrors) CaughtPanicDuringABuildPhase(caughtPanic interface{}, cl CodeLocation) error {
+func (g ginkgoErrors) CaughtPanicDuringABuildPhase(caughtPanic any, cl CodeLocation) error {
return GinkgoError{
Heading: "Assertion or Panic detected during tree construction",
Message: formatter.F(
@@ -189,7 +189,7 @@ func (g ginkgoErrors) InvalidDeclarationOfFlakeAttemptsAndMustPassRepeatedly(cl
}
}
-func (g ginkgoErrors) UnknownDecorator(cl CodeLocation, nodeType NodeType, decorator interface{}) error {
+func (g ginkgoErrors) UnknownDecorator(cl CodeLocation, nodeType NodeType, decorator any) error {
return GinkgoError{
Heading: "Unknown Decorator",
Message: formatter.F(`[%s] node was passed an unknown decorator: '%#v'`, nodeType, decorator),
@@ -345,7 +345,7 @@ func (g ginkgoErrors) PushingCleanupInCleanupNode(cl CodeLocation) error {
}
/* ReportEntry errors */
-func (g ginkgoErrors) TooManyReportEntryValues(cl CodeLocation, arg interface{}) error {
+func (g ginkgoErrors) TooManyReportEntryValues(cl CodeLocation, arg any) error {
return GinkgoError{
Heading: "Too Many ReportEntry Values",
Message: formatter.F(`{{bold}}AddGinkgoReport{{/}} can only be given one value. Got unexpected value: %#v`, arg),
@@ -432,6 +432,33 @@ func (g ginkgoErrors) InvalidEmptyLabel(cl CodeLocation) error {
}
}
+func (g ginkgoErrors) InvalidSemVerConstraint(semVerConstraint, errMsg string, cl CodeLocation) error {
+ return GinkgoError{
+ Heading: "Invalid SemVerConstraint",
+ Message: fmt.Sprintf("'%s' is an invalid SemVerConstraint: %s", semVerConstraint, errMsg),
+ CodeLocation: cl,
+ DocLink: "spec-semantic-version-filtering",
+ }
+}
+
+func (g ginkgoErrors) InvalidEmptySemVerConstraint(cl CodeLocation) error {
+ return GinkgoError{
+ Heading: "Invalid Empty SemVerConstraint",
+ Message: "SemVerConstraint cannot be empty",
+ CodeLocation: cl,
+ DocLink: "spec-semantic-version-filtering",
+ }
+}
+
+func (g ginkgoErrors) InvalidEmptyComponentForSemVerConstraint(cl CodeLocation) error {
+ return GinkgoError{
+ Heading: "Invalid Empty Component for ComponentSemVerConstraint",
+ Message: "ComponentSemVerConstraint requires a non-empty component name",
+ CodeLocation: cl,
+ DocLink: "spec-semantic-version-filtering",
+ }
+}
+
/* Table errors */
func (g ginkgoErrors) MultipleEntryBodyFunctionsForTable(cl CodeLocation) error {
return GinkgoError{
@@ -539,7 +566,7 @@ func (g ginkgoErrors) SynchronizedBeforeSuiteDisappearedOnProc1() error {
/* Configuration errors */
-func (g ginkgoErrors) UnknownTypePassedToRunSpecs(value interface{}) error {
+func (g ginkgoErrors) UnknownTypePassedToRunSpecs(value any) error {
return GinkgoError{
Heading: "Unknown Type passed to RunSpecs",
Message: fmt.Sprintf("RunSpecs() accepts labels, and configuration of type types.SuiteConfig and/or types.ReporterConfig.\n You passed in: %v", value),
@@ -629,6 +656,20 @@ func (g ginkgoErrors) BothRepeatAndUntilItFails() error {
}
}
+func (g ginkgoErrors) ExpectFilenameNotPath(flag string, path string) error {
+ return GinkgoError{
+ Heading: fmt.Sprintf("%s expects a filename but was given a path: %s", flag, path),
+ Message: fmt.Sprintf("%s takes a filename, not a path. Use --output-dir to specify a directory to collect all test outputs.", flag),
+ }
+}
+
+func (g ginkgoErrors) FlagAfterPositionalParameter() error {
+ return GinkgoError{
+ Heading: "Malformed arguments - detected a flag after the package liste",
+ Message: "Make sure all flags appear {{bold}}after{{/}} the Ginkgo subcommand and {{bold}}before{{/}} your list of packages (or './...').\n{{gray}}e.g. 'ginkgo run -p my_package' is valid but `ginkgo -p run my_package` is not.\n{{gray}}e.g. 'ginkgo -p -vet=\"\" ./...' is valid but 'ginkgo -p ./... -vet=\"\"' is not{{/}}",
+ }
+}
+
/* Stack-Trace parsing errors */
func (g ginkgoErrors) FailedToParseStackTrace(message string) error {
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/flags.go b/vendor/github.com/onsi/ginkgo/v2/types/flags.go
index de69f3022..8409653f9 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/flags.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/flags.go
@@ -92,7 +92,7 @@ func (gfs GinkgoFlagSections) Lookup(key string) (GinkgoFlagSection, bool) {
type GinkgoFlagSet struct {
flags GinkgoFlags
- bindings interface{}
+ bindings any
sections GinkgoFlagSections
extraGoFlagsSection GinkgoFlagSection
@@ -101,7 +101,7 @@ type GinkgoFlagSet struct {
}
// Call NewGinkgoFlagSet to create GinkgoFlagSet that creates and binds to it's own *flag.FlagSet
-func NewGinkgoFlagSet(flags GinkgoFlags, bindings interface{}, sections GinkgoFlagSections) (GinkgoFlagSet, error) {
+func NewGinkgoFlagSet(flags GinkgoFlags, bindings any, sections GinkgoFlagSections) (GinkgoFlagSet, error) {
return bindFlagSet(GinkgoFlagSet{
flags: flags,
bindings: bindings,
@@ -110,7 +110,7 @@ func NewGinkgoFlagSet(flags GinkgoFlags, bindings interface{}, sections GinkgoFl
}
// Call NewGinkgoFlagSet to create GinkgoFlagSet that extends an existing *flag.FlagSet
-func NewAttachedGinkgoFlagSet(flagSet *flag.FlagSet, flags GinkgoFlags, bindings interface{}, sections GinkgoFlagSections, extraGoFlagsSection GinkgoFlagSection) (GinkgoFlagSet, error) {
+func NewAttachedGinkgoFlagSet(flagSet *flag.FlagSet, flags GinkgoFlags, bindings any, sections GinkgoFlagSections, extraGoFlagsSection GinkgoFlagSection) (GinkgoFlagSet, error) {
return bindFlagSet(GinkgoFlagSet{
flags: flags,
bindings: bindings,
@@ -335,7 +335,7 @@ func (f GinkgoFlagSet) substituteUsage() {
fmt.Fprintln(f.flagSet.Output(), f.Usage())
}
-func valueAtKeyPath(root interface{}, keyPath string) (reflect.Value, bool) {
+func valueAtKeyPath(root any, keyPath string) (reflect.Value, bool) {
if len(keyPath) == 0 {
return reflect.Value{}, false
}
@@ -433,7 +433,7 @@ func (ssv stringSliceVar) Set(s string) error {
}
// given a set of GinkgoFlags and bindings, generate flag arguments suitable to be passed to an application with that set of flags configured.
-func GenerateFlagArgs(flags GinkgoFlags, bindings interface{}) ([]string, error) {
+func GenerateFlagArgs(flags GinkgoFlags, bindings any) ([]string, error) {
result := []string{}
for _, flag := range flags {
name := flag.ExportAs
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/label_filter.go b/vendor/github.com/onsi/ginkgo/v2/types/label_filter.go
index 7fdc8aa23..40a909b6d 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/label_filter.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/label_filter.go
@@ -343,7 +343,7 @@ func tokenize(input string) func() (*treeNode, error) {
consumeUntil := func(cutset string) (string, int) {
j := i
for ; j < len(runes); j++ {
- if strings.IndexRune(cutset, runes[j]) >= 0 {
+ if strings.ContainsRune(cutset, runes[j]) {
break
}
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/report_entry.go b/vendor/github.com/onsi/ginkgo/v2/types/report_entry.go
index 7b1524b52..63f7a9f6d 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/report_entry.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/report_entry.go
@@ -9,18 +9,18 @@ import (
// ReportEntryValue wraps a report entry's value ensuring it can be encoded and decoded safely into reports
// and across the network connection when running in parallel
type ReportEntryValue struct {
- raw interface{} //unexported to prevent gob from freaking out about unregistered structs
+ raw any //unexported to prevent gob from freaking out about unregistered structs
AsJSON string
Representation string
}
-func WrapEntryValue(value interface{}) ReportEntryValue {
+func WrapEntryValue(value any) ReportEntryValue {
return ReportEntryValue{
raw: value,
}
}
-func (rev ReportEntryValue) GetRawValue() interface{} {
+func (rev ReportEntryValue) GetRawValue() any {
return rev.raw
}
@@ -118,7 +118,7 @@ func (entry ReportEntry) StringRepresentation() string {
// If used from a rehydrated JSON file _or_ in a ReportAfterSuite when running in parallel this will be
// a JSON-decoded {}interface. If you want to reconstitute your original object you can decode the entry.Value.AsJSON
// field yourself.
-func (entry ReportEntry) GetRawValue() interface{} {
+func (entry ReportEntry) GetRawValue() any {
return entry.Value.GetRawValue()
}
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/semver_filter.go b/vendor/github.com/onsi/ginkgo/v2/types/semver_filter.go
new file mode 100644
index 000000000..71778078d
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/types/semver_filter.go
@@ -0,0 +1,121 @@
+package types
+
+import (
+ "fmt"
+ "strings"
+
+ "github.com/Masterminds/semver/v3"
+)
+
+type SemVerFilter func(component string, constraints []string) bool
+
+func MustParseSemVerFilter(input string) SemVerFilter {
+ filter, err := ParseSemVerFilter(input)
+ if err != nil {
+ panic(err)
+ }
+ return filter
+}
+
+// ParseSemVerFilter parses non-component and component-specific semantic version filter string.
+// The filter string can contain multiple non-component and component-specific versions separated by commas.
+// Each component-specific version is in the format "component=version".
+// If a version is specified without a component, it applies to non-component-specific constraints.
+func ParseSemVerFilter(componentFilterVersions string) (SemVerFilter, error) {
+ if componentFilterVersions == "" {
+ return func(_ string, _ []string) bool { return true }, nil
+ }
+
+ result := map[string]*semver.Version{}
+ parts := strings.Split(componentFilterVersions, ",")
+ for _, part := range parts {
+ part = strings.TrimSpace(part)
+ if len(part) == 0 {
+ continue
+ }
+ if strings.Contains(part, "=") {
+ // validate component-specific version string
+ invalidPart, invalidErr := false, fmt.Errorf("invalid component filter version: %s", part)
+ subParts := strings.Split(part, "=")
+ if len(subParts) != 2 {
+ invalidPart = true
+ }
+ component := strings.TrimSpace(subParts[0])
+ versionStr := strings.TrimSpace(subParts[1])
+ if len(component) == 0 || len(versionStr) == 0 {
+ invalidPart = true
+ }
+ if invalidPart {
+ return nil, invalidErr
+ }
+
+ // validate semver
+ v, err := semver.NewVersion(versionStr)
+ if err != nil {
+ return nil, fmt.Errorf("invalid component filter version: %s, error: %w", part, err)
+ }
+ result[component] = v
+ } else {
+ v, err := semver.NewVersion(part)
+ if err != nil {
+ return nil, fmt.Errorf("invalid filter version: %s, error: %w", part, err)
+ }
+ result[""] = v
+ }
+ }
+
+ return func(component string, constraints []string) bool {
+ // unconstrained specs always run
+ if len(component) == 0 && len(constraints) == 0 {
+ return true
+ }
+
+ // check non-component specific version constraints
+ if len(component) == 0 && len(constraints) != 0 {
+ v := result[""]
+ if v != nil {
+ for _, constraintStr := range constraints {
+ constraint, err := semver.NewConstraint(constraintStr)
+ if err != nil {
+ return false
+ }
+
+ if !constraint.Check(v) {
+ return false
+ }
+ }
+ }
+ }
+
+ // check component-specific version constraints
+ if len(component) != 0 && len(constraints) != 0 {
+ v := result[component]
+ if v != nil {
+ for _, constraintStr := range constraints {
+ constraint, err := semver.NewConstraint(constraintStr)
+ if err != nil {
+ return false
+ }
+
+ if !constraint.Check(v) {
+ return false
+ }
+ }
+ }
+ }
+
+ return true
+ }, nil
+}
+
+func ValidateAndCleanupSemVerConstraint(semVerConstraint string, cl CodeLocation) (string, error) {
+ if len(semVerConstraint) == 0 {
+ return "", GinkgoErrors.InvalidEmptySemVerConstraint(cl)
+ }
+ _, err := semver.NewConstraint(semVerConstraint)
+ if err != nil {
+ return "", GinkgoErrors.InvalidSemVerConstraint(semVerConstraint, err.Error(), cl)
+ }
+
+ return semVerConstraint, nil
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/types.go b/vendor/github.com/onsi/ginkgo/v2/types/types.go
index ddcbec1ba..240150512 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/types.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/types.go
@@ -4,6 +4,7 @@ import (
"encoding/json"
"fmt"
"os"
+ "slices"
"sort"
"strings"
"time"
@@ -19,6 +20,61 @@ func init() {
}
}
+// ConstructionNodeReport captures information about a Ginkgo spec.
+type ConstructionNodeReport struct {
+ // ContainerHierarchyTexts is a slice containing the text strings of
+ // all Describe/Context/When containers in this spec's hierarchy.
+ ContainerHierarchyTexts []string
+
+ // ContainerHierarchyLocations is a slice containing the CodeLocations of
+ // all Describe/Context/When containers in this spec's hierarchy.
+ ContainerHierarchyLocations []CodeLocation
+
+ // ContainerHierarchyLabels is a slice containing the labels of
+ // all Describe/Context/When containers in this spec's hierarchy
+ ContainerHierarchyLabels [][]string
+
+ // ContainerHierarchySemVerConstraints is a slice containing the semVerConstraints of
+ // all Describe/Context/When containers in this spec's hierarchy
+ ContainerHierarchySemVerConstraints [][]string
+
+ // ContainerHierarchyComponentSemVerConstraints is a slice containing the component-specific semVerConstraints of
+ // all Describe/Context/When containers in this spec's hierarchy
+ ContainerHierarchyComponentSemVerConstraints []map[string][]string
+
+ // IsSerial captures whether the any container has the Serial decorator
+ IsSerial bool
+
+ // IsInOrderedContainer captures whether any container is an Ordered container
+ IsInOrderedContainer bool
+}
+
+// FullText returns a concatenation of all the report.ContainerHierarchyTexts and report.LeafNodeText
+func (report ConstructionNodeReport) FullText() string {
+ texts := []string{}
+ texts = append(texts, report.ContainerHierarchyTexts...)
+ texts = slices.DeleteFunc(texts, func(t string) bool {
+ return t == ""
+ })
+ return strings.Join(texts, " ")
+}
+
+// Labels returns a deduped set of all the spec's Labels.
+func (report ConstructionNodeReport) Labels() []string {
+ out := []string{}
+ seen := map[string]bool{}
+ for _, labels := range report.ContainerHierarchyLabels {
+ for _, label := range labels {
+ if !seen[label] {
+ seen[label] = true
+ out = append(out, label)
+ }
+ }
+ }
+
+ return out
+}
+
// Report captures information about a Ginkgo test run
type Report struct {
//SuitePath captures the absolute path to the test suite
@@ -30,6 +86,12 @@ type Report struct {
//SuiteLabels captures any labels attached to the suite by the DSL's RunSpecs() function
SuiteLabels []string
+ //SuiteSemVerConstraints captures any semVerConstraints attached to the suite by the DSL's RunSpecs() function
+ SuiteSemVerConstraints []string
+
+ //SuiteComponentSemVerConstraints captures any component-specific semVerConstraints attached to the suite by the DSL's RunSpecs() function
+ SuiteComponentSemVerConstraints map[string][]string
+
//SuiteSucceeded captures the success or failure status of the test run
//If true, the test run is considered successful.
//If false, the test run is considered unsuccessful
@@ -129,13 +191,26 @@ type SpecReport struct {
// all Describe/Context/When containers in this spec's hierarchy
ContainerHierarchyLabels [][]string
- // LeafNodeType, LeadNodeLocation, LeafNodeLabels and LeafNodeText capture the NodeType, CodeLocation, and text
+ // ContainerHierarchySemVerConstraints is a slice containing the semVerConstraints of
+ // all Describe/Context/When containers in this spec's hierarchy
+ ContainerHierarchySemVerConstraints [][]string
+
+ // ContainerHierarchyComponentSemVerConstraints is a slice containing the component-specific semVerConstraints of
+ // all Describe/Context/When containers in this spec's hierarchy
+ ContainerHierarchyComponentSemVerConstraints []map[string][]string
+
+ // LeafNodeType, LeafNodeLocation, LeafNodeLabels, LeafNodeSemVerConstraints and LeafNodeText capture the NodeType, CodeLocation, and text
// of the Ginkgo node being tested (typically an NodeTypeIt node, though this can also be
// one of the NodeTypesForSuiteLevelNodes node types)
- LeafNodeType NodeType
- LeafNodeLocation CodeLocation
- LeafNodeLabels []string
- LeafNodeText string
+ LeafNodeType NodeType
+ LeafNodeLocation CodeLocation
+ LeafNodeLabels []string
+ LeafNodeSemVerConstraints []string
+ LeafNodeComponentSemVerConstraints map[string][]string
+ LeafNodeText string
+
+ // Captures the Spec Priority
+ SpecPriority int
// State captures whether the spec has passed, failed, etc.
State SpecState
@@ -198,48 +273,54 @@ type SpecReport struct {
func (report SpecReport) MarshalJSON() ([]byte, error) {
//All this to avoid emitting an empty Failure struct in the JSON
out := struct {
- ContainerHierarchyTexts []string
- ContainerHierarchyLocations []CodeLocation
- ContainerHierarchyLabels [][]string
- LeafNodeType NodeType
- LeafNodeLocation CodeLocation
- LeafNodeLabels []string
- LeafNodeText string
- State SpecState
- StartTime time.Time
- EndTime time.Time
- RunTime time.Duration
- ParallelProcess int
- Failure *Failure `json:",omitempty"`
- NumAttempts int
- MaxFlakeAttempts int
- MaxMustPassRepeatedly int
- CapturedGinkgoWriterOutput string `json:",omitempty"`
- CapturedStdOutErr string `json:",omitempty"`
- ReportEntries ReportEntries `json:",omitempty"`
- ProgressReports []ProgressReport `json:",omitempty"`
- AdditionalFailures []AdditionalFailure `json:",omitempty"`
- SpecEvents SpecEvents `json:",omitempty"`
+ ContainerHierarchyTexts []string
+ ContainerHierarchyLocations []CodeLocation
+ ContainerHierarchyLabels [][]string
+ ContainerHierarchySemVerConstraints [][]string
+ ContainerHierarchyComponentSemVerConstraints []map[string][]string
+ LeafNodeType NodeType
+ LeafNodeLocation CodeLocation
+ LeafNodeLabels []string
+ LeafNodeSemVerConstraints []string
+ LeafNodeText string
+ State SpecState
+ StartTime time.Time
+ EndTime time.Time
+ RunTime time.Duration
+ ParallelProcess int
+ Failure *Failure `json:",omitempty"`
+ NumAttempts int
+ MaxFlakeAttempts int
+ MaxMustPassRepeatedly int
+ CapturedGinkgoWriterOutput string `json:",omitempty"`
+ CapturedStdOutErr string `json:",omitempty"`
+ ReportEntries ReportEntries `json:",omitempty"`
+ ProgressReports []ProgressReport `json:",omitempty"`
+ AdditionalFailures []AdditionalFailure `json:",omitempty"`
+ SpecEvents SpecEvents `json:",omitempty"`
}{
- ContainerHierarchyTexts: report.ContainerHierarchyTexts,
- ContainerHierarchyLocations: report.ContainerHierarchyLocations,
- ContainerHierarchyLabels: report.ContainerHierarchyLabels,
- LeafNodeType: report.LeafNodeType,
- LeafNodeLocation: report.LeafNodeLocation,
- LeafNodeLabels: report.LeafNodeLabels,
- LeafNodeText: report.LeafNodeText,
- State: report.State,
- StartTime: report.StartTime,
- EndTime: report.EndTime,
- RunTime: report.RunTime,
- ParallelProcess: report.ParallelProcess,
- Failure: nil,
- ReportEntries: nil,
- NumAttempts: report.NumAttempts,
- MaxFlakeAttempts: report.MaxFlakeAttempts,
- MaxMustPassRepeatedly: report.MaxMustPassRepeatedly,
- CapturedGinkgoWriterOutput: report.CapturedGinkgoWriterOutput,
- CapturedStdOutErr: report.CapturedStdOutErr,
+ ContainerHierarchyTexts: report.ContainerHierarchyTexts,
+ ContainerHierarchyLocations: report.ContainerHierarchyLocations,
+ ContainerHierarchyLabels: report.ContainerHierarchyLabels,
+ ContainerHierarchySemVerConstraints: report.ContainerHierarchySemVerConstraints,
+ ContainerHierarchyComponentSemVerConstraints: report.ContainerHierarchyComponentSemVerConstraints,
+ LeafNodeType: report.LeafNodeType,
+ LeafNodeLocation: report.LeafNodeLocation,
+ LeafNodeLabels: report.LeafNodeLabels,
+ LeafNodeSemVerConstraints: report.LeafNodeSemVerConstraints,
+ LeafNodeText: report.LeafNodeText,
+ State: report.State,
+ StartTime: report.StartTime,
+ EndTime: report.EndTime,
+ RunTime: report.RunTime,
+ ParallelProcess: report.ParallelProcess,
+ Failure: nil,
+ ReportEntries: nil,
+ NumAttempts: report.NumAttempts,
+ MaxFlakeAttempts: report.MaxFlakeAttempts,
+ MaxMustPassRepeatedly: report.MaxMustPassRepeatedly,
+ CapturedGinkgoWriterOutput: report.CapturedGinkgoWriterOutput,
+ CapturedStdOutErr: report.CapturedStdOutErr,
}
if !report.Failure.IsZero() {
@@ -287,6 +368,9 @@ func (report SpecReport) FullText() string {
if report.LeafNodeText != "" {
texts = append(texts, report.LeafNodeText)
}
+ texts = slices.DeleteFunc(texts, func(t string) bool {
+ return t == ""
+ })
return strings.Join(texts, " ")
}
@@ -312,6 +396,56 @@ func (report SpecReport) Labels() []string {
return out
}
+// SemVerConstraints returns a deduped set of all the spec's SemVerConstraints.
+func (report SpecReport) SemVerConstraints() []string {
+ out := []string{}
+ seen := map[string]bool{}
+ for _, semVerConstraints := range report.ContainerHierarchySemVerConstraints {
+ for _, semVerConstraint := range semVerConstraints {
+ if !seen[semVerConstraint] {
+ seen[semVerConstraint] = true
+ out = append(out, semVerConstraint)
+ }
+ }
+ }
+ for _, semVerConstraint := range report.LeafNodeSemVerConstraints {
+ if !seen[semVerConstraint] {
+ seen[semVerConstraint] = true
+ out = append(out, semVerConstraint)
+ }
+ }
+
+ return out
+}
+
+// ComponentSemVerConstraints returns a deduped map of all the spec's component-specific SemVerConstraints.
+func (report SpecReport) ComponentSemVerConstraints() map[string][]string {
+ out := map[string][]string{}
+ seen := map[string]bool{}
+ for _, compSemVerConstraints := range report.ContainerHierarchyComponentSemVerConstraints {
+ for component := range compSemVerConstraints {
+ if !seen[component] {
+ seen[component] = true
+ out[component] = compSemVerConstraints[component]
+ } else {
+ out[component] = append(out[component], compSemVerConstraints[component]...)
+ out[component] = slices.Compact(out[component])
+ }
+ }
+ }
+ for component := range report.LeafNodeComponentSemVerConstraints {
+ if !seen[component] {
+ seen[component] = true
+ out[component] = report.LeafNodeComponentSemVerConstraints[component]
+ } else {
+ out[component] = append(out[component], report.LeafNodeComponentSemVerConstraints[component]...)
+ out[component] = slices.Compact(out[component])
+ }
+ }
+
+ return out
+}
+
// MatchesLabelFilter returns true if the spec satisfies the passed in label filter query
func (report SpecReport) MatchesLabelFilter(query string) (bool, error) {
filter, err := ParseLabelFilter(query)
@@ -321,6 +455,30 @@ func (report SpecReport) MatchesLabelFilter(query string) (bool, error) {
return filter(report.Labels()), nil
}
+// MatchesSemVerFilter returns true if the spec satisfies the passed in label filter query
+func (report SpecReport) MatchesSemVerFilter(version string) (bool, error) {
+ filter, err := ParseSemVerFilter(version)
+ if err != nil {
+ return false, err
+ }
+
+ semVerConstraints := report.SemVerConstraints()
+ if len(semVerConstraints) != 0 && filter("", report.SemVerConstraints()) == false {
+ return false, nil
+ }
+
+ componentSemVerConstraints := report.ComponentSemVerConstraints()
+ if len(componentSemVerConstraints) != 0 {
+ for component, constraints := range componentSemVerConstraints {
+ if filter(component, constraints) == false {
+ return false, nil
+ }
+ }
+ }
+
+ return true, nil
+}
+
// FileName() returns the name of the file containing the spec
func (report SpecReport) FileName() string {
return report.LeafNodeLocation.FileName
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/version.go b/vendor/github.com/onsi/ginkgo/v2/types/version.go
index caf3c9f5e..1df09be00 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/version.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/version.go
@@ -1,3 +1,3 @@
package types
-const VERSION = "2.21.0"
+const VERSION = "2.28.1"
diff --git a/vendor/github.com/onsi/gomega/CHANGELOG.md b/vendor/github.com/onsi/gomega/CHANGELOG.md
index b7d7309f3..cf020605c 100644
--- a/vendor/github.com/onsi/gomega/CHANGELOG.md
+++ b/vendor/github.com/onsi/gomega/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 1.39.0
+
+### Features
+
+Add `MatchErrorStrictly` which only passes if `errors.Is(actual, expected)` returns true. `MatchError`, by contrast, will fallback to string comparison.
+
+## 1.38.3
+
+### Fixes
+make string formatitng more consistent for users who use format.Object directly
+
## 1.38.2
- roll back to go 1.23.0 [c404969]
diff --git a/vendor/github.com/onsi/gomega/format/format.go b/vendor/github.com/onsi/gomega/format/format.go
index 96f04b210..6c23ba338 100644
--- a/vendor/github.com/onsi/gomega/format/format.go
+++ b/vendor/github.com/onsi/gomega/format/format.go
@@ -262,7 +262,7 @@ func Object(object any, indentation uint) string {
if err, ok := object.(error); ok && !isNilValue(value) { // isNilValue check needed here to avoid nil deref due to boxed nil
commonRepresentation += "\n" + IndentString(err.Error(), indentation) + "\n" + indent
}
- return fmt.Sprintf("%s<%s>: %s%s", indent, formatType(value), commonRepresentation, formatValue(value, indentation))
+ return fmt.Sprintf("%s<%s>: %s%s", indent, formatType(value), commonRepresentation, formatValue(value, indentation, true))
}
/*
@@ -306,7 +306,7 @@ func formatType(v reflect.Value) string {
}
}
-func formatValue(value reflect.Value, indentation uint) string {
+func formatValue(value reflect.Value, indentation uint, isTopLevel bool) string {
if indentation > MaxDepth {
return "..."
}
@@ -367,11 +367,11 @@ func formatValue(value reflect.Value, indentation uint) string {
case reflect.Func:
return fmt.Sprintf("0x%x", value.Pointer())
case reflect.Ptr:
- return formatValue(value.Elem(), indentation)
+ return formatValue(value.Elem(), indentation, isTopLevel)
case reflect.Slice:
return truncateLongStrings(formatSlice(value, indentation))
case reflect.String:
- return truncateLongStrings(formatString(value.String(), indentation))
+ return truncateLongStrings(formatString(value.String(), indentation, isTopLevel))
case reflect.Array:
return truncateLongStrings(formatSlice(value, indentation))
case reflect.Map:
@@ -392,8 +392,8 @@ func formatValue(value reflect.Value, indentation uint) string {
}
}
-func formatString(object any, indentation uint) string {
- if indentation == 1 {
+func formatString(object any, indentation uint, isTopLevel bool) string {
+ if isTopLevel {
s := fmt.Sprintf("%s", object)
components := strings.Split(s, "\n")
result := ""
@@ -416,14 +416,14 @@ func formatString(object any, indentation uint) string {
func formatSlice(v reflect.Value, indentation uint) string {
if v.Kind() == reflect.Slice && v.Type().Elem().Kind() == reflect.Uint8 && isPrintableString(string(v.Bytes())) {
- return formatString(v.Bytes(), indentation)
+ return formatString(v.Bytes(), indentation, false)
}
l := v.Len()
result := make([]string, l)
longest := 0
- for i := 0; i < l; i++ {
- result[i] = formatValue(v.Index(i), indentation+1)
+ for i := range l {
+ result[i] = formatValue(v.Index(i), indentation+1, false)
if len(result[i]) > longest {
longest = len(result[i])
}
@@ -443,7 +443,7 @@ func formatMap(v reflect.Value, indentation uint) string {
longest := 0
for i, key := range v.MapKeys() {
value := v.MapIndex(key)
- result[i] = fmt.Sprintf("%s: %s", formatValue(key, indentation+1), formatValue(value, indentation+1))
+ result[i] = fmt.Sprintf("%s: %s", formatValue(key, indentation+1, false), formatValue(value, indentation+1, false))
if len(result[i]) > longest {
longest = len(result[i])
}
@@ -462,10 +462,10 @@ func formatStruct(v reflect.Value, indentation uint) string {
l := v.NumField()
result := []string{}
longest := 0
- for i := 0; i < l; i++ {
+ for i := range l {
structField := t.Field(i)
fieldEntry := v.Field(i)
- representation := fmt.Sprintf("%s: %s", structField.Name, formatValue(fieldEntry, indentation+1))
+ representation := fmt.Sprintf("%s: %s", structField.Name, formatValue(fieldEntry, indentation+1, false))
result = append(result, representation)
if len(representation) > longest {
longest = len(representation)
@@ -479,7 +479,7 @@ func formatStruct(v reflect.Value, indentation uint) string {
}
func formatInterface(v reflect.Value, indentation uint) string {
- return fmt.Sprintf("<%s>%s", formatType(v.Elem()), formatValue(v.Elem(), indentation))
+ return fmt.Sprintf("<%s>%s", formatType(v.Elem()), formatValue(v.Elem(), indentation, false))
}
func isNilValue(a reflect.Value) bool {
diff --git a/vendor/github.com/onsi/gomega/gomega_dsl.go b/vendor/github.com/onsi/gomega/gomega_dsl.go
index fdba34ee9..cd6ce450f 100644
--- a/vendor/github.com/onsi/gomega/gomega_dsl.go
+++ b/vendor/github.com/onsi/gomega/gomega_dsl.go
@@ -22,7 +22,7 @@ import (
"github.com/onsi/gomega/types"
)
-const GOMEGA_VERSION = "1.38.2"
+const GOMEGA_VERSION = "1.39.0"
const nilGomegaPanic = `You are trying to make an assertion, but haven't registered Gomega's fail handler.
If you're using Ginkgo then you probably forgot to put your assertion in an It().
diff --git a/vendor/github.com/onsi/gomega/matchers.go b/vendor/github.com/onsi/gomega/matchers.go
index 10b6693fd..16ca8f46d 100644
--- a/vendor/github.com/onsi/gomega/matchers.go
+++ b/vendor/github.com/onsi/gomega/matchers.go
@@ -146,6 +146,24 @@ func MatchError(expected any, functionErrorDescription ...any) types.GomegaMatch
}
}
+// MatchErrorStrictly succeeds iff actual is a non-nil error that matches the passed in
+// expected error according to errors.Is(actual, expected).
+//
+// This behavior differs from MatchError where
+//
+// Expect(errors.New("some error")).To(MatchError(errors.New("some error")))
+//
+// succeeds, but errors.Is would return false so:
+//
+// Expect(errors.New("some error")).To(MatchErrorStrictly(errors.New("some error")))
+//
+// fails.
+func MatchErrorStrictly(expected error) types.GomegaMatcher {
+ return &matchers.MatchErrorStrictlyMatcher{
+ Expected: expected,
+ }
+}
+
// BeClosed succeeds if actual is a closed channel.
// It is an error to pass a non-channel to BeClosed, it is also an error to pass nil
//
@@ -515,8 +533,8 @@ func HaveExistingField(field string) types.GomegaMatcher {
// and even interface values.
//
// actual := 42
-// Expect(actual).To(HaveValue(42))
-// Expect(&actual).To(HaveValue(42))
+// Expect(actual).To(HaveValue(Equal(42)))
+// Expect(&actual).To(HaveValue(Equal(42)))
func HaveValue(matcher types.GomegaMatcher) types.GomegaMatcher {
return &matchers.HaveValueMatcher{
Matcher: matcher,
diff --git a/vendor/github.com/onsi/gomega/matchers/have_key_matcher.go b/vendor/github.com/onsi/gomega/matchers/have_key_matcher.go
index 9e16dcf5d..16630c18e 100644
--- a/vendor/github.com/onsi/gomega/matchers/have_key_matcher.go
+++ b/vendor/github.com/onsi/gomega/matchers/have_key_matcher.go
@@ -39,7 +39,7 @@ func (matcher *HaveKeyMatcher) Match(actual any) (success bool, err error) {
}
keys := reflect.ValueOf(actual).MapKeys()
- for i := 0; i < len(keys); i++ {
+ for i := range keys {
success, err := keyMatcher.Match(keys[i].Interface())
if err != nil {
return false, fmt.Errorf("HaveKey's key matcher failed with:\n%s%s", format.Indent, err.Error())
diff --git a/vendor/github.com/onsi/gomega/matchers/have_key_with_value_matcher.go b/vendor/github.com/onsi/gomega/matchers/have_key_with_value_matcher.go
index 1c53f1e56..0cd708153 100644
--- a/vendor/github.com/onsi/gomega/matchers/have_key_with_value_matcher.go
+++ b/vendor/github.com/onsi/gomega/matchers/have_key_with_value_matcher.go
@@ -52,7 +52,7 @@ func (matcher *HaveKeyWithValueMatcher) Match(actual any) (success bool, err err
}
keys := reflect.ValueOf(actual).MapKeys()
- for i := 0; i < len(keys); i++ {
+ for i := range keys {
success, err := keyMatcher.Match(keys[i].Interface())
if err != nil {
return false, fmt.Errorf("HaveKeyWithValue's key matcher failed with:\n%s%s", format.Indent, err.Error())
diff --git a/vendor/github.com/onsi/gomega/matchers/match_error_strictly_matcher.go b/vendor/github.com/onsi/gomega/matchers/match_error_strictly_matcher.go
new file mode 100644
index 000000000..63969b266
--- /dev/null
+++ b/vendor/github.com/onsi/gomega/matchers/match_error_strictly_matcher.go
@@ -0,0 +1,39 @@
+package matchers
+
+import (
+ "errors"
+ "fmt"
+
+ "github.com/onsi/gomega/format"
+)
+
+type MatchErrorStrictlyMatcher struct {
+ Expected error
+}
+
+func (matcher *MatchErrorStrictlyMatcher) Match(actual any) (success bool, err error) {
+
+ if isNil(matcher.Expected) {
+ return false, fmt.Errorf("Expected error is nil, use \"ToNot(HaveOccurred())\" to explicitly check for nil errors")
+ }
+
+ if isNil(actual) {
+ return false, fmt.Errorf("Expected an error, got nil")
+ }
+
+ if !isError(actual) {
+ return false, fmt.Errorf("Expected an error. Got:\n%s", format.Object(actual, 1))
+ }
+
+ actualErr := actual.(error)
+
+ return errors.Is(actualErr, matcher.Expected), nil
+}
+
+func (matcher *MatchErrorStrictlyMatcher) FailureMessage(actual any) (message string) {
+ return format.Message(actual, "to match error", matcher.Expected)
+}
+
+func (matcher *MatchErrorStrictlyMatcher) NegatedFailureMessage(actual any) (message string) {
+ return format.Message(actual, "not to match error", matcher.Expected)
+}
diff --git a/vendor/github.com/onsi/gomega/matchers/support/goraph/edge/edge.go b/vendor/github.com/onsi/gomega/matchers/support/goraph/edge/edge.go
index 8c38411b2..72edba20f 100644
--- a/vendor/github.com/onsi/gomega/matchers/support/goraph/edge/edge.go
+++ b/vendor/github.com/onsi/gomega/matchers/support/goraph/edge/edge.go
@@ -1,6 +1,9 @@
package edge
-import . "github.com/onsi/gomega/matchers/support/goraph/node"
+import (
+ . "github.com/onsi/gomega/matchers/support/goraph/node"
+ "slices"
+)
type Edge struct {
Node1 int
@@ -20,13 +23,7 @@ func (ec EdgeSet) Free(node Node) bool {
}
func (ec EdgeSet) Contains(edge Edge) bool {
- for _, e := range ec {
- if e == edge {
- return true
- }
- }
-
- return false
+ return slices.Contains(ec, edge)
}
func (ec EdgeSet) FindByNodes(node1, node2 Node) (Edge, bool) {
diff --git a/vendor/github.com/openshift/api/.ci-operator.yaml b/vendor/github.com/openshift/api/.ci-operator.yaml
index a3628cf24..1d88a59fd 100644
--- a/vendor/github.com/openshift/api/.ci-operator.yaml
+++ b/vendor/github.com/openshift/api/.ci-operator.yaml
@@ -1,4 +1,4 @@
build_root_image:
name: release
namespace: openshift
- tag: rhel-9-release-golang-1.25-openshift-4.22
+ tag: rhel-9-release-golang-1.26-openshift-5.0
diff --git a/vendor/github.com/openshift/api/.golangci.yaml b/vendor/github.com/openshift/api/.golangci.yaml
index 608fb0ed2..e4e5b9761 100644
--- a/vendor/github.com/openshift/api/.golangci.yaml
+++ b/vendor/github.com/openshift/api/.golangci.yaml
@@ -106,11 +106,21 @@ linters:
# This regex must always be updated in tandem with the regex in .golangci.go-validated.yaml that prevents `optionalfields` from being applied to the files in the path.
path: machine/v1beta1/(types_awsprovider.go|types_azureprovider.go|types_gcpprovider.go|types_vsphereprovider.go)|machine/v1alpha1/types_openstack.go
text: "optionalfields"
+ - linters:
+ - kubeapilinter
+ # osin/v1 types are config file APIs, not CRDs — validation is handled in Go code at config load time.
+ path: osin/v1/types.go
- linters:
- kubeapilinter
# Silence norefs lint for `Ref` field in ClusterAPI as it refers to an OCI image reference, not a kube object reference.
path: operator/v1alpha1/types_clusterapi.go
text: "noreferences: naming convention \"no-references\": field ClusterAPIInstallerComponentImage.Ref: field names should not contain reference-related words"
+ - linters:
+ - kubeapilinter
+ # PacemakerCluster intentionally marks Conditions as required with XValidation rules
+ # to enforce specific condition types are always present.
+ path: etcd/v1/types_pacemakercluster.go
+ text: "conditions: Conditions field in (PacemakerClusterStatus|PacemakerClusterNodeStatus|PacemakerClusterFencingAgentStatus|PacemakerClusterResourceStatus) is missing the following markers: optional"
- linters:
- kubeapilinter
path: features|payload-command/*.go
diff --git a/vendor/github.com/openshift/api/Dockerfile.ocp b/vendor/github.com/openshift/api/Dockerfile.ocp
index e04ec9fbc..98870518c 100644
--- a/vendor/github.com/openshift/api/Dockerfile.ocp
+++ b/vendor/github.com/openshift/api/Dockerfile.ocp
@@ -1,10 +1,10 @@
-FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS builder
+FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 AS builder
WORKDIR /go/src/github.com/openshift/api
COPY . .
ENV GO_PACKAGE github.com/openshift/api
RUN make build --warn-undefined-variables
-FROM registry.ci.openshift.org/ocp/4.22:base-rhel9
+FROM registry.ci.openshift.org/ocp/5.0:base-rhel9
# copy the built binaries to /usr/bin
COPY --from=builder /go/src/github.com/openshift/api/render /usr/bin/
diff --git a/vendor/github.com/openshift/api/Makefile b/vendor/github.com/openshift/api/Makefile
index ac20137fa..b6c0de378 100644
--- a/vendor/github.com/openshift/api/Makefile
+++ b/vendor/github.com/openshift/api/Makefile
@@ -4,7 +4,7 @@ all: build
update: update-non-codegen update-codegen
RUNTIME ?= podman
-RUNTIME_IMAGE_NAME ?= registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.22
+RUNTIME_IMAGE_NAME ?= registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-5.0
EXCLUDE_DIRS := _output/ dependencymagnet/ hack/ third_party/ tls/ tools/ vendor/ tests/
GO_PACKAGES :=$(addsuffix ...,$(addprefix ./,$(filter-out $(EXCLUDE_DIRS), $(wildcard */))))
@@ -179,6 +179,27 @@ generate-with-container:
integration:
make -C tests integration
+# Run API review evals. Requires claude CLI.
+# EVAL_RUNS=5 Number of runs per test case (default: 1)
+# EVAL_THRESHOLD=0.8 Minimum pass rate (default: 0.8)
+# EVAL_GOLDEN_MODEL=... Model for golden tests (default: sonnet)
+# EVAL_INTEGRATION_MODEL=... Model for integration tests (default: opus)
+# EVAL_JUDGE_MODEL=... Model for judging results (default: haiku)
+# EVAL_GOLDEN_PROCS=4 Max parallel golden tests (default: 4)
+# EVAL_INTEGRATION_PROCS=2 Max parallel integration tests (default: 2)
+# EVAL_GINKGO_ARGS=... Extra ginkgo args
+.PHONY: eval
+eval:
+ $(MAKE) -C tests eval
+
+.PHONY: eval-golden
+eval-golden:
+ $(MAKE) -C tests eval-golden
+
+.PHONY: eval-integration
+eval-integration:
+ $(MAKE) -C tests eval-integration
+
tests-vendor:
make -C tests vendor
@@ -199,7 +220,7 @@ write-available-featuresets:
.PHONY: clean
clean:
- rm -f render write-available-featuresets models-schema
+ rm -f render write-available-featuresets
rm -rf tools/_output
VERSION ?= $(shell git describe --always --abbrev=7)
diff --git a/vendor/github.com/openshift/api/apiextensions/v1alpha1/doc.go b/vendor/github.com/openshift/api/apiextensions/v1alpha1/doc.go
index e5d665fbb..ff9b7416a 100644
--- a/vendor/github.com/openshift/api/apiextensions/v1alpha1/doc.go
+++ b/vendor/github.com/openshift/api/apiextensions/v1alpha1/doc.go
@@ -1,6 +1,7 @@
// +k8s:deepcopy-gen=package,register
// +k8s:defaulter-gen=TypeMeta
// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=com.github.openshift.api.apiextensions.v1alpha1
// +openshift:featuregated-schema-gen=true
// +groupName=apiextensions.openshift.io
diff --git a/vendor/github.com/openshift/api/apiextensions/v1alpha1/zz_generated.model_name.go b/vendor/github.com/openshift/api/apiextensions/v1alpha1/zz_generated.model_name.go
new file mode 100644
index 000000000..1f0482e4f
--- /dev/null
+++ b/vendor/github.com/openshift/api/apiextensions/v1alpha1/zz_generated.model_name.go
@@ -0,0 +1,61 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+// Code generated by codegen. DO NOT EDIT.
+
+package v1alpha1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIExcludedField) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiextensions.v1alpha1.APIExcludedField"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIVersions) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiextensions.v1alpha1.APIVersions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CRDData) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiextensions.v1alpha1.CRDData"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompatibilityRequirement) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirement"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompatibilityRequirementList) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirementList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompatibilityRequirementSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirementSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompatibilityRequirementStatus) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiextensions.v1alpha1.CompatibilityRequirementStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompatibilitySchema) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiextensions.v1alpha1.CompatibilitySchema"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CustomResourceDefinitionSchemaValidation) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiextensions.v1alpha1.CustomResourceDefinitionSchemaValidation"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ObjectSchemaValidation) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiextensions.v1alpha1.ObjectSchemaValidation"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ObservedCRD) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiextensions.v1alpha1.ObservedCRD"
+}
diff --git a/vendor/github.com/openshift/api/apiserver/v1/doc.go b/vendor/github.com/openshift/api/apiserver/v1/doc.go
index cc6a8aa61..598fd6e75 100644
--- a/vendor/github.com/openshift/api/apiserver/v1/doc.go
+++ b/vendor/github.com/openshift/api/apiserver/v1/doc.go
@@ -1,6 +1,7 @@
// +k8s:deepcopy-gen=package,register
// +k8s:defaulter-gen=TypeMeta
// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=com.github.openshift.api.apiserver.v1
// +kubebuilder:validation:Optional
// +groupName=apiserver.openshift.io
diff --git a/vendor/github.com/openshift/api/apiserver/v1/zz_generated.model_name.go b/vendor/github.com/openshift/api/apiserver/v1/zz_generated.model_name.go
new file mode 100644
index 000000000..69b62d04f
--- /dev/null
+++ b/vendor/github.com/openshift/api/apiserver/v1/zz_generated.model_name.go
@@ -0,0 +1,46 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+// Code generated by codegen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIRequestCount) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiserver.v1.APIRequestCount"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIRequestCountList) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiserver.v1.APIRequestCountList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIRequestCountSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiserver.v1.APIRequestCountSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIRequestCountStatus) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiserver.v1.APIRequestCountStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PerNodeAPIRequestLog) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiserver.v1.PerNodeAPIRequestLog"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PerResourceAPIRequestLog) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiserver.v1.PerResourceAPIRequestLog"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PerUserAPIRequestCount) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiserver.v1.PerUserAPIRequestCount"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PerVerbAPIRequestCount) OpenAPIModelName() string {
+ return "com.github.openshift.api.apiserver.v1.PerVerbAPIRequestCount"
+}
diff --git a/vendor/github.com/openshift/api/apps/.codegen.yaml b/vendor/github.com/openshift/api/apps/.codegen.yaml
new file mode 100644
index 000000000..f7a37129a
--- /dev/null
+++ b/vendor/github.com/openshift/api/apps/.codegen.yaml
@@ -0,0 +1,2 @@
+protobuf:
+ disabled: false
diff --git a/vendor/github.com/openshift/api/apps/v1/doc.go b/vendor/github.com/openshift/api/apps/v1/doc.go
index f0fb3f59a..9ba23002d 100644
--- a/vendor/github.com/openshift/api/apps/v1/doc.go
+++ b/vendor/github.com/openshift/api/apps/v1/doc.go
@@ -2,6 +2,7 @@
// +k8s:conversion-gen=github.com/openshift/origin/pkg/apps/apis/apps
// +k8s:defaulter-gen=TypeMeta
// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=com.github.openshift.api.apps.v1
// +k8s:prerelease-lifecycle-gen=true
// +groupName=apps.openshift.io
diff --git a/vendor/github.com/openshift/api/apps/v1/zz_generated.model_name.go b/vendor/github.com/openshift/api/apps/v1/zz_generated.model_name.go
new file mode 100644
index 000000000..3eea1fc87
--- /dev/null
+++ b/vendor/github.com/openshift/api/apps/v1/zz_generated.model_name.go
@@ -0,0 +1,116 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+// Code generated by codegen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CustomDeploymentStrategyParams) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.CustomDeploymentStrategyParams"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentCause) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentCause"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentCauseImageTrigger) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentCauseImageTrigger"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentCondition) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentCondition"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentConfig) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentConfig"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentConfigList) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentConfigList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentConfigRollback) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentConfigRollback"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentConfigRollbackSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentConfigRollbackSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentConfigSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentConfigSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentConfigStatus) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentConfigStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentDetails) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentDetails"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentLog) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentLog"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentLogOptions) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentLogOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentRequest) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentRequest"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentStrategy) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentStrategy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentTriggerImageChangeParams) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentTriggerImageChangeParams"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeploymentTriggerPolicy) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.DeploymentTriggerPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ExecNewPodHook) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.ExecNewPodHook"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in LifecycleHook) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.LifecycleHook"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RecreateDeploymentStrategyParams) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.RecreateDeploymentStrategyParams"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RollingDeploymentStrategyParams) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.RollingDeploymentStrategyParams"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TagImageHook) OpenAPIModelName() string {
+ return "com.github.openshift.api.apps.v1.TagImageHook"
+}
diff --git a/vendor/github.com/openshift/api/authorization/.codegen.yaml b/vendor/github.com/openshift/api/authorization/.codegen.yaml
new file mode 100644
index 000000000..f7a37129a
--- /dev/null
+++ b/vendor/github.com/openshift/api/authorization/.codegen.yaml
@@ -0,0 +1,2 @@
+protobuf:
+ disabled: false
diff --git a/vendor/github.com/openshift/api/authorization/v1/doc.go b/vendor/github.com/openshift/api/authorization/v1/doc.go
index a66741dce..8b4e927d6 100644
--- a/vendor/github.com/openshift/api/authorization/v1/doc.go
+++ b/vendor/github.com/openshift/api/authorization/v1/doc.go
@@ -2,6 +2,7 @@
// +k8s:conversion-gen=github.com/openshift/origin/pkg/authorization/apis/authorization
// +k8s:defaulter-gen=TypeMeta
// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=com.github.openshift.api.authorization.v1
// +kubebuilder:validation:Optional
// +groupName=authorization.openshift.io
diff --git a/vendor/github.com/openshift/api/authorization/v1/zz_generated.model_name.go b/vendor/github.com/openshift/api/authorization/v1/zz_generated.model_name.go
new file mode 100644
index 000000000..47987773b
--- /dev/null
+++ b/vendor/github.com/openshift/api/authorization/v1/zz_generated.model_name.go
@@ -0,0 +1,171 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+// Code generated by codegen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Action) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.Action"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ClusterRole) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.ClusterRole"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ClusterRoleBinding) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.ClusterRoleBinding"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ClusterRoleBindingList) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.ClusterRoleBindingList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ClusterRoleList) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.ClusterRoleList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupRestriction) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.GroupRestriction"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in IsPersonalSubjectAccessReview) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.IsPersonalSubjectAccessReview"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in LocalResourceAccessReview) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.LocalResourceAccessReview"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in LocalSubjectAccessReview) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.LocalSubjectAccessReview"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NamedClusterRole) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.NamedClusterRole"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NamedClusterRoleBinding) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.NamedClusterRoleBinding"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NamedRole) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.NamedRole"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NamedRoleBinding) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.NamedRoleBinding"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PolicyRule) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.PolicyRule"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ResourceAccessReview) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.ResourceAccessReview"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ResourceAccessReviewResponse) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.ResourceAccessReviewResponse"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Role) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.Role"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RoleBinding) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.RoleBinding"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RoleBindingList) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.RoleBindingList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RoleBindingRestriction) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.RoleBindingRestriction"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RoleBindingRestrictionList) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.RoleBindingRestrictionList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RoleBindingRestrictionSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.RoleBindingRestrictionSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RoleList) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.RoleList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SelfSubjectRulesReview) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.SelfSubjectRulesReview"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SelfSubjectRulesReviewSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.SelfSubjectRulesReviewSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ServiceAccountReference) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.ServiceAccountReference"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ServiceAccountRestriction) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.ServiceAccountRestriction"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SubjectAccessReview) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.SubjectAccessReview"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SubjectAccessReviewResponse) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.SubjectAccessReviewResponse"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SubjectRulesReview) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.SubjectRulesReview"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SubjectRulesReviewSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.SubjectRulesReviewSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SubjectRulesReviewStatus) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.SubjectRulesReviewStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in UserRestriction) OpenAPIModelName() string {
+ return "com.github.openshift.api.authorization.v1.UserRestriction"
+}
diff --git a/vendor/github.com/openshift/api/build/.codegen.yaml b/vendor/github.com/openshift/api/build/.codegen.yaml
new file mode 100644
index 000000000..f7a37129a
--- /dev/null
+++ b/vendor/github.com/openshift/api/build/.codegen.yaml
@@ -0,0 +1,2 @@
+protobuf:
+ disabled: false
diff --git a/vendor/github.com/openshift/api/build/v1/doc.go b/vendor/github.com/openshift/api/build/v1/doc.go
index 9bc16f64b..6fe1839e9 100644
--- a/vendor/github.com/openshift/api/build/v1/doc.go
+++ b/vendor/github.com/openshift/api/build/v1/doc.go
@@ -2,6 +2,7 @@
// +k8s:conversion-gen=github.com/openshift/origin/pkg/build/apis/build
// +k8s:defaulter-gen=TypeMeta
// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=com.github.openshift.api.build.v1
// +groupName=build.openshift.io
// Package v1 is the v1 version of the API.
diff --git a/vendor/github.com/openshift/api/build/v1/zz_generated.model_name.go b/vendor/github.com/openshift/api/build/v1/zz_generated.model_name.go
new file mode 100644
index 000000000..dd144e3af
--- /dev/null
+++ b/vendor/github.com/openshift/api/build/v1/zz_generated.model_name.go
@@ -0,0 +1,301 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+// Code generated by codegen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BinaryBuildRequestOptions) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BinaryBuildRequestOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BinaryBuildSource) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BinaryBuildSource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BitbucketWebHookCause) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BitbucketWebHookCause"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Build) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.Build"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildCondition) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildCondition"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildConfig) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildConfig"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildConfigList) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildConfigList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildConfigSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildConfigSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildConfigStatus) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildConfigStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildList) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildLog) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildLog"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildLogOptions) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildLogOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildOutput) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildOutput"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildPostCommitSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildPostCommitSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildRequest) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildRequest"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildSource) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildSource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildStatus) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildStatusOutput) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildStatusOutput"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildStatusOutputTo) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildStatusOutputTo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildStrategy) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildStrategy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildTriggerCause) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildTriggerCause"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildTriggerPolicy) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildTriggerPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildVolume) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildVolume"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildVolumeMount) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildVolumeMount"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BuildVolumeSource) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.BuildVolumeSource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CommonSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.CommonSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CommonWebHookCause) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.CommonWebHookCause"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ConfigMapBuildSource) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.ConfigMapBuildSource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CustomBuildStrategy) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.CustomBuildStrategy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DockerBuildStrategy) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.DockerBuildStrategy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DockerStrategyOptions) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.DockerStrategyOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GenericWebHookCause) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.GenericWebHookCause"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GenericWebHookEvent) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.GenericWebHookEvent"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GitBuildSource) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.GitBuildSource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GitHubWebHookCause) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.GitHubWebHookCause"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GitInfo) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.GitInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GitLabWebHookCause) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.GitLabWebHookCause"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GitRefInfo) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.GitRefInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GitSourceRevision) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.GitSourceRevision"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ImageChangeCause) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.ImageChangeCause"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ImageChangeTrigger) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.ImageChangeTrigger"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ImageChangeTriggerStatus) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.ImageChangeTriggerStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ImageLabel) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.ImageLabel"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ImageSource) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.ImageSource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ImageSourcePath) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.ImageSourcePath"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ImageStreamTagReference) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.ImageStreamTagReference"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in JenkinsPipelineBuildStrategy) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.JenkinsPipelineBuildStrategy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ProxyConfig) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.ProxyConfig"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SecretBuildSource) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.SecretBuildSource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SecretLocalReference) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.SecretLocalReference"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SecretSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.SecretSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SourceBuildStrategy) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.SourceBuildStrategy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SourceControlUser) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.SourceControlUser"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SourceRevision) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.SourceRevision"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SourceStrategyOptions) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.SourceStrategyOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StageInfo) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.StageInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StepInfo) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.StepInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WebHookTrigger) OpenAPIModelName() string {
+ return "com.github.openshift.api.build.v1.WebHookTrigger"
+}
diff --git a/vendor/github.com/openshift/api/cloudnetwork/.codegen.yaml b/vendor/github.com/openshift/api/cloudnetwork/.codegen.yaml
index e69de29bb..f7a37129a 100644
--- a/vendor/github.com/openshift/api/cloudnetwork/.codegen.yaml
+++ b/vendor/github.com/openshift/api/cloudnetwork/.codegen.yaml
@@ -0,0 +1,2 @@
+protobuf:
+ disabled: false
diff --git a/vendor/github.com/openshift/api/cloudnetwork/v1/doc.go b/vendor/github.com/openshift/api/cloudnetwork/v1/doc.go
index 1d495ee24..006a1705b 100644
--- a/vendor/github.com/openshift/api/cloudnetwork/v1/doc.go
+++ b/vendor/github.com/openshift/api/cloudnetwork/v1/doc.go
@@ -1,5 +1,6 @@
// Package v1 contains API Schema definitions for the cloud network v1 API group
// +k8s:deepcopy-gen=package,register
+// +k8s:openapi-model-package=com.github.openshift.api.cloudnetwork.v1
// +groupName=cloud.network.openshift.io
// +kubebuilder:validation:Optional
package v1
diff --git a/vendor/github.com/openshift/api/cloudnetwork/v1/zz_generated.model_name.go b/vendor/github.com/openshift/api/cloudnetwork/v1/zz_generated.model_name.go
new file mode 100644
index 000000000..540988397
--- /dev/null
+++ b/vendor/github.com/openshift/api/cloudnetwork/v1/zz_generated.model_name.go
@@ -0,0 +1,26 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+// Code generated by codegen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CloudPrivateIPConfig) OpenAPIModelName() string {
+ return "com.github.openshift.api.cloudnetwork.v1.CloudPrivateIPConfig"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CloudPrivateIPConfigList) OpenAPIModelName() string {
+ return "com.github.openshift.api.cloudnetwork.v1.CloudPrivateIPConfigList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CloudPrivateIPConfigSpec) OpenAPIModelName() string {
+ return "com.github.openshift.api.cloudnetwork.v1.CloudPrivateIPConfigSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CloudPrivateIPConfigStatus) OpenAPIModelName() string {
+ return "com.github.openshift.api.cloudnetwork.v1.CloudPrivateIPConfigStatus"
+}
diff --git a/vendor/github.com/openshift/api/config/v1/doc.go b/vendor/github.com/openshift/api/config/v1/doc.go
index f99454758..867a4f43f 100644
--- a/vendor/github.com/openshift/api/config/v1/doc.go
+++ b/vendor/github.com/openshift/api/config/v1/doc.go
@@ -1,6 +1,7 @@
// +k8s:deepcopy-gen=package,register
// +k8s:defaulter-gen=TypeMeta
// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=com.github.openshift.api.config.v1
// +openshift:featuregated-schema-gen=true
// +kubebuilder:validation:Optional
diff --git a/vendor/github.com/openshift/api/config/v1/register.go b/vendor/github.com/openshift/api/config/v1/register.go
index 222c7f0cc..1f27d821a 100644
--- a/vendor/github.com/openshift/api/config/v1/register.go
+++ b/vendor/github.com/openshift/api/config/v1/register.go
@@ -78,6 +78,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
&ClusterImagePolicyList{},
&InsightsDataGather{},
&InsightsDataGatherList{},
+ &CRIOCredentialProviderConfig{},
+ &CRIOCredentialProviderConfigList{},
)
metav1.AddToGroupVersion(scheme, GroupVersion)
return nil
diff --git a/vendor/github.com/openshift/api/config/v1/types.go b/vendor/github.com/openshift/api/config/v1/types.go
index 3e17ca0cc..e7106ef7a 100644
--- a/vendor/github.com/openshift/api/config/v1/types.go
+++ b/vendor/github.com/openshift/api/config/v1/types.go
@@ -284,7 +284,12 @@ type ClientConnectionOverrides struct {
}
// GenericControllerConfig provides information to configure a controller
+//
+// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+// +openshift:compatibility-gen:level=1
type GenericControllerConfig struct {
+ metav1.TypeMeta `json:",inline"`
+
// servingInfo is the HTTP serving information for the controller's endpoints
ServingInfo HTTPServingInfo `json:"servingInfo"`
diff --git a/vendor/github.com/openshift/api/config/v1/types_apiserver.go b/vendor/github.com/openshift/api/config/v1/types_apiserver.go
index 31d888185..7de714ebf 100644
--- a/vendor/github.com/openshift/api/config/v1/types_apiserver.go
+++ b/vendor/github.com/openshift/api/config/v1/types_apiserver.go
@@ -34,6 +34,7 @@ type APIServer struct {
Status APIServerStatus `json:"status"`
}
+// +openshift:validation:FeatureGateAwareXValidation:featureGate=TLSAdherence,rule="has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true",message="tlsAdherence may not be removed once set"
type APIServerSpec struct {
// servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates
// will be used for serving secure traffic.
@@ -62,6 +63,39 @@ type APIServerSpec struct {
// The current default is the Intermediate profile.
// +optional
TLSSecurityProfile *TLSSecurityProfile `json:"tlsSecurityProfile,omitempty"`
+ // tlsAdherence controls if components in the cluster adhere to the TLS security profile
+ // configured on this APIServer resource.
+ //
+ // Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents".
+ //
+ // When set to "LegacyAdheringComponentsOnly", components that already honor the
+ // cluster-wide TLS profile continue to do so. Components that do not already honor
+ // it continue to use their individual TLS configurations.
+ //
+ // When set to "StrictAllComponents", all components must honor the configured TLS
+ // profile unless they have a component-specific TLS configuration that overrides
+ // it. This mode is recommended for security-conscious deployments and is required
+ // for certain compliance frameworks.
+ //
+ // Note: Some components such as Kubelet and IngressController have their own
+ // dedicated TLS configuration mechanisms via KubeletConfig and IngressController
+ // CRs respectively. When these component-specific TLS configurations are set,
+ // they take precedence over the cluster-wide tlsSecurityProfile. When not set,
+ // these components fall back to the cluster-wide default.
+ //
+ // Components that encounter an unknown value for tlsAdherence should treat it
+ // as "StrictAllComponents" and log a warning to ensure forward compatibility
+ // while defaulting to the more secure behavior.
+ //
+ // This field is optional.
+ // When omitted, this means the user has no opinion and the platform is left
+ // to choose reasonable defaults. These defaults are subject to change over time.
+ // The current default is LegacyAdheringComponentsOnly.
+ //
+ // Once set, this field may be changed to a different value, but may not be removed.
+ // +openshift:enable:FeatureGate=TLSAdherence
+ // +optional
+ TLSAdherence TLSAdherencePolicy `json:"tlsAdherence,omitempty"`
// audit specifies the settings for audit configuration to be applied to all OpenShift-provided
// API servers in the cluster.
// +optional
@@ -175,7 +209,7 @@ type APIServerNamedServingCert struct {
}
// APIServerEncryption is used to encrypt sensitive resources on the cluster.
-// +openshift:validation:FeatureGateAwareXValidation:featureGate=KMSEncryptionProvider,rule="has(self.type) && self.type == 'KMS' ? has(self.kms) : !has(self.kms)",message="kms config is required when encryption type is KMS, and forbidden otherwise"
+// +openshift:validation:FeatureGateAwareXValidation:featureGate=KMSEncryption,rule="has(self.type) && self.type == 'KMS' ? has(self.kms) : !has(self.kms)",message="kms config is required when encryption type is KMS, and forbidden otherwise"
// +union
type APIServerEncryption struct {
// type defines what encryption type should be used to encrypt resources at the datastore layer.
@@ -204,14 +238,13 @@ type APIServerEncryption struct {
// managing the lifecyle of the encryption keys outside of the control plane.
// This allows integration with an external provider to manage the data encryption keys securely.
//
- // +openshift:enable:FeatureGate=KMSEncryptionProvider
+ // +openshift:enable:FeatureGate=KMSEncryption
// +unionMember
// +optional
- KMS *KMSConfig `json:"kms,omitempty"`
+ KMS KMSPluginConfig `json:"kms,omitempty,omitzero"`
}
// +openshift:validation:FeatureGateAwareEnum:featureGate="",enum="";identity;aescbc;aesgcm
-// +openshift:validation:FeatureGateAwareEnum:featureGate=KMSEncryptionProvider,enum="";identity;aescbc;aesgcm;KMS
// +openshift:validation:FeatureGateAwareEnum:featureGate=KMSEncryption,enum="";identity;aescbc;aesgcm;KMS
type EncryptionType string
@@ -237,6 +270,35 @@ const (
type APIServerStatus struct {
}
+// TLSAdherencePolicy defines which components adhere to the TLS security profile.
+// Implementors should use the ShouldHonorClusterTLSProfile helper function from library-go
+// rather than checking these values directly.
+// +kubebuilder:validation:Enum=LegacyAdheringComponentsOnly;StrictAllComponents
+type TLSAdherencePolicy string
+
+const (
+ // TLSAdherencePolicyNoOpinion represents an empty/unset value for tlsAdherence.
+ // This value cannot be explicitly set and is only present when the field is omitted.
+ // When the field is omitted, the cluster defaults to LegacyAdheringComponentsOnly
+ // behavior. Components should treat this the same as LegacyAdheringComponentsOnly.
+ TLSAdherencePolicyNoOpinion TLSAdherencePolicy = ""
+
+ // TLSAdherencePolicyLegacyAdheringComponentsOnly maintains backward-compatible behavior.
+ // Components that already honor the cluster-wide TLS profile (such as kube-apiserver,
+ // openshift-apiserver, oauth-apiserver, and others) continue to do so. Components that do
+ // not already honor it continue to use their individual TLS configurations (e.g.,
+ // IngressController.spec.tlsSecurityProfile, KubeletConfig.spec.tlsSecurityProfile,
+ // or component defaults). No additional components are required to start honoring the
+ // cluster-wide profile in this mode.
+ TLSAdherencePolicyLegacyAdheringComponentsOnly TLSAdherencePolicy = "LegacyAdheringComponentsOnly"
+
+ // TLSAdherencePolicyStrictAllComponents means all components must honor the configured TLS
+ // profile unless they have a component-specific TLS configuration that overrides it.
+ // This mode is recommended for security-conscious deployments and is required
+ // for certain compliance frameworks.
+ TLSAdherencePolicyStrictAllComponents TLSAdherencePolicy = "StrictAllComponents"
+)
+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
diff --git a/vendor/github.com/openshift/api/config/v1/types_authentication.go b/vendor/github.com/openshift/api/config/v1/types_authentication.go
index 64d0f399b..348ee0401 100644
--- a/vendor/github.com/openshift/api/config/v1/types_authentication.go
+++ b/vendor/github.com/openshift/api/config/v1/types_authentication.go
@@ -5,7 +5,7 @@ import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
// +genclient
// +genclient:nonNamespaced
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDC;ExternalOIDCWithUIDAndExtraClaimMappings;ExternalOIDCWithUpstreamParity,rule="!has(self.spec.oidcProviders) || self.spec.oidcProviders.all(p, !has(p.oidcClients) || p.oidcClients.all(specC, self.status.oidcClients.exists(statusC, statusC.componentNamespace == specC.componentNamespace && statusC.componentName == specC.componentName) || (has(oldSelf.spec.oidcProviders) && oldSelf.spec.oidcProviders.exists(oldP, oldP.name == p.name && has(oldP.oidcClients) && oldP.oidcClients.exists(oldC, oldC.componentNamespace == specC.componentNamespace && oldC.componentName == specC.componentName)))))",message="all oidcClients in the oidcProviders must match their componentName and componentNamespace to either a previously configured oidcClient or they must exist in the status.oidcClients"
+// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDC;ExternalOIDCWithUIDAndExtraClaimMappings;ExternalOIDCWithUpstreamParity;ExternalOIDCExternalClaimsSourcing,rule="!has(self.spec.oidcProviders) || self.spec.oidcProviders.all(p, !has(p.oidcClients) || p.oidcClients.all(specC, self.status.oidcClients.exists(statusC, statusC.componentNamespace == specC.componentNamespace && statusC.componentName == specC.componentName) || (has(oldSelf.spec.oidcProviders) && oldSelf.spec.oidcProviders.exists(oldP, oldP.name == p.name && has(oldP.oidcClients) && oldP.oidcClients.exists(oldC, oldC.componentNamespace == specC.componentNamespace && oldC.componentName == specC.componentName)))))",message="all oidcClients in the oidcProviders must match their componentName and componentNamespace to either a previously configured oidcClient or they must exist in the status.oidcClients"
// Authentication specifies cluster-wide settings for authentication (like OAuth and
// webhook token authenticators). The canonical name of an instance is `cluster`.
@@ -91,6 +91,7 @@ type AuthenticationSpec struct {
// +openshift:enable:FeatureGate=ExternalOIDC
// +openshift:enable:FeatureGate=ExternalOIDCWithUIDAndExtraClaimMappings
// +openshift:enable:FeatureGate=ExternalOIDCWithUpstreamParity
+ // +openshift:enable:FeatureGate=ExternalOIDCExternalClaimsSourcing
// +optional
OIDCProviders []OIDCProvider `json:"oidcProviders,omitempty"`
}
@@ -245,6 +246,36 @@ type OIDCProvider struct {
// +optional
// +openshift:enable:FeatureGate=ExternalOIDCWithUpstreamParity
UserValidationRules []TokenUserValidationRule `json:"userValidationRules,omitempty"`
+
+ // externalClaimsSources is an optional field that can be used to configure
+ // sources, external to the token provided in a request, in which claims
+ // should be fetched from and made available to the claim mapping process
+ // that is used to build the identity of a token holder.
+ //
+ // For example, fetching additional user metadata from an OIDC provider's UserInfo endpoint.
+ //
+ // When not specified, only claims present in the token itself will be available
+ // in the claim mapping process.
+ //
+ // When specified, at least one external claim source must be specified and no more than 5
+ // sources may be specified.
+ // All external claim sources must have unique claim mappings.
+ // When an external source responds and resolves additional claims successfully, they will
+ // be made available as claims during the claim mapping process.
+ // Externally sourced claims with the same name as a claim existing within the token will
+ // overwrite the claim data from the token with the externally sourced information.
+ // If an external source does not respond, responds with an error, or the additional
+ // claim data cannot be resolved from the response successfully it will not be
+ // included in the claim data passed to the claim mapping process.
+ //
+ // +openshift:enable:FeatureGate=ExternalOIDCExternalClaimsSourcing
+ //
+ // +optional
+ // +kubebuilder:validation:MinItems=1
+ // +kubebuilder:validation:MaxItems=5
+ // +kubebuilder:validation:XValidation:rule="self.all(s, s.mappings.all(m, self.filter(s2, s2.mappings.exists(m2, m2.name == m.name)).size() == 1))",message="mapping names must be unique across all external claim sources."
+ // +listType=atomic
+ ExternalClaimsSources []ExternalClaimsSource `json:"externalClaimsSources,omitempty"`
}
// +kubebuilder:validation:MinLength=1
@@ -618,6 +649,7 @@ type OIDCClientReference struct {
// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDC,rule="has(self.claim)",message="claim is required"
// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithUIDAndExtraClaimMappings,rule="has(self.claim)",message="claim is required"
// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithUpstreamParity,rule="has(self.claim) ? !has(self.expression) : has(self.expression)",message="precisely one of claim or expression must be set"
+// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithUpstreamParity,rule="has(self.expression) && size(self.expression) > 0 ? !has(self.prefixPolicy) || self.prefixPolicy != 'Prefix' : true",message="prefixPolicy must not be set to 'Prefix' when expression is set"
type UsernameClaimMapping struct {
// claim is an optional field that configures the JWT token claim whose value is assigned to the cluster identity field associated with this mapping.
// claim is required when the ExternalOIDCWithUpstreamParity feature gate is not enabled.
@@ -650,11 +682,9 @@ type UsernameClaimMapping struct {
// Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
//
// When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim.
- //
// The prefix field must be set when prefixPolicy is 'Prefix'.
- //
+ // Must not be set to 'Prefix' when expression is set.
// When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim.
- //
// When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time.
// Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'.
//
@@ -684,7 +714,7 @@ type UsernameClaimMapping struct {
// +enum
type UsernamePrefixPolicy string
-var (
+const (
// NoOpinion let's the cluster assign prefixes. If the username claim is email, there is no prefix
// If the username claim is anything else, it is prefixed by the issuerURL
NoOpinion UsernamePrefixPolicy = ""
@@ -710,12 +740,14 @@ type UsernamePrefix struct {
// PrefixedClaimMapping configures a claim mapping
// that allows for an optional prefix.
+// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithUpstreamParity,rule="has(self.expression) && size(self.expression) > 0 ? (!has(self.prefix) || size(self.prefix) == 0) : true",message="prefix must not be set to a non-empty value when expression is set"
type PrefixedClaimMapping struct {
TokenClaimMapping `json:",inline"`
// prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.
//
- // When omitted (""), no prefix is applied to the cluster identity attribute.
+ // When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute.
+ // Must not be set to a non-empty value when expression is set.
//
// Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c".
//
@@ -734,10 +766,10 @@ type TokenValidationRuleType string
const (
// TokenValidationRuleTypeRequiredClaim indicates that the token must contain a specific claim.
// Used as a value for TokenValidationRuleType.
- TokenValidationRuleTypeRequiredClaim = "RequiredClaim"
+ TokenValidationRuleTypeRequiredClaim TokenValidationRuleType = "RequiredClaim"
// TokenValidationRuleTypeCEL indicates that the token validation is defined via a CEL expression.
// Used as a value for TokenValidationRuleType.
- TokenValidationRuleTypeCEL = "CEL"
+ TokenValidationRuleTypeCEL TokenValidationRuleType = "CEL"
)
// TokenClaimValidationRule represents a validation rule based on token claims.
@@ -830,3 +862,355 @@ type TokenUserValidationRule struct {
// +kubebuilder:validation:MaxLength=256
Message string `json:"message,omitempty"`
}
+
+// ExternalClaimsSource provides the configuration for a single external claim source.
+type ExternalClaimsSource struct {
+ // authentication is an optional field that configures how the apiserver authenticates with an external claims source.
+ // When not specified, anonymous authentication is used which means no 'Authorization' header
+ // is sent in the HTTP request to fetch the external claims.
+ //
+ // +optional
+ Authentication ExternalSourceAuthentication `json:"authentication,omitzero"`
+
+ // tls is an optional field that configures the http client TLS
+ // settings when fetching external claims from this source.
+ //
+ // When omitted, system default TLS settings will be used
+ // for fetching claims from the external source.
+ //
+ // +optional
+ TLS ExternalSourceTLS `json:"tls,omitzero"`
+
+ // url is a required configuration of the URL
+ // for which the external claims are located.
+ //
+ // +required
+ URL SourceURL `json:"url,omitzero"`
+
+ // mappings is a required list of the claim
+ // and response handling expression pairs
+ // that produces the claims from the external source.
+ // mappings must have at least 1 entry and must not exceed 16 entries.
+ // Entries must have a unique name across all external claim sources.
+ //
+ // +required
+ // +listType=map
+ // +listMapKey=name
+ // +kubebuilder:validation:MinItems=1
+ // +kubebuilder:validation:MaxItems=16
+ Mappings []SourcedClaimMapping `json:"mappings,omitempty"`
+
+ // predicates is an optional list of constraints in
+ // which claims should attempt to be fetched from this
+ // external source.
+ //
+ // When omitted, claims are always fetched
+ // from this external source.
+ //
+ // When specified, all predicates must evaluate to 'true'
+ // before claims are attempted to be fetched from this external source.
+ // predicates must have at least 1 entry and must not exceed 16 entries.
+ // Entries must have unique expressions.
+ //
+ // +optional
+ // +listType=map
+ // +listMapKey=expression
+ // +kubebuilder:validation:MinItems=1
+ // +kubebuilder:validation:MaxItems=16
+ Predicates []ExternalSourcePredicate `json:"predicates,omitempty"`
+}
+
+// ExternalSourceAuthenticationType is the type of authentication that should be used
+// when fetching claims from an external source.
+//
+// +enum
+// +kubebuilder:validation:Enum=RequestProvidedToken;ClientCredential
+type ExternalSourceAuthenticationType string
+
+const (
+ // ExternalSourceAuthenticationTypeRequestProvidedToken is an ExternalSourceAuthenticationType
+ // that represents that the token being evaluated for authentication
+ // should be used for authenticating with the external claims source.
+ // This is useful for scenarios where a token has multiple audiences
+ // and scopes so that it can be used to access both the cluster and
+ // the UserInfo endpoint that contains additional information about the
+ // user not present in the token.
+ ExternalSourceAuthenticationTypeRequestProvidedToken ExternalSourceAuthenticationType = "RequestProvidedToken"
+
+ // ExternalSourceAuthenticationTypeClientCredential is an ExternalSourceAuthenticationType
+ // that represents that the authenticator should use the OAuth2
+ // client credentials grant flow to obtain an access token for
+ // authenticating with the external claims source.
+ // This is useful for scenarios such as fetching user information
+ // from Microsoft's Graph API where a separate client credential
+ // is needed to access the API.
+ ExternalSourceAuthenticationTypeClientCredential ExternalSourceAuthenticationType = "ClientCredential"
+)
+
+// ExternalSourceAuthentication configures how the apiserver should attempt
+// to authenticate with an external claims source.
+//
+// +kubebuilder:validation:XValidation:rule="self.type == 'ClientCredential' ? has(self.clientCredential) : !has(self.clientCredential)",message="clientCredential is required when type is ClientCredential, and forbidden otherwise"
+type ExternalSourceAuthentication struct {
+ // type is a required field that sets the type of
+ // authentication method used by the authenticator
+ // when fetching external claims.
+ //
+ // Allowed values are 'RequestProvidedToken' and 'ClientCredential'.
+ //
+ // When set to 'RequestProvidedToken', the authenticator will
+ // use the token provided to the kube-apiserver as part of the
+ // request to authenticate with the external claims source.
+ //
+ // When set to 'ClientCredential', the authenticator will
+ // use the configured client-id, client-secret, and token endpoint
+ // to fetch an access token using the OAuth2 client credentials grant
+ // flow. The fetched access token will then be used to authenticate
+ // with the external claims source.
+ //
+ // +required
+ Type ExternalSourceAuthenticationType `json:"type,omitempty"`
+
+ // clientCredential configures the client credentials
+ // and token endpoint to use to get an access token.
+ // clientCredential is required when type is 'ClientCredential', and forbidden otherwise.
+ //
+ // +optional
+ ClientCredential ClientCredentialConfig `json:"clientCredential,omitzero"`
+}
+
+// ExternalSourceTLS configures the TLS options that the apiserver uses as a client
+// when making a request to the external claim source.
+type ExternalSourceTLS struct {
+ // certificateAuthority is a required reference to a ConfigMap in the openshift-config
+ // namespace that contains the CA certificate to use to validate TLS connections with the external claims source.
+ // The key "ca-bundle.crt" must be present in the referenced ConfigMap and must contain the CA certificate to be used
+ // to verify the external source's TLS certificate.
+ //
+ // +required
+ CertificateAuthority ExternalSourceCertificateAuthorityConfigMapReference `json:"certificateAuthority,omitzero"`
+}
+
+// ClientCredentialConfig configures the client credentials and token endpoint
+// to use to get an access token via the OAuth2 client credentials grant flow.
+type ClientCredentialConfig struct {
+ // clientID is a required client identifier to use during the OAuth2 client credentials flow.
+ // clientID must be at least 1 character in length, must not exceed 256 characters in length,
+ // and must only contain printable ASCII characters.
+ //
+ // +required
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=256
+ // +kubebuilder:validation:XValidation:rule="self.matches('^[[:print:]]+$')",message="clientID must only contain printable ASCII characters"
+ ClientID string `json:"clientID,omitempty"`
+
+ // clientSecret is a required reference to a Secret in the openshift-config namespace to be used
+ // as the client secret during the OAuth2 client credentials flow.
+ //
+ // The key 'client-secret' is used to locate the client secret data in the Secret.
+ //
+ // +required
+ ClientSecret ClientSecretSecretReference `json:"clientSecret,omitzero"`
+
+ // tokenEndpoint is a required URL to query for an access token using
+ // the client credential OAuth2 flow.
+ // tokenEndpoint must be at least 1 character in length and must not exceed 2048 characters in length.
+ // tokenEndpoint must be a valid HTTPS URL.
+ // tokenEndpoint must have a host and a path.
+ // tokenEndpoint must not contain query parameters, fragments,
+ // or user information (e.g., "user:password@host").
+ //
+ // +required
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=2048
+ // +kubebuilder:validation:XValidation:rule="isURL(self)",message="tokenEndpoint must be a valid HTTPS url"
+ // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getScheme() == 'https'",message="tokenEndpoint must be a valid HTTPS url"
+ // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getHost() != ''",message="tokenEndpoint must have a hostname"
+ // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getEscapedPath() != ''",message="tokenEndpoint must have a path"
+ // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getQuery() == {}",message="tokenEndpoint must not have query parameters"
+ // +kubebuilder:validation:XValidation:rule="isURL(self) && self.find('#(.+)$') == ''",message="tokenEndpoint must not have a fragment"
+ // +kubebuilder:validation:XValidation:rule="isURL(self) && !self.matches('^https://[^/]+@.+$')",message="tokenEndpoint must not have user info"
+ TokenEndpoint string `json:"tokenEndpoint,omitempty"`
+
+ // scopes is an optional list of OAuth2 scopes to request when obtaining
+ // an access token.
+ //
+ // If not specified, the token endpoint's default scopes
+ // will be used.
+ //
+ // When specified, there must be at least 1 entry and must not exceed 16 entries.
+ // Each entry must be at least 1 character in length and must not exceed 256 characters in length.
+ // Each entry must only contain printable ASCII characters, excluding spaces, double quotes and backslashes.
+ // Entries must be unique.
+ //
+ // +optional
+ // +kubebuilder:validation:MinItems=1
+ // +kubebuilder:validation:MaxItems=16
+ // +listType=set
+ Scopes []OAuth2Scope `json:"scopes,omitempty"`
+
+ // tls is an optional field that allows configuring the TLS
+ // settings used to interact with the identity provider
+ // as an OAuth2 client.
+ //
+ // When omitted, system default TLS settings will be used
+ // for the OAuth2 client.
+ //
+ // +optional
+ TLS ExternalSourceTLS `json:"tls,omitzero"`
+}
+
+// OAuth2Scope is a string alias that represents an OAuth2 Scope as defined by https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.4
+// Must be at least 1 character in length, must not exceed 256 characters in length and must only contain printable ASCII characters, excluding spaces, double quotes and backslashes.
+//
+// +kubebuilder:validation:XValidation:rule="self.matches('^[!#-[\\\\]-~]+$')",message="scopes must only contain printable ASCII characters excluding spaces, double quotes and backslashes"
+// +kubebuilder:validation:MinLength=1
+// +kubebuilder:validation:MaxLength=256
+type OAuth2Scope string
+
+// SourceURL configures the options used to build the URL that is queried for external claims.
+type SourceURL struct {
+ // hostname is a required hostname for which the external claims are located.
+ //
+ // It must be a valid DNS subdomain name as per RFC1123.
+ //
+ // This means that it must start and end with a lowercase alphanumeric character,
+ // must only consist of lowercase alphanumeric characters, '-', and '.'.
+ // hostname may optionally specify a port in the format ':{port}'.
+ // If a port is specified it must not exceed 65535.
+ //
+ // hostname must be at least 1 character in length.
+ // When specifying a port, hostname must not exceed 259 characters in length.
+ // When not specifying a port, hostname must not exceed 253 characters in length.
+ //
+ // +required
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=259
+ // +kubebuilder:validation:XValidation:rule="isURL('https://'+self)",message="hostname must be a valid hostname"
+ // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self.split(':')[0]).hasValue()",message="hostname before port must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'"
+ // +kubebuilder:validation:XValidation:rule="self.split(':').size() > 1 ? int(self.split(':')[1]) <= 65535 : true",message="port must not exceed 65535"
+ Hostname string `json:"hostname,omitempty"`
+
+ // pathExpression is a required CEL expression that returns a list
+ // of string values used to construct the URL path.
+ // Claims from the token used for the request to the kube-apiserver
+ // are made available via the `claims` variable.
+ // expression must be at least 1 character in length and must not exceed 1024 characters in length.
+ //
+ // Values in the returned list will be joined with the hostname using a forward slash
+ // (`/`) as a separator. Values in the returned list do not need to include the forward slash.
+ // If a forward slash is included in a returned value, it will be encoded as `%2F`.
+ //
+ // Example of a static path configuration:
+ //
+ // pathExpression: ['realms', 'k8s', 'protocol', 'openid-connect', 'userinfo']
+ //
+ // The above example would resolve to the path: '/realms/k8s/protocol/openid-connect/userinfo'
+ //
+ // Example of a dynamic path configuration:
+ //
+ // pathExpression: "['admin', 'realms', 'k8s', 'users'] + [claims.sub] + ['groups']"
+ //
+ // Assuming 'claims.sub' is set to '12345', the above example would resolve to the path: '/admin/realms/k8s/users/12345/groups'
+ //
+ // +required
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=1024
+ PathExpression string `json:"pathExpression,omitempty"`
+}
+
+// SourcedClaimMapping configures the mapping behavior for a single external claim
+// from the response the apiserver received from the external claim source.
+type SourcedClaimMapping struct {
+ // name is a required name of the claim that
+ // will be produced and made available during
+ // the claim-to-identity mapping process.
+ // name must consist of only lowercase alpha characters and underscores ('_').
+ // name must be at least 1 character and must not exceed 256 characters in length.
+ //
+ // +required
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=256
+ // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z_]+$')",message="name must consist of only lowercase alpha characters and underscores"
+ Name string `json:"name,omitempty"`
+
+ // expression is a required CEL expression that
+ // will produce a value to be assigned to the claim.
+ // The full response body from the request to the
+ // external claim source is provided via the
+ // `response.body` variable.
+ //
+ // The contents of the `response.body` variable varies based on the response received
+ // from the external source. It is the responsibility of those configuring
+ // this expression to understand what is returned from the external source.
+ //
+ // expression must be at least 1 character and must not exceed 1024 characters in length.
+ //
+ // +required
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=1024
+ Expression string `json:"expression,omitempty"`
+}
+
+// ExternalSourcePredicate configures a singular condition
+// that must return true before the external source is queried
+// to retrieve external claims.
+type ExternalSourcePredicate struct {
+ // expression is a required CEL expression that
+ // is used to determine whether or not an external
+ // source should be used to fetch external claims.
+ //
+ // The expression must return a boolean value,
+ // where true means that the source should be consulted
+ // and false means that it should not.
+ //
+ // Claims from the token used for the request to the kube-apiserver
+ // are made available via the `claims` variable.
+ //
+ // The contents of the `claims` variable varies based on the claims that are
+ // present in the token being validated. It is the responsibility of those configuring this
+ // field to understand what claims the identity provider includes when issuing tokens.
+ //
+ // expression must be at least 1 character and must not exceed 1024 characters in length.
+ //
+ // +required
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=1024
+ Expression string `json:"expression,omitempty"`
+}
+
+// ExternalSourceCertificateAuthorityConfigMapReference is a reference to a ConfigMap in the openshift-config
+// namespace that should be used for configuring the certificate authority to be
+// used when sourcing claims from external sources.
+type ExternalSourceCertificateAuthorityConfigMapReference struct {
+ // name is the required name of the ConfigMap that exists in the openshift-config namespace.
+ // The key "ca-bundle.crt" must be present and must contain the CA certificate to be used
+ // to verify the external source's TLS certificate.
+ //
+ // It must be at least 1 character in length, must not exceed 253 characters in length,
+ // must start and end with a lowercase alphanumeric character, and must only contain
+ // lowercase alphanumeric characters, '-' or '.'.
+ //
+ // +required
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=253
+ // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'"
+ Name string `json:"name,omitempty"`
+}
+
+// ClientSecretSecretReference is a reference to a Secret in the openshift-config
+// namespace that should be used for configuring the client secret to be
+// used when sourcing claims from external sources with the client credential authentication flow.
+type ClientSecretSecretReference struct {
+ // name is the required name of the Secret that exists in the openshift-config namespace.
+ //
+ // It must be at least 1 character in length, must not exceed 253 characters in length,
+ // must start and end with a lowercase alphanumeric character, and must only contain
+ // lowercase alphanumeric characters, '-' or '.'.
+ //
+ // +required
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=253
+ // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'"
+ Name string `json:"name,omitempty"`
+}
diff --git a/vendor/github.com/openshift/api/config/v1/types_cluster_operator.go b/vendor/github.com/openshift/api/config/v1/types_cluster_operator.go
index 832304038..e934e8355 100644
--- a/vendor/github.com/openshift/api/config/v1/types_cluster_operator.go
+++ b/vendor/github.com/openshift/api/config/v1/types_cluster_operator.go
@@ -160,8 +160,9 @@ const (
// is actively rolling out new code, propagating config changes (e.g, a version change), or otherwise
// moving from one steady state to another. Operators should not report
// Progressing when they are reconciling (without action) a previously known
- // state. Operators should not report Progressing only because DaemonSets owned by them
- // are adjusting to a new node from cluster scaleup or a node rebooting from cluster upgrade.
+ // state. Operators should not report Progressing only because resources owned by them,
+ // such as DaemonSets and Deployments, are adjusting to a new node from cluster scaleup
+ // or a node rebooting from cluster upgrade.
// If the observed cluster state has changed and the component is
// reacting to it (updated proxy configuration for instance), Progressing should become true
// since it is moving from one steady state to another.
diff --git a/vendor/github.com/openshift/api/config/v1/types_cluster_version.go b/vendor/github.com/openshift/api/config/v1/types_cluster_version.go
index 5f36f693d..9cb85f4c0 100644
--- a/vendor/github.com/openshift/api/config/v1/types_cluster_version.go
+++ b/vendor/github.com/openshift/api/config/v1/types_cluster_version.go
@@ -18,7 +18,8 @@ import (
// +kubebuilder:object:root=true
// +kubebuilder:subresource:status
// +kubebuilder:resource:path=clusterversions,scope=Cluster
-// +kubebuilder:validation:XValidation:rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && self.spec.capabilities.baselineCapabilitySet == 'None' && 'marketplace' in self.spec.capabilities.additionalEnabledCapabilities ? 'OperatorLifecycleManager' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'OperatorLifecycleManager' in self.status.capabilities.enabledCapabilities) : true",message="the `marketplace` capability requires the `OperatorLifecycleManager` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `OperatorLifecycleManager` capability"
+// +openshift:validation:FeatureGateAwareXValidation:featureGate="";CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && self.spec.capabilities.baselineCapabilitySet == 'None' && 'marketplace' in self.spec.capabilities.additionalEnabledCapabilities ? 'OperatorLifecycleManager' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'OperatorLifecycleManager' in self.status.capabilities.enabledCapabilities) : true",message="the `marketplace` capability requires the `OperatorLifecycleManager` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `OperatorLifecycleManager` capability"
+// +openshift:validation:FeatureGateAwareXValidation:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && 'ClusterAPI' in self.spec.capabilities.additionalEnabledCapabilities ? 'CompatibilityRequirements' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'CompatibilityRequirements' in self.status.capabilities.enabledCapabilities) : true",message="the `ClusterAPI` capability requires the `CompatibilityRequirements` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `CompatibilityRequirements` capability"
// +kubebuilder:printcolumn:name=Version,JSONPath=.status.history[?(@.state=="Completed")].version,type=string
// +kubebuilder:printcolumn:name=Available,JSONPath=.status.conditions[?(@.type=="Available")].status,type=string
// +kubebuilder:printcolumn:name=Progressing,JSONPath=.status.conditions[?(@.type=="Progressing")].status,type=string
@@ -283,6 +284,16 @@ type UpdateHistory struct {
// ClusterID is string RFC4122 uuid.
type ClusterID string
+// UpdateMode defines how an update should be processed.
+// +enum
+// +kubebuilder:validation:Enum=Preflight
+type UpdateMode string
+
+const (
+ // UpdateModePreflight allows an update to be checked for compatibility without committing to updating the cluster.
+ UpdateModePreflight UpdateMode = "Preflight"
+)
+
// ClusterVersionArchitecture enumerates valid cluster architectures.
// +kubebuilder:validation:Enum="Multi";""
type ClusterVersionArchitecture string
@@ -294,7 +305,10 @@ const (
)
// ClusterVersionCapability enumerates optional, core cluster components.
-// +kubebuilder:validation:Enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1
+// +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1
+// +openshift:validation:FeatureGateAwareEnum:featureGate=CRDCompatibilityRequirementOperator,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements
+// +openshift:validation:FeatureGateAwareEnum:featureGate=ClusterAPIMachineManagement,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI
+// +openshift:validation:FeatureGateAwareEnum:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI
type ClusterVersionCapability string
const (
@@ -415,6 +429,19 @@ const (
// Managers deployed on top of OpenShift. They help you to work with cloud
// provider API and embeds cloud-specific control logic.
ClusterVersionCapabilityCloudControllerManager ClusterVersionCapability = "CloudControllerManager"
+
+ // ClusterVersionCapabilityCompatibilityRequirements manages the Compatibility
+ // Requirements operator which enforces CRD compatibility constraints via
+ // validating webhooks.
+ ClusterVersionCapabilityCompatibilityRequirements ClusterVersionCapability = "CompatibilityRequirements"
+
+ // ClusterVersionCapabilityClusterAPI manages the Cluster API operator and
+ // controllers which provide forward-compatible machine management for
+ // OpenShift clusters.
+ //
+ // Note that Cluster API has a hard requirement on CompatibilityRequirements.
+ // CompatibilityRequirements cannot be disabled while Cluster API is enabled.
+ ClusterVersionCapabilityClusterAPI ClusterVersionCapability = "ClusterAPI"
)
// KnownClusterVersionCapabilities includes all known optional, core cluster components.
@@ -436,6 +463,8 @@ var KnownClusterVersionCapabilities = []ClusterVersionCapability{
ClusterVersionCapabilityCloudCredential,
ClusterVersionCapabilityIngress,
ClusterVersionCapabilityCloudControllerManager,
+ ClusterVersionCapabilityCompatibilityRequirements,
+ ClusterVersionCapabilityClusterAPI,
}
// ClusterVersionCapabilitySet defines sets of cluster version capabilities.
@@ -634,6 +663,8 @@ var ClusterVersionCapabilitySets = map[ClusterVersionCapabilitySet][]ClusterVers
ClusterVersionCapabilityCloudCredential,
ClusterVersionCapabilityIngress,
ClusterVersionCapabilityCloudControllerManager,
+ ClusterVersionCapabilityCompatibilityRequirements,
+ ClusterVersionCapabilityClusterAPI,
},
}
@@ -760,6 +791,22 @@ type Update struct {
// +listMapKey=name
// +optional
AcceptRisks []AcceptRisk `json:"acceptRisks,omitempty"`
+
+ // mode determines how an update should be processed.
+ // The only valid value is "Preflight".
+ // When omitted, the cluster performs a normal update by applying the specified version or image to the cluster.
+ // This is the standard update behavior.
+ // When set to "Preflight", the cluster runs compatibility checks against the target release without
+ // performing an actual update. Compatibility results, including any detected risks, are reported
+ // in status.conditionalUpdates and status.conditionalUpdateRisks alongside risks from the update
+ // recommendation service.
+ // This allows administrators to assess update readiness and address issues before committing to the update.
+ // Preflight mode is particularly useful for skip-level updates where upgrade compatibility needs to be
+ // verified across multiple minor versions.
+ // When mode is set to "Preflight", the same rules for version, image, and architecture apply as for normal updates.
+ // +openshift:enable:FeatureGate=ClusterUpdatePreflight
+ // +optional
+ Mode UpdateMode `json:"mode,omitempty"`
}
// AcceptRisk represents a risk that is considered acceptable.
diff --git a/vendor/github.com/openshift/api/config/v1/types_crio_credential_provider_config.go b/vendor/github.com/openshift/api/config/v1/types_crio_credential_provider_config.go
new file mode 100644
index 000000000..3fe543aac
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/types_crio_credential_provider_config.go
@@ -0,0 +1,186 @@
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is "cluster". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources.
+// For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in.
+// CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation.
+// Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout.
+//
+// The resource is a singleton named "cluster".
+//
+// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:path=criocredentialproviderconfigs,scope=Cluster
+// +kubebuilder:subresource:status
+// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/2725
+// +openshift:file-pattern=cvoRunLevel=0000_10,operatorName=config-operator,operatorOrdering=01
+// +openshift:enable:FeatureGate=CRIOCredentialProviderConfig
+// +openshift:compatibility-gen:level=1
+// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'cluster'",message="criocredentialproviderconfig is a singleton, .metadata.name must be 'cluster'"
+type CRIOCredentialProviderConfig struct {
+ metav1.TypeMeta `json:",inline"`
+
+ // metadata is the standard object's metadata.
+ // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+ // +optional
+ metav1.ObjectMeta `json:"metadata,omitzero"`
+
+ // spec defines the desired configuration of the CRI-O Credential Provider.
+ // This field is required and must be provided when creating the resource.
+ // +required
+ Spec *CRIOCredentialProviderConfigSpec `json:"spec,omitempty,omitzero"`
+
+ // status represents the current state of the CRIOCredentialProviderConfig.
+ // When omitted or nil, it indicates that the status has not yet been set by the controller.
+ // The controller will populate this field with validation conditions and operational state.
+ // +optional
+ Status CRIOCredentialProviderConfigStatus `json:"status,omitzero,omitempty"`
+}
+
+// CRIOCredentialProviderConfigSpec defines the desired configuration of the CRI-O Credential Provider.
+// +kubebuilder:validation:MinProperties=0
+type CRIOCredentialProviderConfigSpec struct {
+ // matchImages is a list of string patterns used to determine whether
+ // the CRI-O credential provider should be invoked for a given image. This list is
+ // passed to the kubelet CredentialProviderConfig, and if any pattern matches
+ // the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling
+ // that image or its mirrors.
+ // Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider.
+ // Conflicts between the existing platform specific provider image match configuration and this list will be handled by
+ // the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those
+ // from the CRIOCredentialProviderConfig when both match the same image.
+ // To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with
+ // existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml).
+ // You can check the resource's Status conditions
+ // to see if any entries were ignored due to exact matches with known built-in provider patterns.
+ //
+ // This field is optional, the items of the list must contain between 1 and 50 entries.
+ // The list is treated as a set, so duplicate entries are not allowed.
+ //
+ // For more details, see:
+ // https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/
+ // https://github.com/cri-o/crio-credential-provider#architecture
+ //
+ // Each entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters.
+ // Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io',
+ // and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net').
+ // A global wildcard '*' (matching any domain) is not allowed.
+ // Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path.
+ // For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not.
+ // Each wildcard matches only a single domain label,
+ // so '*.io' does **not** match '*.k8s.io'.
+ //
+ // A match exists between an image and a matchImage when all of the below are true:
+ // Both contain the same number of domain parts and each part matches.
+ // The URL path of an matchImages must be a prefix of the target image URL path.
+ // If the matchImages contains a port, then the port must match in the image as well.
+ //
+ // Example values of matchImages:
+ // - 123456789.dkr.ecr.us-east-1.amazonaws.com
+ // - *.azurecr.io
+ // - gcr.io
+ // - *.*.registry.io
+ // - registry.io:8080/path
+ //
+ // +kubebuilder:validation:MaxItems=50
+ // +kubebuilder:validation:MinItems=1
+ // +listType=set
+ // +optional
+ MatchImages []MatchImage `json:"matchImages,omitempty"`
+}
+
+// MatchImage is a string pattern used to match container image registry addresses.
+// It must be a valid fully qualified domain name with optional wildcard, port, and path.
+// The maximum length is 512 characters.
+//
+// Wildcards ('*') are supported for full subdomain labels and top-level domains.
+// Each entry can optionally contain a port (e.g., :8080) and a path (e.g., /path).
+// Wildcards are not allowed in the port or path portions.
+//
+// Examples:
+// - "registry.io" - matches exactly registry.io
+// - "*.azurecr.io" - matches any single subdomain of azurecr.io
+// - "registry.io:8080/path" - matches with specific port and path prefix
+//
+// +kubebuilder:validation:MaxLength=512
+// +kubebuilder:validation:MinLength=1
+// +kubebuilder:validation:XValidation:rule="self != '*'",message="global wildcard '*' is not allowed"
+// +kubebuilder:validation:XValidation:rule=`self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$')`,message="invalid matchImages value, must be a valid fully qualified domain name in lowercase with optional wildcard, port, and path"
+type MatchImage string
+
+// +k8s:deepcopy-gen=true
+// CRIOCredentialProviderConfigStatus defines the observed state of CRIOCredentialProviderConfig
+// +kubebuilder:validation:MinProperties=1
+type CRIOCredentialProviderConfigStatus struct {
+ // conditions represent the latest available observations of the configuration state.
+ // When omitted, it indicates that no conditions have been reported yet.
+ // The maximum number of conditions is 16.
+ // Conditions are stored as a map keyed by condition type, ensuring uniqueness.
+ //
+ // Expected condition types include:
+ // "Validated": indicates whether the matchImages configuration is valid
+ // +optional
+ // +kubebuilder:validation:MaxItems=16
+ // +kubebuilder:validation:MinItems=1
+ // +listType=map
+ // +listMapKey=type
+ Conditions []metav1.Condition `json:"conditions,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// CRIOCredentialProviderConfigList contains a list of CRIOCredentialProviderConfig resources
+//
+// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+// +openshift:compatibility-gen:level=1
+type CRIOCredentialProviderConfigList struct {
+ metav1.TypeMeta `json:",inline"`
+
+ // metadata is the standard list's metadata.
+ // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+ metav1.ListMeta `json:"metadata"`
+
+ Items []CRIOCredentialProviderConfig `json:"items"`
+}
+
+const (
+ // ConditionTypeValidated is a condition type that indicates whether the CRIOCredentialProviderConfig
+ // matchImages configuration has been validated successfully.
+ // When True, all matchImage patterns are valid and have been applied.
+ // When False, the configuration contains errors (see Reason for details).
+ // Possible reasons for False status:
+ // - ValidationFailed: matchImages contains invalid patterns
+ // - ConfigurationPartiallyApplied: some matchImage entries were ignored due to conflicts
+ ConditionTypeValidated = "Validated"
+
+ // ReasonValidationFailed is a condition reason used with ConditionTypeValidated=False
+ // to indicate that the matchImages configuration contains one or more invalid registry patterns
+ // that do not conform to the required format (valid FQDN with optional wildcard, port, and path).
+ ReasonValidationFailed = "ValidationFailed"
+
+ // ReasonConfigurationPartiallyApplied is a condition reason used with ConditionTypeValidated=False
+ // to indicate that some matchImage entries were ignored due to conflicts or overlapping patterns.
+ // The condition message will contain details about which entries were ignored and why.
+ ReasonConfigurationPartiallyApplied = "ConfigurationPartiallyApplied"
+
+ // ConditionTypeMachineConfigRendered is a condition type that indicates whether
+ // the CRIOCredentialProviderConfig has been successfully rendered into a
+ // MachineConfig object.
+ // When True, the corresponding MachineConfig is present in the cluster.
+ // When False, rendering failed.
+ ConditionTypeMachineConfigRendered = "MachineConfigRendered"
+
+ // ReasonMachineConfigRenderingSucceeded is a condition reason used with ConditionTypeMachineConfigRendered=True
+ // to indicate that the MachineConfig was successfully created/updated in the API server.
+ ReasonMachineConfigRenderingSucceeded = "MachineConfigRenderingSucceeded"
+
+ // ReasonMachineConfigRenderingFailed is a condition reason used with ConditionTypeMachineConfigRendered=False
+ // to indicate that the MachineConfig creation/update failed.
+ // The condition message will contain details about the failure.
+ ReasonMachineConfigRenderingFailed = "MachineConfigRenderingFailed"
+)
diff --git a/vendor/github.com/openshift/api/config/v1/types_dns.go b/vendor/github.com/openshift/api/config/v1/types_dns.go
index 06eb75ccf..efbdc3ae5 100644
--- a/vendor/github.com/openshift/api/config/v1/types_dns.go
+++ b/vendor/github.com/openshift/api/config/v1/types_dns.go
@@ -134,7 +134,14 @@ type AWSDNSSpec struct {
// privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
// operations on the cluster's private hosted zone specified in the cluster DNS config.
// When left empty, no role should be assumed.
- // +kubebuilder:validation:Pattern:=`^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$`
+ //
+ // The ARN must follow the format: arn::iam:::role/, where:
+ // is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc),
+ // is a 12-digit numeric identifier for the AWS account,
+ // is the IAM role name.
+ //
+ // +openshift:validation:FeatureGateAwareXValidation:featureGate="",rule=`matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')`,message=`privateZoneIAMRole must be a valid AWS IAM role ARN in the format: arn::iam:::role/`
+ // +openshift:validation:FeatureGateAwareXValidation:featureGate=AWSEuropeanSovereignCloudInstall,rule=`matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')`,message=`privateZoneIAMRole must be a valid AWS IAM role ARN in the format: arn::iam:::role/`
// +optional
PrivateZoneIAMRole string `json:"privateZoneIAMRole"`
}
diff --git a/vendor/github.com/openshift/api/config/v1/types_image.go b/vendor/github.com/openshift/api/config/v1/types_image.go
index 82f46c8b6..96fa349a6 100644
--- a/vendor/github.com/openshift/api/config/v1/types_image.go
+++ b/vendor/github.com/openshift/api/config/v1/types_image.go
@@ -165,20 +165,50 @@ type RegistryLocation struct {
// +kubebuilder:validation:XValidation:rule="has(self.blockedRegistries) ? !has(self.allowedRegistries) : true",message="Only one of blockedRegistries or allowedRegistries may be set"
type RegistrySources struct {
// insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections.
+ // Each entry must be a valid registry scope in the format hostname[:port][/path],
+ // optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com").
+ // The hostname must consist of valid DNS labels separated by dots, where each label
+ // contains only alphanumeric characters and hyphens and does not start or end with a hyphen.
+ // Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."),
+ // and must be at most 256 characters in length. The list may contain at most 1024 entries.
// +optional
// +listType=atomic
+ // +kubebuilder:validation:MaxItems=1024
+ // +kubebuilder:validation:items:MinLength=1
+ // +kubebuilder:validation:items:MaxLength=256
+ // +kubebuilder:validation:items:XValidation:rule="self.matches('^\\\\*(?:\\\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$')",message="each registry must be a valid hostname[:port][/path] or wildcard *.hostname format without tags or digests"
InsecureRegistries []string `json:"insecureRegistries,omitempty"`
// blockedRegistries cannot be used for image pull and push actions. All other registries are permitted.
+ // Each entry must be a valid registry scope in the format hostname[:port][/path],
+ // optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com").
+ // The hostname must consist of valid DNS labels separated by dots, where each label
+ // contains only alphanumeric characters and hyphens and does not start or end with a hyphen.
+ // Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."),
+ // and must be at most 256 characters in length. The list may contain at most 1024 entries.
//
// Only one of BlockedRegistries or AllowedRegistries may be set.
// +optional
// +listType=atomic
+ // +kubebuilder:validation:MaxItems=1024
+ // +kubebuilder:validation:items:MinLength=1
+ // +kubebuilder:validation:items:MaxLength=256
+ // +kubebuilder:validation:items:XValidation:rule="self.matches('^\\\\*(?:\\\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$')",message="each registry must be a valid hostname[:port][/path] or wildcard *.hostname format without tags or digests"
BlockedRegistries []string `json:"blockedRegistries,omitempty"`
// allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied.
+ // Each entry must be a valid registry scope in the format hostname[:port][/path],
+ // optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com").
+ // The hostname must consist of valid DNS labels separated by dots, where each label
+ // contains only alphanumeric characters and hyphens and does not start or end with a hyphen.
+ // Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."),
+ // and must be at most 256 characters in length. The list may contain at most 1024 entries.
//
// Only one of BlockedRegistries or AllowedRegistries may be set.
// +optional
// +listType=atomic
+ // +kubebuilder:validation:MaxItems=1024
+ // +kubebuilder:validation:items:MinLength=1
+ // +kubebuilder:validation:items:MaxLength=256
+ // +kubebuilder:validation:items:XValidation:rule="self.matches('^\\\\*(?:\\\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$')",message="each registry must be a valid hostname[:port][/path] or wildcard *.hostname format without tags or digests"
AllowedRegistries []string `json:"allowedRegistries,omitempty"`
// containerRuntimeSearchRegistries are registries that will be searched when pulling images that do not have fully qualified
// domains in their pull specs. Registries will be searched in the order provided in the list.
diff --git a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go
index 369ba1e7a..5d9f10374 100644
--- a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go
+++ b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go
@@ -19,6 +19,7 @@ import (
// +kubebuilder:resource:path=infrastructures,scope=Cluster
// +kubebuilder:subresource:status
// +kubebuilder:metadata:annotations=release.openshift.io/bootstrap-required=true
+// +openshift:validation:FeatureGateAwareXValidation:featureGate=MutableTopology,rule="!has(self.spec.controlPlaneTopology) || (has(oldSelf.spec.controlPlaneTopology) && self.spec.controlPlaneTopology == oldSelf.spec.controlPlaneTopology) || (has(self.status.controlPlaneTopology) && self.spec.controlPlaneTopology == self.status.controlPlaneTopology) || (has(self.status.controlPlaneTopology) && self.status.controlPlaneTopology == 'SingleReplica' && self.spec.controlPlaneTopology == 'HighlyAvailable')",message="spec.controlPlaneTopology must match status.controlPlaneTopology or be set to HighlyAvailable when status.controlPlaneTopology is SingleReplica"
type Infrastructure struct {
metav1.TypeMeta `json:",inline"`
@@ -55,6 +56,21 @@ type InfrastructureSpec struct {
// platformSpec holds desired information specific to the underlying
// infrastructure provider.
PlatformSpec PlatformSpec `json:"platformSpec,omitempty"`
+
+ // controlPlaneTopology expresses the desired topology configuration for control nodes.
+ //
+ // When status.controlPlaneTopology is 'SingleReplica' and spec.controlPlaneTopology is set to 'HighlyAvailable',
+ // a transition will be triggered to reconfigure the cluster from SingleReplica to HighlyAvailable.
+ //
+ // When left blank or status.controlPlaneTopology and spec.controlPlaneTopology are the same value,
+ // no changes are required and no transitions will be triggered.
+ //
+ // This value may be set to match status.controlPlaneTopology regardless of the current value.
+ //
+ // +openshift:enable:FeatureGate=MutableTopology
+ // +kubebuilder:validation:Enum=HighlyAvailable;SingleReplica
+ // +optional
+ ControlPlaneTopology TopologyMode `json:"controlPlaneTopology,omitempty"`
}
// InfrastructureStatus describes the infrastructure the cluster is leveraging.
@@ -102,11 +118,11 @@ type InfrastructureStatus struct {
// and the operators should not configure the operand for highly-available operation
// The 'External' mode indicates that the control plane is hosted externally to the cluster and that
// its components are not visible within the cluster.
+ // The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes
+ // that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.
// +kubebuilder:default=HighlyAvailable
- // +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=HighlyAvailable;SingleReplica;External
- // +openshift:validation:FeatureGateAwareEnum:featureGate=HighlyAvailableArbiter,enum=HighlyAvailable;HighlyAvailableArbiter;SingleReplica;External
- // +openshift:validation:FeatureGateAwareEnum:featureGate=DualReplica,enum=HighlyAvailable;SingleReplica;DualReplica;External
- // +openshift:validation:FeatureGateAwareEnum:requiredFeatureGate=HighlyAvailableArbiter;DualReplica,enum=HighlyAvailable;HighlyAvailableArbiter;SingleReplica;DualReplica;External
+ // +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=HighlyAvailable;HighlyAvailableArbiter;SingleReplica;External
+ // +openshift:validation:FeatureGateAwareEnum:featureGate=DualReplica,enum=HighlyAvailable;HighlyAvailableArbiter;SingleReplica;DualReplica;External
// +optional
ControlPlaneTopology TopologyMode `json:"controlPlaneTopology"`
@@ -295,7 +311,8 @@ type ExternalPlatformSpec struct {
// PlatformSpec holds the desired state specific to the underlying infrastructure provider
// of the current cluster. Since these are used at spec-level for the underlying cluster, it
// is supposed that only one of the spec structs is set.
-// +kubebuilder:validation:XValidation:rule="!has(oldSelf.vsphere) && has(self.vsphere) ? size(self.vsphere.vcenters) < 2 : true",message="vcenters can have at most 1 item when configured post-install"
+// +openshift:validation:FeatureGateAwareXValidation:featureGate="",rule="!has(oldSelf.vsphere) && has(self.vsphere) ? (has(self.vsphere.vcenters) && size(self.vsphere.vcenters) < 2) : true",message="vcenters can have at most 1 item when configured post-install"
+// +openshift:validation:FeatureGateAwareXValidation:featureGate=VSphereMultiVCenterDay2,rule="oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue() : true",message="vcenters is required once set and cannot be removed"
type PlatformSpec struct {
// type is the underlying infrastructure provider for the cluster. This
// value controls whether infrastructure automation such as service load
@@ -643,7 +660,6 @@ type AzurePlatformStatus struct {
//
// +default={"dnsType": "PlatformDefault"}
// +kubebuilder:default={"dnsType": "PlatformDefault"}
- // +openshift:enable:FeatureGate=AzureClusterHostedDNSInstall
// +optional
CloudLoadBalancerConfig *CloudLoadBalancerConfig `json:"cloudLoadBalancerConfig,omitempty"`
@@ -787,7 +803,6 @@ type GCPPlatformStatus struct {
//
// +default={"dnsType": "PlatformDefault"}
// +kubebuilder:default={"dnsType": "PlatformDefault"}
- // +openshift:enable:FeatureGate=GCPClusterHostedDNSInstall
// +optional
// +nullable
CloudLoadBalancerConfig *CloudLoadBalancerConfig `json:"cloudLoadBalancerConfig,omitempty"`
@@ -1642,21 +1657,24 @@ type VSpherePlatformNodeNetworking struct {
// use these fields for configuration.
// +kubebuilder:validation:XValidation:rule="!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)",message="apiServerInternalIPs list is required once set"
// +kubebuilder:validation:XValidation:rule="!has(oldSelf.ingressIPs) || has(self.ingressIPs)",message="ingressIPs list is required once set"
-// +kubebuilder:validation:XValidation:rule="!has(oldSelf.vcenters) && has(self.vcenters) ? size(self.vcenters) < 2 : true",message="vcenters can have at most 1 item when configured post-install"
type VSpherePlatformSpec struct {
// vcenters holds the connection details for services to communicate with vCenter.
- // Currently, only a single vCenter is supported, but in tech preview 3 vCenters are supported.
+ // Up to 3 vCenters are supported.
// Once the cluster has been installed, you are unable to change the current number of defined
- // vCenters except in the case where the cluster has been upgraded from a version of OpenShift
- // where the vsphere platform spec was not present. You may make modifications to the existing
+ // vCenters except when 1.) the cluster has been upgraded from a version of OpenShift
+ // where the vsphere platform spec was not present or 2.) in TechPreview you are able to add and
+ // remove vCenters but may not remove all vCenters. You may make modifications to the existing
// vCenters that are defined in the vcenters list in order to match with any added or modified
// failure domains.
// ---
// + If VCenters is not defined use the existing cloud-config configmap defined
// + in openshift-config.
- // +kubebuilder:validation:MinItems=0
+ // +kubebuilder:validation:MinItems=1
// +kubebuilder:validation:MaxItems=3
- // +kubebuilder:validation:XValidation:rule="size(self) != size(oldSelf) ? size(oldSelf) == 0 && size(self) < 2 : true",message="vcenters cannot be added or removed once set"
+ // +openshift:validation:FeatureGateAwareXValidation:featureGate="",rule="size(self) != size(oldSelf) ? size(oldSelf) == 0 && size(self) < 2 : true",message="vcenters cannot be added or removed once set"
+ // +openshift:validation:FeatureGateAwareXValidation:featureGate=VSphereMultiVCenterDay2,rule="size(self) >= size(oldSelf) ? oldSelf.all(x, self.exists(y, y.server == x.server)) : true",message="Cannot add and remove vCenters at the same time"
+ // +openshift:validation:FeatureGateAwareXValidation:featureGate=VSphereMultiVCenterDay2,rule="size(self) < size(oldSelf) ? self.all(x, oldSelf.exists(y, y.server == x.server)) : true",message="Cannot add and remove vCenters at the same time"
+ // +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, y.server == x.server))",message="vcenters must have unique server values"
// +listType=atomic
// +optional
VCenters []VSpherePlatformVCenterSpec `json:"vcenters,omitempty"`
diff --git a/vendor/github.com/openshift/api/config/v1/types_ingress.go b/vendor/github.com/openshift/api/config/v1/types_ingress.go
index 26e0ebf21..bb461e2f3 100644
--- a/vendor/github.com/openshift/api/config/v1/types_ingress.go
+++ b/vendor/github.com/openshift/api/config/v1/types_ingress.go
@@ -64,10 +64,12 @@ type IngressSpec struct {
// To determine the set of configurable Routes, look at namespace and name of entries in the
// .status.componentRoutes list, where participating operators write the status of
// configurable routes.
+ // A maximum of 250 component routes may be configured.
// +optional
// +listType=map
// +listMapKey=namespace
// +listMapKey=name
+ // +kubebuilder:validation:MaxItems=250
ComponentRoutes []ComponentRouteSpec `json:"componentRoutes,omitempty"`
// requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
@@ -164,6 +166,14 @@ const (
Classic AWSLBType = "Classic"
)
+// LabelValue is the value part of a Kubernetes label.
+// A label value must be either empty or 1-63 characters, consisting of
+// alphanumeric characters, '-', '_', or '.', starting and ending with
+// an alphanumeric character.
+// +kubebuilder:validation:MaxLength=63
+// +kubebuilder:validation:XValidation:rule="!format.labelValue().validate(self).hasValue()",message="label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric)"
+type LabelValue string
+
// ConsumingUser is an alias for string which we add validation to. Currently only service accounts are supported.
// +kubebuilder:validation:Pattern="^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
// +kubebuilder:validation:MinLength=1
@@ -245,6 +255,32 @@ type ComponentRouteSpec struct {
// the Secret specification for a serving certificate will not be needed.
// +optional
ServingCertKeyPairSecret SecretNameReference `json:"servingCertKeyPairSecret"`
+
+ // labels defines additional labels to be applied to the route created
+ // for the component. These labels are used by the IngressController to
+ // determine which routes it should manage. Changing labels may cause the
+ // route to be reassigned to a different IngressController.
+ // When omitted, no additional labels are applied to the component route.
+ // When specified, labels must contain at least one entry, up to a maximum of 8.
+ // Label keys must be valid qualified names, consisting of a name segment and
+ // an optional prefix separated by a slash (/). The name segment must be at most
+ // 63 characters in length and must consist only of alphanumeric characters,
+ // dashes (-), underscores (_), and dots (.), and must start and end with
+ // alphanumeric characters. The prefix, if specified, must be a DNS subdomain:
+ // at most 253 characters in length, consisting of dot-separated segments where
+ // each segment starts and ends with an alphanumeric character.
+ // Label values must be either empty or 1-63 characters, consisting of
+ // alphanumeric characters, dashes (-), underscores (_), or dots (.),
+ // starting and ending with an alphanumeric character.
+ // Keys with the "kubernetes.io/", "k8s.io/", and "openshift.io/" prefixes are reserved and may not be used.
+ // +openshift:enable:FeatureGate=IngressComponentRouteLabels
+ // +optional
+ // +mapType=granular
+ // +kubebuilder:validation:MinProperties=1
+ // +kubebuilder:validation:MaxProperties=8
+ // +kubebuilder:validation:XValidation:rule="self.all(key, !format.qualifiedName().validate(key).hasValue())",message="label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character"
+ // +kubebuilder:validation:XValidation:rule="self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') && !key.startsWith('openshift.io/'))",message="kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used"
+ Labels map[string]LabelValue `json:"labels,omitempty"`
}
// ComponentRouteStatus contains information allowing configuration of a route's hostname and serving certificate.
diff --git a/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go b/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go
index 3293204fa..6b58d9da4 100644
--- a/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go
+++ b/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go
@@ -1,55 +1,261 @@
package v1
-// KMSConfig defines the configuration for the KMS instance
-// that will be used with KMSEncryptionProvider encryption
-// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws config is required when kms provider type is AWS, and forbidden otherwise"
+// KMSPluginConfig defines the configuration for the KMS instance
+// that will be used with KMS encryption
+// +kubebuilder:validation:XValidation:rule="self.type == 'Vault' ? has(self.vault) : !has(self.vault)",message="vault config is required when kms provider type is Vault, and forbidden otherwise"
// +union
-type KMSConfig struct {
+type KMSPluginConfig struct {
// type defines the kind of platform for the KMS provider.
- // Available provider types are AWS only.
+ // Allowed values are Vault.
+ // When set to Vault, the plugin connects to a HashiCorp Vault server for key management.
//
// +unionDiscriminator
// +required
Type KMSProviderType `json:"type"`
- // aws defines the key config for using an AWS KMS instance
- // for the encryption. The AWS KMS instance is managed
+ // vault defines the configuration for the Vault KMS plugin.
+ // The plugin connects to a Vault Enterprise server that is managed
// by the user outside the purview of the control plane.
+ // This field must be set when type is Vault, and must be unset otherwise.
//
// +unionMember
// +optional
- AWS *AWSKMSConfig `json:"aws,omitempty"`
+ Vault VaultKMSPluginConfig `json:"vault,omitempty,omitzero"`
+
+ // --- TOMBSTONE ---
+ // aws was a field that allowed configuring AWS KMS.
+ // It was never implemented and has been removed.
+ // The field name is reserved to prevent reuse.
+ //
+ // +optional
+ // AWS *AWSKMSConfig `json:"aws,omitempty"`
}
-// AWSKMSConfig defines the KMS config specific to AWS KMS provider
-type AWSKMSConfig struct {
- // keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
- // The value must adhere to the format `arn:aws:kms:::key/`, where:
- // - `` is the AWS region consisting of lowercase letters and hyphens followed by a number.
- // - `` is a 12-digit numeric identifier for the AWS account.
- // - `` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
+// --- TOMBSTONE ---
+// AWSKMSConfig was a type for AWS KMS configuration that was never implemented.
+// The type name is reserved to prevent reuse.
+//
+// type AWSKMSConfig struct {
+// KeyARN string `json:"keyARN"`
+// Region string `json:"region"`
+// }
+
+// KMSProviderType is a specific supported KMS provider
+// +kubebuilder:validation:Enum=Vault
+type KMSProviderType string
+
+const (
+ // VaultKMSProvider represents a supported KMS provider for use with HashiCorp Vault
+ VaultKMSProvider KMSProviderType = "Vault"
+
+ // --- TOMBSTONE ---
+ // AWSKMSProvider was a constant for AWS KMS support that was never implemented.
+ // The constant name is reserved to prevent reuse.
+ //
+ // AWSKMSProvider KMSProviderType = "AWS"
+)
+
+// VaultSecretReference references a secret in the openshift-config namespace.
+type VaultSecretReference struct {
+ // name is the metadata.name of the referenced secret in the openshift-config namespace.
+ // The name must be a valid DNS subdomain name: it must contain no more than 253 characters,
+ // contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
//
- // +kubebuilder:validation:MaxLength=128
// +kubebuilder:validation:MinLength=1
- // +kubebuilder:validation:XValidation:rule="self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')",message="keyARN must follow the format `arn:aws:kms:::key/`. The account ID must be a 12 digit number and the region and key ID should consist only of lowercase hexadecimal characters and hyphens (-)."
+ // +kubebuilder:validation:MaxLength=253
+ // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +required
- KeyARN string `json:"keyARN"`
- // region specifies the AWS region where the KMS instance exists, and follows the format
- // `--`, e.g.: `us-east-1`.
- // Only lowercase letters and hyphens followed by numbers are allowed.
+ Name string `json:"name,omitempty"`
+}
+
+// VaultConfigMapReference references a ConfigMap in the openshift-config namespace.
+type VaultConfigMapReference struct {
+ // name is the metadata.name of the referenced ConfigMap in the openshift-config namespace.
+ // The name must be a valid DNS subdomain name: it must contain no more than 253 characters,
+ // contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
//
- // +kubebuilder:validation:MaxLength=64
// +kubebuilder:validation:MinLength=1
- // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]+(-[a-z0-9]+)*$')",message="region must be a valid AWS region, consisting of lowercase characters, digits and hyphens (-) only."
+ // +kubebuilder:validation:MaxLength=253
+ // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +required
- Region string `json:"region"`
+ Name string `json:"name,omitempty"`
}
-// KMSProviderType is a specific supported KMS provider
-// +kubebuilder:validation:Enum=AWS
-type KMSProviderType string
+// VaultAuthentication defines the authentication method used to authenticate with Vault.
+// +kubebuilder:validation:XValidation:rule="self.type == 'AppRole' ? has(self.appRole) : !has(self.appRole)",message="appRole config is required when authentication type is AppRole, and forbidden otherwise"
+// +union
+type VaultAuthentication struct {
+ // type defines the authentication method used to authenticate with Vault.
+ // Allowed values are AppRole.
+ // When set to AppRole, the plugin uses AppRole credentials to authenticate with Vault.
+ //
+ // +unionDiscriminator
+ // +required
+ Type VaultAuthenticationType `json:"type,omitempty"`
+
+ // appRole defines the configuration for AppRole authentication.
+ // This field must be set when type is AppRole, and must be unset otherwise.
+ //
+ // +unionMember
+ // +optional
+ AppRole VaultAppRoleAuthentication `json:"appRole,omitzero"`
+}
+
+// VaultAuthenticationType defines the authentication method type for Vault.
+// +kubebuilder:validation:Enum=AppRole
+type VaultAuthenticationType string
const (
- // AWSKMSProvider represents a supported KMS provider for use with AWS KMS
- AWSKMSProvider KMSProviderType = "AWS"
+ // VaultAuthenticationTypeAppRole represents AppRole authentication method.
+ VaultAuthenticationTypeAppRole VaultAuthenticationType = "AppRole"
)
+
+// VaultAppRoleAuthentication defines the configuration for AppRole authentication with Vault.
+type VaultAppRoleAuthentication struct {
+ // secret references a secret in the openshift-config namespace containing
+ // the AppRole credentials used to authenticate with Vault.
+ // The referenced Secret must contain two keys: "role-id" for the AppRole Role ID and "secret-id" for the AppRole Secret ID.
+ //
+ // +required
+ Secret VaultSecretReference `json:"secret,omitzero"`
+}
+
+// VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS
+type VaultKMSPluginConfig struct {
+ // kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.
+ //
+ // The image must be a fully qualified OCI image pull spec with a SHA256 digest.
+ // The format is: host[:port][/namespace]/name@sha256:
+ // where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9.
+ // The total length must be between 75 and 447 characters.
+ //
+ // Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed.
+ // The registry hostname must be included and must contain at least one dot.
+ // Image tags (e.g., ":latest", ":v1.0.0") are not allowed.
+ //
+ // Consult the OpenShift documentation for compatible plugin versions with your cluster version,
+ // then obtain the image digest for that version from HashiCorp's container registry.
+ //
+ // For disconnected environments, mirror the plugin image to an accessible registry
+ // and reference the mirrored location with its digest.
+ //
+ // +kubebuilder:validation:MinLength=75
+ // +kubebuilder:validation:MaxLength=447
+ // +kubebuilder:validation:XValidation:rule=`(self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$'))`,message="the OCI Image reference must end with a valid '@sha256:' suffix, where '' is 64 characters long"
+ // +kubebuilder:validation:XValidation:rule=`(self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$'))`,message="the OCI Image name should follow the host[:port][/namespace]/name format, resembling a valid URL without the scheme. Short names are not allowed, the registry hostname must be included."
+ // +required
+ KMSPluginImage string `json:"kmsPluginImage,omitempty"`
+
+ // vaultAddress specifies the address of the HashiCorp Vault instance.
+ // The value must be a valid HTTPS URL containing only scheme, host, and optional port.
+ // Paths, user info, query parameters, and fragments are not allowed.
+ //
+ // Format: https://hostname[:port]
+ // Example: https://vault.example.com:8200
+ //
+ // The value must be between 1 and 512 characters.
+ //
+ // +kubebuilder:validation:XValidation:rule="isURL(self)",message="must be a valid URL"
+ // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getScheme() == 'https'",message="must use the 'https' scheme"
+ // +kubebuilder:validation:XValidation:rule="isURL(self) && (url(self).getEscapedPath() == '' || url(self).getEscapedPath() == '/')",message="must not contain a path"
+ // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getQuery() == {}",message="must not have a query"
+ // +kubebuilder:validation:XValidation:rule="self.find('#(.+)$') == ''",message="must not have a fragment"
+ // +kubebuilder:validation:XValidation:rule="self.find('@') == ''",message="must not have user info"
+ // +kubebuilder:validation:MaxLength=512
+ // +kubebuilder:validation:MinLength=1
+ // +required
+ VaultAddress string `json:"vaultAddress,omitempty"`
+
+ // vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted.
+ // This is only applicable for Vault Enterprise installations.
+ // When this field is not set, no namespace is used.
+ //
+ // The value must be between 1 and 4096 characters.
+ // The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.
+ //
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=4096
+ // +kubebuilder:validation:XValidation:rule="!self.endsWith('/')",message="vaultNamespace cannot end with a forward slash"
+ // +kubebuilder:validation:XValidation:rule="!self.contains(' ')",message="vaultNamespace cannot contain spaces"
+ // +kubebuilder:validation:XValidation:rule="!(self in ['root', 'sys', 'audit', 'auth', 'cubbyhole', 'identity'])",message="vaultNamespace cannot be a reserved string (root, sys, audit, auth, cubbyhole, identity)"
+ // +optional
+ VaultNamespace string `json:"vaultNamespace,omitempty"`
+
+ // tls contains the TLS configuration for connecting to the Vault server.
+ // When this field is not set, system default TLS settings are used.
+ // +optional
+ TLS VaultTLSConfig `json:"tls,omitzero"`
+
+ // authentication defines the authentication method used to authenticate with Vault.
+ //
+ // +required
+ Authentication VaultAuthentication `json:"authentication,omitzero"`
+
+ // transitMount specifies the mount path of the Vault Transit engine.
+ //
+ // The transit mount must be between 1 and 1024 characters, cannot start or
+ // end with a forward slash, cannot contain consecutive forward slashes, and
+ // must only contain RFC 3986 unreserved characters (alphanumeric, hyphen,
+ // period, underscore, tilde) and forward slashes as path separators.
+ //
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=1024
+ // +kubebuilder:validation:XValidation:rule="!self.startsWith('/')",message="transitMount cannot start with a forward slash"
+ // +kubebuilder:validation:XValidation:rule="!self.endsWith('/')",message="transitMount cannot end with a forward slash"
+ // +kubebuilder:validation:XValidation:rule="!self.contains('//')",message="transitMount cannot contain consecutive forward slashes"
+ // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._~/-]+$')",message="transitMount must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) and forward slashes"
+ // +required
+ TransitMount string `json:"transitMount,omitempty"`
+
+ // transitKey specifies the name of the encryption key in Vault's Transit engine.
+ // This key is used to encrypt and decrypt data.
+ //
+ // The transit key must be between 1 and 512 characters, cannot contain forward slashes,
+ // and must only contain alphanumeric characters, hyphens, periods, and underscores.
+ //
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:MaxLength=512
+ // +kubebuilder:validation:XValidation:rule="!self.contains('/')",message="transitKey cannot contain forward slashes"
+ // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._-]+$')",message="transitKey must only contain alphanumeric characters, hyphens, periods, and underscores"
+ // +required
+ TransitKey string `json:"transitKey,omitempty"`
+}
+
+// VaultTLSConfig contains TLS configuration for connecting to Vault.
+// +kubebuilder:validation:MinProperties=1
+type VaultTLSConfig struct {
+ // caBundle references a ConfigMap in the openshift-config namespace containing
+ // the CA certificate bundle used to verify the TLS connection to the Vault server.
+ // The referenced ConfigMap must contain the CA bundle in the key "ca-bundle.crt".
+ // When this field is not set, the system's trusted CA certificates are used.
+ //
+ // The namespace for the ConfigMap is openshift-config.
+ //
+ // Example ConfigMap:
+ // apiVersion: v1
+ // kind: ConfigMap
+ // metadata:
+ // name: vault-ca-bundle
+ // namespace: openshift-config
+ // data:
+ // ca-bundle.crt: |
+ // -----BEGIN CERTIFICATE-----
+ // ...
+ // -----END CERTIFICATE-----
+ //
+ // +optional
+ CABundle VaultConfigMapReference `json:"caBundle,omitzero"`
+
+ // serverName specifies the Server Name Indication (SNI) to use when connecting to Vault via TLS.
+ // This is useful when the Vault server's hostname doesn't match its TLS certificate.
+ // When this field is not set, the hostname from vaultAddress is used for SNI.
+ //
+ // The value must be a valid DNS hostname: it must contain no more than 253 characters,
+ // contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
+ //
+ // +kubebuilder:validation:MaxLength=253
+ // +kubebuilder:validation:MinLength=1
+ // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
+ // +optional
+ ServerName string `json:"serverName,omitempty"`
+}
diff --git a/vendor/github.com/openshift/api/config/v1/types_network.go b/vendor/github.com/openshift/api/config/v1/types_network.go
index fb8ed2fff..80b022de9 100644
--- a/vendor/github.com/openshift/api/config/v1/types_network.go
+++ b/vendor/github.com/openshift/api/config/v1/types_network.go
@@ -86,6 +86,13 @@ type NetworkSpec struct {
//
// +optional
NetworkDiagnostics NetworkDiagnostics `json:"networkDiagnostics"`
+
+ // networkObservability is an optional field that configures network observability installation
+ // during cluster deployment (day-0).
+ // When omitted, unless this is a SNO cluster, network observability will be installed if not already present, after that, no action taken.
+ // +openshift:enable:FeatureGate=NetworkObservabilityInstall
+ // +optional
+ NetworkObservability NetworkObservabilitySpec `json:"networkObservability,omitempty,omitzero"`
}
// NetworkStatus is the current network configuration.
@@ -304,3 +311,29 @@ type NetworkDiagnosticsTargetPlacement struct {
// +listType=atomic
Tolerations []corev1.Toleration `json:"tolerations"`
}
+
+// NetworkObservabilityInstallationPolicy is an enumeration of the available network observability installation policies
+// Valid values are "InstallAndEnable", "NoAction".
+// +kubebuilder:validation:Enum=InstallAndEnable;NoAction
+type NetworkObservabilityInstallationPolicy string
+
+const (
+ // NetworkObservabilityInstallAndEnable means that network observability should be installed and enabled during cluster deployment
+ // Since this was explicitly set to install, if the user remove NetworkObservability, it will be installed again unless the value of InstallationPolicy is changed
+ NetworkObservabilityInstallAndEnable NetworkObservabilityInstallationPolicy = "InstallAndEnable"
+ // NetworkObservabilityNoAction means that nothing will be done regarding Network Observability
+ NetworkObservabilityNoAction NetworkObservabilityInstallationPolicy = "NoAction"
+)
+
+// NetworkObservabilitySpec defines the configuration for network observability installation
+type NetworkObservabilitySpec struct {
+ // installationPolicy controls whether network observability is installed during cluster deployment.
+ // Valid values are "InstallAndEnable" and "NoAction".
+ // When set to "InstallAndEnable", ensure that network observability will be installed and enabled on the cluster. If already installed, no action taken, but if it gets uninstalled, it will install it again.
+ // When set to "NoAction", nothing will be done regarding Network observability.
+ // During the installation of NetworkObservability, the platform checks for any existing manual installations.
+ // If a successful installation using the OLMv0 or OLMv1 API is detected, it will be used.
+ // If the platform cannot determine how the current version was installed, or if the existing installation is incomplete, the installation process will stop.
+ // +required
+ InstallationPolicy NetworkObservabilityInstallationPolicy `json:"installationPolicy,omitempty"`
+}
diff --git a/vendor/github.com/openshift/api/config/v1/types_tlssecurityprofile.go b/vendor/github.com/openshift/api/config/v1/types_tlssecurityprofile.go
index 48657b089..2e9be97ae 100644
--- a/vendor/github.com/openshift/api/config/v1/types_tlssecurityprofile.go
+++ b/vendor/github.com/openshift/api/config/v1/types_tlssecurityprofile.go
@@ -7,10 +7,16 @@ type TLSSecurityProfile struct {
// type is one of Old, Intermediate, Modern or Custom. Custom provides the
// ability to specify individual TLS security profile parameters.
//
- // The profiles are based on version 5.7 of the Mozilla Server Side TLS
- // configuration guidelines. The cipher lists consist of the configuration's
- // "ciphersuites" followed by the Go-specific "ciphers" from the guidelines.
- // See: https://ssl-config.mozilla.org/guidelines/5.7.json
+ // The cipher and groups lists in these profiles are based on version 5.8 of the
+ // Mozilla Server Side TLS configuration guidelines.
+ // See: https://ssl-config.mozilla.org/guidelines/5.8.json
+ //
+ // The groups are listed in suggested preference order, with the most preferred group first.
+ // Note that not all platform components honor the ordering: Go-based components use Go's
+ // internal preference order and treat this list as a filter of allowed groups rather than
+ // an ordered preference.
+ // Note that X25519MLKEM768 is a post-quantum hybrid group that is not
+ // FIPS-approved and should be ignored by components running in FIPS mode.
//
// The profiles are intent based, so they may change over time as new ciphers are
// developed and existing ciphers are found to be insecure. Depending on
@@ -23,6 +29,10 @@ type TLSSecurityProfile struct {
// old is a TLS profile for use when services need to be accessed by very old
// clients or libraries and should be used only as a last resort.
//
+ // The supported groups list includes by default the following groups
+ // in suggested preference order (ordering may not be honored by all implementations):
+ // X25519MLKEM768, X25519, secp256r1, secp384r1.
+ //
// This profile is equivalent to a Custom profile specified as:
// minTLSVersion: VersionTLS10
// ciphers:
@@ -39,11 +49,14 @@ type TLSSecurityProfile struct {
// - ECDHE-RSA-AES128-SHA256
// - ECDHE-ECDSA-AES128-SHA
// - ECDHE-RSA-AES128-SHA
+ // - ECDHE-ECDSA-AES256-SHA384
+ // - ECDHE-RSA-AES256-SHA384
// - ECDHE-ECDSA-AES256-SHA
// - ECDHE-RSA-AES256-SHA
// - AES128-GCM-SHA256
// - AES256-GCM-SHA384
// - AES128-SHA256
+ // - AES256-SHA256
// - AES128-SHA
// - AES256-SHA
// - DES-CBC3-SHA
@@ -56,6 +69,10 @@ type TLSSecurityProfile struct {
// legacy clients and want to remain highly secure while being compatible with
// most clients currently in use.
//
+ // The supported groups list includes by default the following groups
+ // in suggested preference order (ordering may not be honored by all implementations):
+ // X25519MLKEM768, X25519, secp256r1, secp384r1.
+ //
// This profile is equivalent to a Custom profile specified as:
// minTLSVersion: VersionTLS12
// ciphers:
@@ -75,7 +92,9 @@ type TLSSecurityProfile struct {
// modern is a TLS security profile for use with clients that support TLS 1.3 and
// do not need backward compatibility for older clients.
- //
+ // The supported groups list includes by default the following groups
+ // in suggested preference order (ordering may not be honored by all implementations):
+ // X25519MLKEM768, X25519, secp256r1, secp384r1.
// This profile is equivalent to a Custom profile specified as:
// minTLSVersion: VersionTLS13
// ciphers:
@@ -88,8 +107,11 @@ type TLSSecurityProfile struct {
Modern *ModernTLSProfile `json:"modern,omitempty"`
// custom is a user-defined TLS security profile. Be extremely careful using a custom
- // profile as invalid configurations can be catastrophic. An example custom profile
- // looks like this:
+ // profile as invalid configurations can be catastrophic.
+ //
+ // The supported groups list for this profile is empty by default.
+ //
+ // An example custom profile looks like this:
//
// minTLSVersion: VersionTLS11
// ciphers:
@@ -142,6 +164,33 @@ const (
TLSProfileCustomType TLSProfileType = "Custom"
)
+// TLSGroup is a supported group identifier that can be used in TLSProfile.Groups.
+// There is a one-to-one mapping between these names and the group IDs defined
+// in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry:
+// https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
+// Note that X25519MLKEM768 is a post-quantum hybrid group that is not
+// FIPS-approved and should be ignored by components running in FIPS mode.
+//
+// +kubebuilder:validation:Enum=X25519;secp256r1;secp384r1;secp521r1;X25519MLKEM768;SecP256r1MLKEM768;SecP384r1MLKEM1024
+type TLSGroup string
+
+const (
+ // TLSGroupX25519 represents X25519.
+ TLSGroupX25519 TLSGroup = "X25519"
+ // TLSGroupSecP256r1 represents P-256 (secp256r1).
+ TLSGroupSecP256r1 TLSGroup = "secp256r1"
+ // TLSGroupSecP384r1 represents P-384 (secp384r1).
+ TLSGroupSecP384r1 TLSGroup = "secp384r1"
+ // TLSGroupSecP521r1 represents P-521 (secp521r1).
+ TLSGroupSecP521r1 TLSGroup = "secp521r1"
+ // TLSGroupX25519MLKEM768 represents X25519MLKEM768.
+ TLSGroupX25519MLKEM768 TLSGroup = "X25519MLKEM768"
+ // TLSGroupSecP256r1MLKEM768 represents SecP256r1MLKEM768.
+ TLSGroupSecP256r1MLKEM768 TLSGroup = "SecP256r1MLKEM768"
+ // TLSGroupSecP384r1MLKEM1024 represents SecP384r1MLKEM1024.
+ TLSGroupSecP384r1MLKEM1024 TLSGroup = "SecP384r1MLKEM1024"
+)
+
// TLSProfileSpec is the desired behavior of a TLSSecurityProfile.
type TLSProfileSpec struct {
// ciphers is used to specify the cipher algorithms that are negotiated
@@ -155,6 +204,30 @@ type TLSProfileSpec struct {
// and are always enabled when TLS 1.3 is negotiated.
// +listType=atomic
Ciphers []string `json:"ciphers"`
+ // groups is an optional, ordered field used to specify the supported groups (formerly known as
+ // elliptic curves) that are used during the TLS handshake. The order of the groups represents
+ // a suggested preference, with the most preferred group first. Note that not all platform
+ // components honor the ordering: Go-based components use Go's internal preference order and
+ // treat this list as a filter of allowed groups rather than an ordered preference.
+ // Operators may remove entries their operands do not support.
+ //
+ // When omitted, this means no opinion and the platform is left to choose reasonable defaults which are
+ // subject to change over time and may be different per platform component depending on the underlying TLS
+ // libraries they use. If specified, the list must contain at least one and at most 7 groups,
+ // and each group must be unique.
+ //
+ // For example, to use X25519 and secp256r1 (yaml):
+ //
+ // groups:
+ // - X25519
+ // - secp256r1
+ //
+ // +optional
+ // +listType=set
+ // +kubebuilder:validation:MaxItems=7
+ // +kubebuilder:validation:MinItems=1
+ // +openshift:enable:FeatureGate=TLSGroupPreferences
+ Groups []TLSGroup `json:"groups,omitempty"`
// minTLSVersion is used to specify the minimal version of the TLS protocol
// that is negotiated during the TLS handshake. For example, to use TLS
// versions 1.1, 1.2 and 1.3 (yaml):
@@ -187,16 +260,22 @@ const (
// TLSProfiles contains a map of TLSProfileType names to TLSProfileSpec.
//
-// These profiles are based on version 5.7 of the Mozilla Server Side TLS
-// configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.7.json
+// The cipher and groups lists in these profiles are based on version 5.8 of the
+// Mozilla Server Side TLS configuration guidelines.
+// See: https://ssl-config.mozilla.org/guidelines/5.8.json
//
// Each Ciphers slice is the configuration's "ciphersuites" followed by the
-// Go-specific "ciphers" from the guidelines JSON.
+// "ciphers" from the guidelines JSON.
+//
+// Groups are listed in suggested preference order, though Go-based components may use
+// their own internal ordering. TLSProfiles Old, Intermediate, Modern include by default
+// the following groups: X25519MLKEM768, X25519, secp256r1, secp384r1
//
// NOTE: The caller needs to make sure to check that these constants are valid
// for their binary. Not all entries map to values for all binaries. In the case
// of ties, the kube-apiserver wins. Do not fail, just be sure to include only
-// valid entries and everything will be ok.
+// valid entries and everything will be ok. In particular, X25519MLKEM768 is
+// not FIPS-approved and must be omitted by components running in FIPS mode.
var TLSProfiles = map[TLSProfileType]*TLSProfileSpec{
TLSProfileOldType: {
Ciphers: []string{
@@ -213,15 +292,24 @@ var TLSProfiles = map[TLSProfileType]*TLSProfileSpec{
"ECDHE-RSA-AES128-SHA256",
"ECDHE-ECDSA-AES128-SHA",
"ECDHE-RSA-AES128-SHA",
+ "ECDHE-ECDSA-AES256-SHA384",
+ "ECDHE-RSA-AES256-SHA384",
"ECDHE-ECDSA-AES256-SHA",
"ECDHE-RSA-AES256-SHA",
"AES128-GCM-SHA256",
"AES256-GCM-SHA384",
"AES128-SHA256",
+ "AES256-SHA256",
"AES128-SHA",
"AES256-SHA",
"DES-CBC3-SHA",
},
+ Groups: []TLSGroup{
+ TLSGroupX25519MLKEM768,
+ TLSGroupX25519,
+ TLSGroupSecP256r1,
+ TLSGroupSecP384r1,
+ },
MinTLSVersion: VersionTLS10,
},
TLSProfileIntermediateType: {
@@ -236,6 +324,12 @@ var TLSProfiles = map[TLSProfileType]*TLSProfileSpec{
"ECDHE-ECDSA-CHACHA20-POLY1305",
"ECDHE-RSA-CHACHA20-POLY1305",
},
+ Groups: []TLSGroup{
+ TLSGroupX25519MLKEM768,
+ TLSGroupX25519,
+ TLSGroupSecP256r1,
+ TLSGroupSecP384r1,
+ },
MinTLSVersion: VersionTLS12,
},
TLSProfileModernType: {
@@ -244,6 +338,12 @@ var TLSProfiles = map[TLSProfileType]*TLSProfileSpec{
"TLS_AES_256_GCM_SHA384",
"TLS_CHACHA20_POLY1305_SHA256",
},
+ Groups: []TLSGroup{
+ TLSGroupX25519MLKEM768,
+ TLSGroupX25519,
+ TLSGroupSecP256r1,
+ TLSGroupSecP384r1,
+ },
MinTLSVersion: VersionTLS13,
},
}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-CustomNoUpgrade.crd.yaml
index c89d45ddc..1702e755a 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-CustomNoUpgrade.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-CustomNoUpgrade.crd.yaml
@@ -95,6 +95,8 @@ spec:
- Ingress
- CloudControllerManager
- OperatorLifecycleManagerV1
+ - CompatibilityRequirements
+ - ClusterAPI
type: string
type: array
x-kubernetes-list-type: atomic
@@ -218,6 +220,23 @@ spec:
When image is set, architecture cannot be specified.
If both version and image are set, the version extracted from the referenced image must match the specified version.
type: string
+ mode:
+ description: |-
+ mode determines how an update should be processed.
+ The only valid value is "Preflight".
+ When omitted, the cluster performs a normal update by applying the specified version or image to the cluster.
+ This is the standard update behavior.
+ When set to "Preflight", the cluster runs compatibility checks against the target release without
+ performing an actual update. Compatibility results, including any detected risks, are reported
+ in status.conditionalUpdates and status.conditionalUpdateRisks alongside risks from the update
+ recommendation service.
+ This allows administrators to assess update readiness and address issues before committing to the update.
+ Preflight mode is particularly useful for skip-level updates where upgrade compatibility needs to be
+ verified across multiple minor versions.
+ When mode is set to "Preflight", the same rules for version, image, and architecture apply as for normal updates.
+ enum:
+ - Preflight
+ type: string
version:
description: |-
version is a semantic version identifying the update version.
@@ -425,6 +444,8 @@ spec:
- Ingress
- CloudControllerManager
- OperatorLifecycleManagerV1
+ - CompatibilityRequirements
+ - ClusterAPI
type: string
type: array
x-kubernetes-list-type: atomic
@@ -452,6 +473,8 @@ spec:
- Ingress
- CloudControllerManager
- OperatorLifecycleManagerV1
+ - CompatibilityRequirements
+ - ClusterAPI
type: string
type: array
x-kubernetes-list-type: atomic
@@ -1116,6 +1139,15 @@ spec:
&& has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities)
&& ''OperatorLifecycleManager'' in self.status.capabilities.enabledCapabilities)
: true'
+ - message: the `ClusterAPI` capability requires the `CompatibilityRequirements`
+ capability, which is neither explicitly or implicitly enabled in this
+ cluster, please enable the `CompatibilityRequirements` capability
+ rule: 'has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities)
+ && ''ClusterAPI'' in self.spec.capabilities.additionalEnabledCapabilities
+ ? ''CompatibilityRequirements'' in self.spec.capabilities.additionalEnabledCapabilities
+ || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities)
+ && ''CompatibilityRequirements'' in self.status.capabilities.enabledCapabilities)
+ : true'
served: true
storage: true
subresources:
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-DevPreviewNoUpgrade.crd.yaml
index f24b2a16a..ac031e99a 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-DevPreviewNoUpgrade.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-DevPreviewNoUpgrade.crd.yaml
@@ -95,6 +95,8 @@ spec:
- Ingress
- CloudControllerManager
- OperatorLifecycleManagerV1
+ - CompatibilityRequirements
+ - ClusterAPI
type: string
type: array
x-kubernetes-list-type: atomic
@@ -218,6 +220,23 @@ spec:
When image is set, architecture cannot be specified.
If both version and image are set, the version extracted from the referenced image must match the specified version.
type: string
+ mode:
+ description: |-
+ mode determines how an update should be processed.
+ The only valid value is "Preflight".
+ When omitted, the cluster performs a normal update by applying the specified version or image to the cluster.
+ This is the standard update behavior.
+ When set to "Preflight", the cluster runs compatibility checks against the target release without
+ performing an actual update. Compatibility results, including any detected risks, are reported
+ in status.conditionalUpdates and status.conditionalUpdateRisks alongside risks from the update
+ recommendation service.
+ This allows administrators to assess update readiness and address issues before committing to the update.
+ Preflight mode is particularly useful for skip-level updates where upgrade compatibility needs to be
+ verified across multiple minor versions.
+ When mode is set to "Preflight", the same rules for version, image, and architecture apply as for normal updates.
+ enum:
+ - Preflight
+ type: string
version:
description: |-
version is a semantic version identifying the update version.
@@ -425,6 +444,8 @@ spec:
- Ingress
- CloudControllerManager
- OperatorLifecycleManagerV1
+ - CompatibilityRequirements
+ - ClusterAPI
type: string
type: array
x-kubernetes-list-type: atomic
@@ -452,6 +473,8 @@ spec:
- Ingress
- CloudControllerManager
- OperatorLifecycleManagerV1
+ - CompatibilityRequirements
+ - ClusterAPI
type: string
type: array
x-kubernetes-list-type: atomic
@@ -1116,6 +1139,15 @@ spec:
&& has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities)
&& ''OperatorLifecycleManager'' in self.status.capabilities.enabledCapabilities)
: true'
+ - message: the `ClusterAPI` capability requires the `CompatibilityRequirements`
+ capability, which is neither explicitly or implicitly enabled in this
+ cluster, please enable the `CompatibilityRequirements` capability
+ rule: 'has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities)
+ && ''ClusterAPI'' in self.spec.capabilities.additionalEnabledCapabilities
+ ? ''CompatibilityRequirements'' in self.spec.capabilities.additionalEnabledCapabilities
+ || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities)
+ && ''CompatibilityRequirements'' in self.status.capabilities.enabledCapabilities)
+ : true'
served: true
storage: true
subresources:
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-TechPreviewNoUpgrade.crd.yaml
index ea97687cf..27985043e 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-TechPreviewNoUpgrade.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-TechPreviewNoUpgrade.crd.yaml
@@ -95,6 +95,8 @@ spec:
- Ingress
- CloudControllerManager
- OperatorLifecycleManagerV1
+ - CompatibilityRequirements
+ - ClusterAPI
type: string
type: array
x-kubernetes-list-type: atomic
@@ -425,6 +427,8 @@ spec:
- Ingress
- CloudControllerManager
- OperatorLifecycleManagerV1
+ - CompatibilityRequirements
+ - ClusterAPI
type: string
type: array
x-kubernetes-list-type: atomic
@@ -452,6 +456,8 @@ spec:
- Ingress
- CloudControllerManager
- OperatorLifecycleManagerV1
+ - CompatibilityRequirements
+ - ClusterAPI
type: string
type: array
x-kubernetes-list-type: atomic
@@ -1116,6 +1122,15 @@ spec:
&& has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities)
&& ''OperatorLifecycleManager'' in self.status.capabilities.enabledCapabilities)
: true'
+ - message: the `ClusterAPI` capability requires the `CompatibilityRequirements`
+ capability, which is neither explicitly or implicitly enabled in this
+ cluster, please enable the `CompatibilityRequirements` capability
+ rule: 'has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities)
+ && ''ClusterAPI'' in self.spec.capabilities.additionalEnabledCapabilities
+ ? ''CompatibilityRequirements'' in self.spec.capabilities.additionalEnabledCapabilities
+ || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities)
+ && ''CompatibilityRequirements'' in self.status.capabilities.enabledCapabilities)
+ : true'
served: true
storage: true
subresources:
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml
index 2e45da09e..b18ea7464 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml
@@ -168,59 +168,267 @@ spec:
managing the lifecyle of the encryption keys outside of the control plane.
This allows integration with an external provider to manage the data encryption keys securely.
properties:
- aws:
+ type:
+ description: |-
+ type defines the kind of platform for the KMS provider.
+ Allowed values are Vault.
+ When set to Vault, the plugin connects to a HashiCorp Vault server for key management.
+ enum:
+ - Vault
+ type: string
+ vault:
description: |-
- aws defines the key config for using an AWS KMS instance
- for the encryption. The AWS KMS instance is managed
+ vault defines the configuration for the Vault KMS plugin.
+ The plugin connects to a Vault Enterprise server that is managed
by the user outside the purview of the control plane.
+ This field must be set when type is Vault, and must be unset otherwise.
properties:
- keyARN:
+ authentication:
+ description: authentication defines the authentication
+ method used to authenticate with Vault.
+ properties:
+ appRole:
+ description: |-
+ appRole defines the configuration for AppRole authentication.
+ This field must be set when type is AppRole, and must be unset otherwise.
+ properties:
+ secret:
+ description: |-
+ secret references a secret in the openshift-config namespace containing
+ the AppRole credentials used to authenticate with Vault.
+ The referenced Secret must contain two keys: "role-id" for the AppRole Role ID and "secret-id" for the AppRole Secret ID.
+ properties:
+ name:
+ description: |-
+ name is the metadata.name of the referenced secret in the openshift-config namespace.
+ The name must be a valid DNS subdomain name: it must contain no more than 253 characters,
+ contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: 'name must be a valid DNS subdomain
+ name: contain no more than 253 characters,
+ contain only lowercase alphanumeric characters,
+ ''-'' or ''.'', and start and end with
+ an alphanumeric character'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ required:
+ - secret
+ type: object
+ type:
+ description: |-
+ type defines the authentication method used to authenticate with Vault.
+ Allowed values are AppRole.
+ When set to AppRole, the plugin uses AppRole credentials to authenticate with Vault.
+ enum:
+ - AppRole
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: appRole config is required when authentication
+ type is AppRole, and forbidden otherwise
+ rule: 'self.type == ''AppRole'' ? has(self.appRole)
+ : !has(self.appRole)'
+ kmsPluginImage:
description: |-
- keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
- The value must adhere to the format `arn:aws:kms:::key/`, where:
- - `` is the AWS region consisting of lowercase letters and hyphens followed by a number.
- - `` is a 12-digit numeric identifier for the AWS account.
- - `` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
- maxLength: 128
+ kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.
+
+ The image must be a fully qualified OCI image pull spec with a SHA256 digest.
+ The format is: host[:port][/namespace]/name@sha256:
+ where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9.
+ The total length must be between 75 and 447 characters.
+
+ Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed.
+ The registry hostname must be included and must contain at least one dot.
+ Image tags (e.g., ":latest", ":v1.0.0") are not allowed.
+
+ Consult the OpenShift documentation for compatible plugin versions with your cluster version,
+ then obtain the image digest for that version from HashiCorp's container registry.
+
+ For disconnected environments, mirror the plugin image to an accessible registry
+ and reference the mirrored location with its digest.
+ maxLength: 447
+ minLength: 75
+ type: string
+ x-kubernetes-validations:
+ - message: the OCI Image reference must end with a valid
+ '@sha256:' suffix, where '' is 64
+ characters long
+ rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$'))
+ - message: the OCI Image name should follow the host[:port][/namespace]/name
+ format, resembling a valid URL without the scheme.
+ Short names are not allowed, the registry hostname
+ must be included.
+ rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$'))
+ tls:
+ description: |-
+ tls contains the TLS configuration for connecting to the Vault server.
+ When this field is not set, system default TLS settings are used.
+ minProperties: 1
+ properties:
+ caBundle:
+ description: |-
+ caBundle references a ConfigMap in the openshift-config namespace containing
+ the CA certificate bundle used to verify the TLS connection to the Vault server.
+ The referenced ConfigMap must contain the CA bundle in the key "ca-bundle.crt".
+ When this field is not set, the system's trusted CA certificates are used.
+
+ The namespace for the ConfigMap is openshift-config.
+
+ Example ConfigMap:
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: vault-ca-bundle
+ namespace: openshift-config
+ data:
+ ca-bundle.crt: |
+ -----BEGIN CERTIFICATE-----
+ ...
+ -----END CERTIFICATE-----
+ properties:
+ name:
+ description: |-
+ name is the metadata.name of the referenced ConfigMap in the openshift-config namespace.
+ The name must be a valid DNS subdomain name: it must contain no more than 253 characters,
+ contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: 'name must be a valid DNS subdomain
+ name: contain no more than 253 characters,
+ contain only lowercase alphanumeric characters,
+ ''-'' or ''.'', and start and end with an
+ alphanumeric character'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ serverName:
+ description: |-
+ serverName specifies the Server Name Indication (SNI) to use when connecting to Vault via TLS.
+ This is useful when the Vault server's hostname doesn't match its TLS certificate.
+ When this field is not set, the hostname from vaultAddress is used for SNI.
+
+ The value must be a valid DNS hostname: it must contain no more than 253 characters,
+ contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: 'serverName must be a valid DNS hostname:
+ contain no more than 253 characters, contain only
+ lowercase alphanumeric characters, ''-'' or ''.'',
+ and start and end with an alphanumeric character'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ type: object
+ transitKey:
+ description: |-
+ transitKey specifies the name of the encryption key in Vault's Transit engine.
+ This key is used to encrypt and decrypt data.
+
+ The transit key must be between 1 and 512 characters, cannot contain forward slashes,
+ and must only contain alphanumeric characters, hyphens, periods, and underscores.
+ maxLength: 512
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: transitKey cannot contain forward slashes
+ rule: '!self.contains(''/'')'
+ - message: transitKey must only contain alphanumeric characters,
+ hyphens, periods, and underscores
+ rule: self.matches('^[a-zA-Z0-9._-]+$')
+ transitMount:
+ description: |-
+ transitMount specifies the mount path of the Vault Transit engine.
+
+ The transit mount must be between 1 and 1024 characters, cannot start or
+ end with a forward slash, cannot contain consecutive forward slashes, and
+ must only contain RFC 3986 unreserved characters (alphanumeric, hyphen,
+ period, underscore, tilde) and forward slashes as path separators.
+ maxLength: 1024
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: transitMount cannot start with a forward slash
+ rule: '!self.startsWith(''/'')'
+ - message: transitMount cannot end with a forward slash
+ rule: '!self.endsWith(''/'')'
+ - message: transitMount cannot contain consecutive forward
+ slashes
+ rule: '!self.contains(''//'')'
+ - message: transitMount must only contain RFC 3986 unreserved
+ characters (alphanumeric, hyphen, period, underscore,
+ tilde) and forward slashes
+ rule: self.matches('^[a-zA-Z0-9._~/-]+$')
+ vaultAddress:
+ description: |-
+ vaultAddress specifies the address of the HashiCorp Vault instance.
+ The value must be a valid HTTPS URL containing only scheme, host, and optional port.
+ Paths, user info, query parameters, and fragments are not allowed.
+
+ Format: https://hostname[:port]
+ Example: https://vault.example.com:8200
+
+ The value must be between 1 and 512 characters.
+ maxLength: 512
minLength: 1
type: string
x-kubernetes-validations:
- - message: keyARN must follow the format `arn:aws:kms:::key/`.
- The account ID must be a 12 digit number and the region
- and key ID should consist only of lowercase hexadecimal
- characters and hyphens (-).
- rule: self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')
- region:
+ - message: must be a valid URL
+ rule: isURL(self)
+ - message: must use the 'https' scheme
+ rule: isURL(self) && url(self).getScheme() == 'https'
+ - message: must not contain a path
+ rule: isURL(self) && (url(self).getEscapedPath() ==
+ '' || url(self).getEscapedPath() == '/')
+ - message: must not have a query
+ rule: isURL(self) && url(self).getQuery() == {}
+ - message: must not have a fragment
+ rule: self.find('#(.+)$') == ''
+ - message: must not have user info
+ rule: self.find('@') == ''
+ vaultNamespace:
description: |-
- region specifies the AWS region where the KMS instance exists, and follows the format
- `--`, e.g.: `us-east-1`.
- Only lowercase letters and hyphens followed by numbers are allowed.
- maxLength: 64
+ vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted.
+ This is only applicable for Vault Enterprise installations.
+ When this field is not set, no namespace is used.
+
+ The value must be between 1 and 4096 characters.
+ The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.
+ maxLength: 4096
minLength: 1
type: string
x-kubernetes-validations:
- - message: region must be a valid AWS region, consisting
- of lowercase characters, digits and hyphens (-) only.
- rule: self.matches('^[a-z0-9]+(-[a-z0-9]+)*$')
+ - message: vaultNamespace cannot end with a forward slash
+ rule: '!self.endsWith(''/'')'
+ - message: vaultNamespace cannot contain spaces
+ rule: '!self.contains('' '')'
+ - message: vaultNamespace cannot be a reserved string
+ (root, sys, audit, auth, cubbyhole, identity)
+ rule: '!(self in [''root'', ''sys'', ''audit'', ''auth'',
+ ''cubbyhole'', ''identity''])'
required:
- - keyARN
- - region
+ - authentication
+ - kmsPluginImage
+ - transitKey
+ - transitMount
+ - vaultAddress
type: object
- type:
- description: |-
- type defines the kind of platform for the KMS provider.
- Available provider types are AWS only.
- enum:
- - AWS
- type: string
required:
- type
type: object
x-kubernetes-validations:
- - message: aws config is required when kms provider type is AWS,
- and forbidden otherwise
- rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws)
- : !has(self.aws)'
+ - message: vault config is required when kms provider type is
+ Vault, and forbidden otherwise
+ rule: 'self.type == ''Vault'' ? has(self.vault) : !has(self.vault)'
type:
description: |-
type defines what encryption type should be used to encrypt resources at the datastore layer.
@@ -292,6 +500,42 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
+ tlsAdherence:
+ description: |-
+ tlsAdherence controls if components in the cluster adhere to the TLS security profile
+ configured on this APIServer resource.
+
+ Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents".
+
+ When set to "LegacyAdheringComponentsOnly", components that already honor the
+ cluster-wide TLS profile continue to do so. Components that do not already honor
+ it continue to use their individual TLS configurations.
+
+ When set to "StrictAllComponents", all components must honor the configured TLS
+ profile unless they have a component-specific TLS configuration that overrides
+ it. This mode is recommended for security-conscious deployments and is required
+ for certain compliance frameworks.
+
+ Note: Some components such as Kubelet and IngressController have their own
+ dedicated TLS configuration mechanisms via KubeletConfig and IngressController
+ CRs respectively. When these component-specific TLS configurations are set,
+ they take precedence over the cluster-wide tlsSecurityProfile. When not set,
+ these components fall back to the cluster-wide default.
+
+ Components that encounter an unknown value for tlsAdherence should treat it
+ as "StrictAllComponents" and log a warning to ensure forward compatibility
+ while defaulting to the more secure behavior.
+
+ This field is optional.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is LegacyAdheringComponentsOnly.
+
+ Once set, this field may be changed to a different value, but may not be removed.
+ enum:
+ - LegacyAdheringComponentsOnly
+ - StrictAllComponents
+ type: string
tlsSecurityProfile:
description: |-
tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
@@ -302,8 +546,11 @@ spec:
custom:
description: |-
custom is a user-defined TLS security profile. Be extremely careful using a custom
- profile as invalid configurations can be catastrophic. An example custom profile
- looks like this:
+ profile as invalid configurations can be catastrophic.
+
+ The supported groups list for this profile is empty by default.
+
+ An example custom profile looks like this:
minTLSVersion: VersionTLS11
ciphers:
@@ -328,6 +575,46 @@ spec:
type: string
type: array
x-kubernetes-list-type: atomic
+ groups:
+ description: |-
+ groups is an optional, ordered field used to specify the supported groups (formerly known as
+ elliptic curves) that are used during the TLS handshake. The order of the groups represents
+ a suggested preference, with the most preferred group first. Note that not all platform
+ components honor the ordering: Go-based components use Go's internal preference order and
+ treat this list as a filter of allowed groups rather than an ordered preference.
+ Operators may remove entries their operands do not support.
+
+ When omitted, this means no opinion and the platform is left to choose reasonable defaults which are
+ subject to change over time and may be different per platform component depending on the underlying TLS
+ libraries they use. If specified, the list must contain at least one and at most 7 groups,
+ and each group must be unique.
+
+ For example, to use X25519 and secp256r1 (yaml):
+
+ groups:
+ - X25519
+ - secp256r1
+ items:
+ description: |-
+ TLSGroup is a supported group identifier that can be used in TLSProfile.Groups.
+ There is a one-to-one mapping between these names and the group IDs defined
+ in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry:
+ https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
+ Note that X25519MLKEM768 is a post-quantum hybrid group that is not
+ FIPS-approved and should be ignored by components running in FIPS mode.
+ enum:
+ - X25519
+ - secp256r1
+ - secp384r1
+ - secp521r1
+ - X25519MLKEM768
+ - SecP256r1MLKEM768
+ - SecP384r1MLKEM1024
+ type: string
+ maxItems: 7
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
minTLSVersion:
description: |-
minTLSVersion is used to specify the minimal version of the TLS protocol
@@ -348,6 +635,10 @@ spec:
legacy clients and want to remain highly secure while being compatible with
most clients currently in use.
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
+
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS12
ciphers:
@@ -366,7 +657,9 @@ spec:
description: |-
modern is a TLS security profile for use with clients that support TLS 1.3 and
do not need backward compatibility for older clients.
-
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS13
ciphers:
@@ -380,6 +673,10 @@ spec:
old is a TLS profile for use when services need to be accessed by very old
clients or libraries and should be used only as a last resort.
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
+
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS10
ciphers:
@@ -396,11 +693,14 @@ spec:
- ECDHE-RSA-AES128-SHA256
- ECDHE-ECDSA-AES128-SHA
- ECDHE-RSA-AES128-SHA
+ - ECDHE-ECDSA-AES256-SHA384
+ - ECDHE-RSA-AES256-SHA384
- ECDHE-ECDSA-AES256-SHA
- ECDHE-RSA-AES256-SHA
- AES128-GCM-SHA256
- AES256-GCM-SHA384
- AES128-SHA256
+ - AES256-SHA256
- AES128-SHA
- AES256-SHA
- DES-CBC3-SHA
@@ -411,10 +711,16 @@ spec:
type is one of Old, Intermediate, Modern or Custom. Custom provides the
ability to specify individual TLS security profile parameters.
- The profiles are based on version 5.7 of the Mozilla Server Side TLS
- configuration guidelines. The cipher lists consist of the configuration's
- "ciphersuites" followed by the Go-specific "ciphers" from the guidelines.
- See: https://ssl-config.mozilla.org/guidelines/5.7.json
+ The cipher and groups lists in these profiles are based on version 5.8 of the
+ Mozilla Server Side TLS configuration guidelines.
+ See: https://ssl-config.mozilla.org/guidelines/5.8.json
+
+ The groups are listed in suggested preference order, with the most preferred group first.
+ Note that not all platform components honor the ordering: Go-based components use Go's
+ internal preference order and treat this list as a filter of allowed groups rather than
+ an ordered preference.
+ Note that X25519MLKEM768 is a post-quantum hybrid group that is not
+ FIPS-approved and should be ignored by components running in FIPS mode.
The profiles are intent based, so they may change over time as new ciphers are
developed and existing ciphers are found to be insecure. Depending on
@@ -427,6 +733,9 @@ spec:
type: string
type: object
type: object
+ x-kubernetes-validations:
+ - message: tlsAdherence may not be removed once set
+ rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true'
status:
description: status holds observed values from the cluster. They may not
be overridden.
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml
index 272d49db0..ef855e387 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml
@@ -233,8 +233,11 @@ spec:
custom:
description: |-
custom is a user-defined TLS security profile. Be extremely careful using a custom
- profile as invalid configurations can be catastrophic. An example custom profile
- looks like this:
+ profile as invalid configurations can be catastrophic.
+
+ The supported groups list for this profile is empty by default.
+
+ An example custom profile looks like this:
minTLSVersion: VersionTLS11
ciphers:
@@ -279,6 +282,10 @@ spec:
legacy clients and want to remain highly secure while being compatible with
most clients currently in use.
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
+
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS12
ciphers:
@@ -297,7 +304,9 @@ spec:
description: |-
modern is a TLS security profile for use with clients that support TLS 1.3 and
do not need backward compatibility for older clients.
-
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS13
ciphers:
@@ -311,6 +320,10 @@ spec:
old is a TLS profile for use when services need to be accessed by very old
clients or libraries and should be used only as a last resort.
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
+
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS10
ciphers:
@@ -327,11 +340,14 @@ spec:
- ECDHE-RSA-AES128-SHA256
- ECDHE-ECDSA-AES128-SHA
- ECDHE-RSA-AES128-SHA
+ - ECDHE-ECDSA-AES256-SHA384
+ - ECDHE-RSA-AES256-SHA384
- ECDHE-ECDSA-AES256-SHA
- ECDHE-RSA-AES256-SHA
- AES128-GCM-SHA256
- AES256-GCM-SHA384
- AES128-SHA256
+ - AES256-SHA256
- AES128-SHA
- AES256-SHA
- DES-CBC3-SHA
@@ -342,10 +358,16 @@ spec:
type is one of Old, Intermediate, Modern or Custom. Custom provides the
ability to specify individual TLS security profile parameters.
- The profiles are based on version 5.7 of the Mozilla Server Side TLS
- configuration guidelines. The cipher lists consist of the configuration's
- "ciphersuites" followed by the Go-specific "ciphers" from the guidelines.
- See: https://ssl-config.mozilla.org/guidelines/5.7.json
+ The cipher and groups lists in these profiles are based on version 5.8 of the
+ Mozilla Server Side TLS configuration guidelines.
+ See: https://ssl-config.mozilla.org/guidelines/5.8.json
+
+ The groups are listed in suggested preference order, with the most preferred group first.
+ Note that not all platform components honor the ordering: Go-based components use Go's
+ internal preference order and treat this list as a filter of allowed groups rather than
+ an ordered preference.
+ Note that X25519MLKEM768 is a post-quantum hybrid group that is not
+ FIPS-approved and should be ignored by components running in FIPS mode.
The profiles are intent based, so they may change over time as new ciphers are
developed and existing ciphers are found to be insecure. Depending on
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml
index 23c438144..b8700ff3f 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml
@@ -168,59 +168,267 @@ spec:
managing the lifecyle of the encryption keys outside of the control plane.
This allows integration with an external provider to manage the data encryption keys securely.
properties:
- aws:
+ type:
+ description: |-
+ type defines the kind of platform for the KMS provider.
+ Allowed values are Vault.
+ When set to Vault, the plugin connects to a HashiCorp Vault server for key management.
+ enum:
+ - Vault
+ type: string
+ vault:
description: |-
- aws defines the key config for using an AWS KMS instance
- for the encryption. The AWS KMS instance is managed
+ vault defines the configuration for the Vault KMS plugin.
+ The plugin connects to a Vault Enterprise server that is managed
by the user outside the purview of the control plane.
+ This field must be set when type is Vault, and must be unset otherwise.
properties:
- keyARN:
+ authentication:
+ description: authentication defines the authentication
+ method used to authenticate with Vault.
+ properties:
+ appRole:
+ description: |-
+ appRole defines the configuration for AppRole authentication.
+ This field must be set when type is AppRole, and must be unset otherwise.
+ properties:
+ secret:
+ description: |-
+ secret references a secret in the openshift-config namespace containing
+ the AppRole credentials used to authenticate with Vault.
+ The referenced Secret must contain two keys: "role-id" for the AppRole Role ID and "secret-id" for the AppRole Secret ID.
+ properties:
+ name:
+ description: |-
+ name is the metadata.name of the referenced secret in the openshift-config namespace.
+ The name must be a valid DNS subdomain name: it must contain no more than 253 characters,
+ contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: 'name must be a valid DNS subdomain
+ name: contain no more than 253 characters,
+ contain only lowercase alphanumeric characters,
+ ''-'' or ''.'', and start and end with
+ an alphanumeric character'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ required:
+ - secret
+ type: object
+ type:
+ description: |-
+ type defines the authentication method used to authenticate with Vault.
+ Allowed values are AppRole.
+ When set to AppRole, the plugin uses AppRole credentials to authenticate with Vault.
+ enum:
+ - AppRole
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: appRole config is required when authentication
+ type is AppRole, and forbidden otherwise
+ rule: 'self.type == ''AppRole'' ? has(self.appRole)
+ : !has(self.appRole)'
+ kmsPluginImage:
description: |-
- keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
- The value must adhere to the format `arn:aws:kms:::key/`, where:
- - `` is the AWS region consisting of lowercase letters and hyphens followed by a number.
- - `` is a 12-digit numeric identifier for the AWS account.
- - `` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
- maxLength: 128
+ kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.
+
+ The image must be a fully qualified OCI image pull spec with a SHA256 digest.
+ The format is: host[:port][/namespace]/name@sha256:
+ where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9.
+ The total length must be between 75 and 447 characters.
+
+ Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed.
+ The registry hostname must be included and must contain at least one dot.
+ Image tags (e.g., ":latest", ":v1.0.0") are not allowed.
+
+ Consult the OpenShift documentation for compatible plugin versions with your cluster version,
+ then obtain the image digest for that version from HashiCorp's container registry.
+
+ For disconnected environments, mirror the plugin image to an accessible registry
+ and reference the mirrored location with its digest.
+ maxLength: 447
+ minLength: 75
+ type: string
+ x-kubernetes-validations:
+ - message: the OCI Image reference must end with a valid
+ '@sha256:' suffix, where '' is 64
+ characters long
+ rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$'))
+ - message: the OCI Image name should follow the host[:port][/namespace]/name
+ format, resembling a valid URL without the scheme.
+ Short names are not allowed, the registry hostname
+ must be included.
+ rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$'))
+ tls:
+ description: |-
+ tls contains the TLS configuration for connecting to the Vault server.
+ When this field is not set, system default TLS settings are used.
+ minProperties: 1
+ properties:
+ caBundle:
+ description: |-
+ caBundle references a ConfigMap in the openshift-config namespace containing
+ the CA certificate bundle used to verify the TLS connection to the Vault server.
+ The referenced ConfigMap must contain the CA bundle in the key "ca-bundle.crt".
+ When this field is not set, the system's trusted CA certificates are used.
+
+ The namespace for the ConfigMap is openshift-config.
+
+ Example ConfigMap:
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: vault-ca-bundle
+ namespace: openshift-config
+ data:
+ ca-bundle.crt: |
+ -----BEGIN CERTIFICATE-----
+ ...
+ -----END CERTIFICATE-----
+ properties:
+ name:
+ description: |-
+ name is the metadata.name of the referenced ConfigMap in the openshift-config namespace.
+ The name must be a valid DNS subdomain name: it must contain no more than 253 characters,
+ contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: 'name must be a valid DNS subdomain
+ name: contain no more than 253 characters,
+ contain only lowercase alphanumeric characters,
+ ''-'' or ''.'', and start and end with an
+ alphanumeric character'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ serverName:
+ description: |-
+ serverName specifies the Server Name Indication (SNI) to use when connecting to Vault via TLS.
+ This is useful when the Vault server's hostname doesn't match its TLS certificate.
+ When this field is not set, the hostname from vaultAddress is used for SNI.
+
+ The value must be a valid DNS hostname: it must contain no more than 253 characters,
+ contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: 'serverName must be a valid DNS hostname:
+ contain no more than 253 characters, contain only
+ lowercase alphanumeric characters, ''-'' or ''.'',
+ and start and end with an alphanumeric character'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ type: object
+ transitKey:
+ description: |-
+ transitKey specifies the name of the encryption key in Vault's Transit engine.
+ This key is used to encrypt and decrypt data.
+
+ The transit key must be between 1 and 512 characters, cannot contain forward slashes,
+ and must only contain alphanumeric characters, hyphens, periods, and underscores.
+ maxLength: 512
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: transitKey cannot contain forward slashes
+ rule: '!self.contains(''/'')'
+ - message: transitKey must only contain alphanumeric characters,
+ hyphens, periods, and underscores
+ rule: self.matches('^[a-zA-Z0-9._-]+$')
+ transitMount:
+ description: |-
+ transitMount specifies the mount path of the Vault Transit engine.
+
+ The transit mount must be between 1 and 1024 characters, cannot start or
+ end with a forward slash, cannot contain consecutive forward slashes, and
+ must only contain RFC 3986 unreserved characters (alphanumeric, hyphen,
+ period, underscore, tilde) and forward slashes as path separators.
+ maxLength: 1024
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: transitMount cannot start with a forward slash
+ rule: '!self.startsWith(''/'')'
+ - message: transitMount cannot end with a forward slash
+ rule: '!self.endsWith(''/'')'
+ - message: transitMount cannot contain consecutive forward
+ slashes
+ rule: '!self.contains(''//'')'
+ - message: transitMount must only contain RFC 3986 unreserved
+ characters (alphanumeric, hyphen, period, underscore,
+ tilde) and forward slashes
+ rule: self.matches('^[a-zA-Z0-9._~/-]+$')
+ vaultAddress:
+ description: |-
+ vaultAddress specifies the address of the HashiCorp Vault instance.
+ The value must be a valid HTTPS URL containing only scheme, host, and optional port.
+ Paths, user info, query parameters, and fragments are not allowed.
+
+ Format: https://hostname[:port]
+ Example: https://vault.example.com:8200
+
+ The value must be between 1 and 512 characters.
+ maxLength: 512
minLength: 1
type: string
x-kubernetes-validations:
- - message: keyARN must follow the format `arn:aws:kms:::key/`.
- The account ID must be a 12 digit number and the region
- and key ID should consist only of lowercase hexadecimal
- characters and hyphens (-).
- rule: self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')
- region:
+ - message: must be a valid URL
+ rule: isURL(self)
+ - message: must use the 'https' scheme
+ rule: isURL(self) && url(self).getScheme() == 'https'
+ - message: must not contain a path
+ rule: isURL(self) && (url(self).getEscapedPath() ==
+ '' || url(self).getEscapedPath() == '/')
+ - message: must not have a query
+ rule: isURL(self) && url(self).getQuery() == {}
+ - message: must not have a fragment
+ rule: self.find('#(.+)$') == ''
+ - message: must not have user info
+ rule: self.find('@') == ''
+ vaultNamespace:
description: |-
- region specifies the AWS region where the KMS instance exists, and follows the format
- `--`, e.g.: `us-east-1`.
- Only lowercase letters and hyphens followed by numbers are allowed.
- maxLength: 64
+ vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted.
+ This is only applicable for Vault Enterprise installations.
+ When this field is not set, no namespace is used.
+
+ The value must be between 1 and 4096 characters.
+ The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.
+ maxLength: 4096
minLength: 1
type: string
x-kubernetes-validations:
- - message: region must be a valid AWS region, consisting
- of lowercase characters, digits and hyphens (-) only.
- rule: self.matches('^[a-z0-9]+(-[a-z0-9]+)*$')
+ - message: vaultNamespace cannot end with a forward slash
+ rule: '!self.endsWith(''/'')'
+ - message: vaultNamespace cannot contain spaces
+ rule: '!self.contains('' '')'
+ - message: vaultNamespace cannot be a reserved string
+ (root, sys, audit, auth, cubbyhole, identity)
+ rule: '!(self in [''root'', ''sys'', ''audit'', ''auth'',
+ ''cubbyhole'', ''identity''])'
required:
- - keyARN
- - region
+ - authentication
+ - kmsPluginImage
+ - transitKey
+ - transitMount
+ - vaultAddress
type: object
- type:
- description: |-
- type defines the kind of platform for the KMS provider.
- Available provider types are AWS only.
- enum:
- - AWS
- type: string
required:
- type
type: object
x-kubernetes-validations:
- - message: aws config is required when kms provider type is AWS,
- and forbidden otherwise
- rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws)
- : !has(self.aws)'
+ - message: vault config is required when kms provider type is
+ Vault, and forbidden otherwise
+ rule: 'self.type == ''Vault'' ? has(self.vault) : !has(self.vault)'
type:
description: |-
type defines what encryption type should be used to encrypt resources at the datastore layer.
@@ -292,6 +500,42 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
+ tlsAdherence:
+ description: |-
+ tlsAdherence controls if components in the cluster adhere to the TLS security profile
+ configured on this APIServer resource.
+
+ Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents".
+
+ When set to "LegacyAdheringComponentsOnly", components that already honor the
+ cluster-wide TLS profile continue to do so. Components that do not already honor
+ it continue to use their individual TLS configurations.
+
+ When set to "StrictAllComponents", all components must honor the configured TLS
+ profile unless they have a component-specific TLS configuration that overrides
+ it. This mode is recommended for security-conscious deployments and is required
+ for certain compliance frameworks.
+
+ Note: Some components such as Kubelet and IngressController have their own
+ dedicated TLS configuration mechanisms via KubeletConfig and IngressController
+ CRs respectively. When these component-specific TLS configurations are set,
+ they take precedence over the cluster-wide tlsSecurityProfile. When not set,
+ these components fall back to the cluster-wide default.
+
+ Components that encounter an unknown value for tlsAdherence should treat it
+ as "StrictAllComponents" and log a warning to ensure forward compatibility
+ while defaulting to the more secure behavior.
+
+ This field is optional.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is LegacyAdheringComponentsOnly.
+
+ Once set, this field may be changed to a different value, but may not be removed.
+ enum:
+ - LegacyAdheringComponentsOnly
+ - StrictAllComponents
+ type: string
tlsSecurityProfile:
description: |-
tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
@@ -302,8 +546,11 @@ spec:
custom:
description: |-
custom is a user-defined TLS security profile. Be extremely careful using a custom
- profile as invalid configurations can be catastrophic. An example custom profile
- looks like this:
+ profile as invalid configurations can be catastrophic.
+
+ The supported groups list for this profile is empty by default.
+
+ An example custom profile looks like this:
minTLSVersion: VersionTLS11
ciphers:
@@ -328,6 +575,46 @@ spec:
type: string
type: array
x-kubernetes-list-type: atomic
+ groups:
+ description: |-
+ groups is an optional, ordered field used to specify the supported groups (formerly known as
+ elliptic curves) that are used during the TLS handshake. The order of the groups represents
+ a suggested preference, with the most preferred group first. Note that not all platform
+ components honor the ordering: Go-based components use Go's internal preference order and
+ treat this list as a filter of allowed groups rather than an ordered preference.
+ Operators may remove entries their operands do not support.
+
+ When omitted, this means no opinion and the platform is left to choose reasonable defaults which are
+ subject to change over time and may be different per platform component depending on the underlying TLS
+ libraries they use. If specified, the list must contain at least one and at most 7 groups,
+ and each group must be unique.
+
+ For example, to use X25519 and secp256r1 (yaml):
+
+ groups:
+ - X25519
+ - secp256r1
+ items:
+ description: |-
+ TLSGroup is a supported group identifier that can be used in TLSProfile.Groups.
+ There is a one-to-one mapping between these names and the group IDs defined
+ in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry:
+ https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
+ Note that X25519MLKEM768 is a post-quantum hybrid group that is not
+ FIPS-approved and should be ignored by components running in FIPS mode.
+ enum:
+ - X25519
+ - secp256r1
+ - secp384r1
+ - secp521r1
+ - X25519MLKEM768
+ - SecP256r1MLKEM768
+ - SecP384r1MLKEM1024
+ type: string
+ maxItems: 7
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
minTLSVersion:
description: |-
minTLSVersion is used to specify the minimal version of the TLS protocol
@@ -348,6 +635,10 @@ spec:
legacy clients and want to remain highly secure while being compatible with
most clients currently in use.
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
+
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS12
ciphers:
@@ -366,7 +657,9 @@ spec:
description: |-
modern is a TLS security profile for use with clients that support TLS 1.3 and
do not need backward compatibility for older clients.
-
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS13
ciphers:
@@ -380,6 +673,10 @@ spec:
old is a TLS profile for use when services need to be accessed by very old
clients or libraries and should be used only as a last resort.
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
+
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS10
ciphers:
@@ -396,11 +693,14 @@ spec:
- ECDHE-RSA-AES128-SHA256
- ECDHE-ECDSA-AES128-SHA
- ECDHE-RSA-AES128-SHA
+ - ECDHE-ECDSA-AES256-SHA384
+ - ECDHE-RSA-AES256-SHA384
- ECDHE-ECDSA-AES256-SHA
- ECDHE-RSA-AES256-SHA
- AES128-GCM-SHA256
- AES256-GCM-SHA384
- AES128-SHA256
+ - AES256-SHA256
- AES128-SHA
- AES256-SHA
- DES-CBC3-SHA
@@ -411,10 +711,16 @@ spec:
type is one of Old, Intermediate, Modern or Custom. Custom provides the
ability to specify individual TLS security profile parameters.
- The profiles are based on version 5.7 of the Mozilla Server Side TLS
- configuration guidelines. The cipher lists consist of the configuration's
- "ciphersuites" followed by the Go-specific "ciphers" from the guidelines.
- See: https://ssl-config.mozilla.org/guidelines/5.7.json
+ The cipher and groups lists in these profiles are based on version 5.8 of the
+ Mozilla Server Side TLS configuration guidelines.
+ See: https://ssl-config.mozilla.org/guidelines/5.8.json
+
+ The groups are listed in suggested preference order, with the most preferred group first.
+ Note that not all platform components honor the ordering: Go-based components use Go's
+ internal preference order and treat this list as a filter of allowed groups rather than
+ an ordered preference.
+ Note that X25519MLKEM768 is a post-quantum hybrid group that is not
+ FIPS-approved and should be ignored by components running in FIPS mode.
The profiles are intent based, so they may change over time as new ciphers are
developed and existing ciphers are found to be insecure. Depending on
@@ -427,6 +733,9 @@ spec:
type: string
type: object
type: object
+ x-kubernetes-validations:
+ - message: tlsAdherence may not be removed once set
+ rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true'
status:
description: status holds observed values from the cluster. They may not
be overridden.
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml
index 3c81a12e8..99c093b21 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml
@@ -233,8 +233,11 @@ spec:
custom:
description: |-
custom is a user-defined TLS security profile. Be extremely careful using a custom
- profile as invalid configurations can be catastrophic. An example custom profile
- looks like this:
+ profile as invalid configurations can be catastrophic.
+
+ The supported groups list for this profile is empty by default.
+
+ An example custom profile looks like this:
minTLSVersion: VersionTLS11
ciphers:
@@ -279,6 +282,10 @@ spec:
legacy clients and want to remain highly secure while being compatible with
most clients currently in use.
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
+
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS12
ciphers:
@@ -297,7 +304,9 @@ spec:
description: |-
modern is a TLS security profile for use with clients that support TLS 1.3 and
do not need backward compatibility for older clients.
-
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS13
ciphers:
@@ -311,6 +320,10 @@ spec:
old is a TLS profile for use when services need to be accessed by very old
clients or libraries and should be used only as a last resort.
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
+
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS10
ciphers:
@@ -327,11 +340,14 @@ spec:
- ECDHE-RSA-AES128-SHA256
- ECDHE-ECDSA-AES128-SHA
- ECDHE-RSA-AES128-SHA
+ - ECDHE-ECDSA-AES256-SHA384
+ - ECDHE-RSA-AES256-SHA384
- ECDHE-ECDSA-AES256-SHA
- ECDHE-RSA-AES256-SHA
- AES128-GCM-SHA256
- AES256-GCM-SHA384
- AES128-SHA256
+ - AES256-SHA256
- AES128-SHA
- AES256-SHA
- DES-CBC3-SHA
@@ -342,10 +358,16 @@ spec:
type is one of Old, Intermediate, Modern or Custom. Custom provides the
ability to specify individual TLS security profile parameters.
- The profiles are based on version 5.7 of the Mozilla Server Side TLS
- configuration guidelines. The cipher lists consist of the configuration's
- "ciphersuites" followed by the Go-specific "ciphers" from the guidelines.
- See: https://ssl-config.mozilla.org/guidelines/5.7.json
+ The cipher and groups lists in these profiles are based on version 5.8 of the
+ Mozilla Server Side TLS configuration guidelines.
+ See: https://ssl-config.mozilla.org/guidelines/5.8.json
+
+ The groups are listed in suggested preference order, with the most preferred group first.
+ Note that not all platform components honor the ordering: Go-based components use Go's
+ internal preference order and treat this list as a filter of allowed groups rather than
+ an ordered preference.
+ Note that X25519MLKEM768 is a post-quantum hybrid group that is not
+ FIPS-approved and should be ignored by components running in FIPS mode.
The profiles are intent based, so they may change over time as new ciphers are
developed and existing ciphers are found to be insecure. Depending on
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml
index 1d75d68e5..6728a62ef 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml
@@ -158,6 +158,277 @@ spec:
description: encryption allows the configuration of encryption of
resources at the datastore layer.
properties:
+ kms:
+ description: |-
+ kms defines the configuration for the external KMS instance that manages the encryption keys,
+ when KMS encryption is enabled sensitive resources will be encrypted using keys managed by an
+ externally configured KMS instance.
+
+ The Key Management Service (KMS) instance provides symmetric encryption and is responsible for
+ managing the lifecyle of the encryption keys outside of the control plane.
+ This allows integration with an external provider to manage the data encryption keys securely.
+ properties:
+ type:
+ description: |-
+ type defines the kind of platform for the KMS provider.
+ Allowed values are Vault.
+ When set to Vault, the plugin connects to a HashiCorp Vault server for key management.
+ enum:
+ - Vault
+ type: string
+ vault:
+ description: |-
+ vault defines the configuration for the Vault KMS plugin.
+ The plugin connects to a Vault Enterprise server that is managed
+ by the user outside the purview of the control plane.
+ This field must be set when type is Vault, and must be unset otherwise.
+ properties:
+ authentication:
+ description: authentication defines the authentication
+ method used to authenticate with Vault.
+ properties:
+ appRole:
+ description: |-
+ appRole defines the configuration for AppRole authentication.
+ This field must be set when type is AppRole, and must be unset otherwise.
+ properties:
+ secret:
+ description: |-
+ secret references a secret in the openshift-config namespace containing
+ the AppRole credentials used to authenticate with Vault.
+ The referenced Secret must contain two keys: "role-id" for the AppRole Role ID and "secret-id" for the AppRole Secret ID.
+ properties:
+ name:
+ description: |-
+ name is the metadata.name of the referenced secret in the openshift-config namespace.
+ The name must be a valid DNS subdomain name: it must contain no more than 253 characters,
+ contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: 'name must be a valid DNS subdomain
+ name: contain no more than 253 characters,
+ contain only lowercase alphanumeric characters,
+ ''-'' or ''.'', and start and end with
+ an alphanumeric character'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ required:
+ - secret
+ type: object
+ type:
+ description: |-
+ type defines the authentication method used to authenticate with Vault.
+ Allowed values are AppRole.
+ When set to AppRole, the plugin uses AppRole credentials to authenticate with Vault.
+ enum:
+ - AppRole
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: appRole config is required when authentication
+ type is AppRole, and forbidden otherwise
+ rule: 'self.type == ''AppRole'' ? has(self.appRole)
+ : !has(self.appRole)'
+ kmsPluginImage:
+ description: |-
+ kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.
+
+ The image must be a fully qualified OCI image pull spec with a SHA256 digest.
+ The format is: host[:port][/namespace]/name@sha256:
+ where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9.
+ The total length must be between 75 and 447 characters.
+
+ Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed.
+ The registry hostname must be included and must contain at least one dot.
+ Image tags (e.g., ":latest", ":v1.0.0") are not allowed.
+
+ Consult the OpenShift documentation for compatible plugin versions with your cluster version,
+ then obtain the image digest for that version from HashiCorp's container registry.
+
+ For disconnected environments, mirror the plugin image to an accessible registry
+ and reference the mirrored location with its digest.
+ maxLength: 447
+ minLength: 75
+ type: string
+ x-kubernetes-validations:
+ - message: the OCI Image reference must end with a valid
+ '@sha256:' suffix, where '' is 64
+ characters long
+ rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$'))
+ - message: the OCI Image name should follow the host[:port][/namespace]/name
+ format, resembling a valid URL without the scheme.
+ Short names are not allowed, the registry hostname
+ must be included.
+ rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$'))
+ tls:
+ description: |-
+ tls contains the TLS configuration for connecting to the Vault server.
+ When this field is not set, system default TLS settings are used.
+ minProperties: 1
+ properties:
+ caBundle:
+ description: |-
+ caBundle references a ConfigMap in the openshift-config namespace containing
+ the CA certificate bundle used to verify the TLS connection to the Vault server.
+ The referenced ConfigMap must contain the CA bundle in the key "ca-bundle.crt".
+ When this field is not set, the system's trusted CA certificates are used.
+
+ The namespace for the ConfigMap is openshift-config.
+
+ Example ConfigMap:
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: vault-ca-bundle
+ namespace: openshift-config
+ data:
+ ca-bundle.crt: |
+ -----BEGIN CERTIFICATE-----
+ ...
+ -----END CERTIFICATE-----
+ properties:
+ name:
+ description: |-
+ name is the metadata.name of the referenced ConfigMap in the openshift-config namespace.
+ The name must be a valid DNS subdomain name: it must contain no more than 253 characters,
+ contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: 'name must be a valid DNS subdomain
+ name: contain no more than 253 characters,
+ contain only lowercase alphanumeric characters,
+ ''-'' or ''.'', and start and end with an
+ alphanumeric character'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ serverName:
+ description: |-
+ serverName specifies the Server Name Indication (SNI) to use when connecting to Vault via TLS.
+ This is useful when the Vault server's hostname doesn't match its TLS certificate.
+ When this field is not set, the hostname from vaultAddress is used for SNI.
+
+ The value must be a valid DNS hostname: it must contain no more than 253 characters,
+ contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: 'serverName must be a valid DNS hostname:
+ contain no more than 253 characters, contain only
+ lowercase alphanumeric characters, ''-'' or ''.'',
+ and start and end with an alphanumeric character'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ type: object
+ transitKey:
+ description: |-
+ transitKey specifies the name of the encryption key in Vault's Transit engine.
+ This key is used to encrypt and decrypt data.
+
+ The transit key must be between 1 and 512 characters, cannot contain forward slashes,
+ and must only contain alphanumeric characters, hyphens, periods, and underscores.
+ maxLength: 512
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: transitKey cannot contain forward slashes
+ rule: '!self.contains(''/'')'
+ - message: transitKey must only contain alphanumeric characters,
+ hyphens, periods, and underscores
+ rule: self.matches('^[a-zA-Z0-9._-]+$')
+ transitMount:
+ description: |-
+ transitMount specifies the mount path of the Vault Transit engine.
+
+ The transit mount must be between 1 and 1024 characters, cannot start or
+ end with a forward slash, cannot contain consecutive forward slashes, and
+ must only contain RFC 3986 unreserved characters (alphanumeric, hyphen,
+ period, underscore, tilde) and forward slashes as path separators.
+ maxLength: 1024
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: transitMount cannot start with a forward slash
+ rule: '!self.startsWith(''/'')'
+ - message: transitMount cannot end with a forward slash
+ rule: '!self.endsWith(''/'')'
+ - message: transitMount cannot contain consecutive forward
+ slashes
+ rule: '!self.contains(''//'')'
+ - message: transitMount must only contain RFC 3986 unreserved
+ characters (alphanumeric, hyphen, period, underscore,
+ tilde) and forward slashes
+ rule: self.matches('^[a-zA-Z0-9._~/-]+$')
+ vaultAddress:
+ description: |-
+ vaultAddress specifies the address of the HashiCorp Vault instance.
+ The value must be a valid HTTPS URL containing only scheme, host, and optional port.
+ Paths, user info, query parameters, and fragments are not allowed.
+
+ Format: https://hostname[:port]
+ Example: https://vault.example.com:8200
+
+ The value must be between 1 and 512 characters.
+ maxLength: 512
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: must be a valid URL
+ rule: isURL(self)
+ - message: must use the 'https' scheme
+ rule: isURL(self) && url(self).getScheme() == 'https'
+ - message: must not contain a path
+ rule: isURL(self) && (url(self).getEscapedPath() ==
+ '' || url(self).getEscapedPath() == '/')
+ - message: must not have a query
+ rule: isURL(self) && url(self).getQuery() == {}
+ - message: must not have a fragment
+ rule: self.find('#(.+)$') == ''
+ - message: must not have user info
+ rule: self.find('@') == ''
+ vaultNamespace:
+ description: |-
+ vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted.
+ This is only applicable for Vault Enterprise installations.
+ When this field is not set, no namespace is used.
+
+ The value must be between 1 and 4096 characters.
+ The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: vaultNamespace cannot end with a forward slash
+ rule: '!self.endsWith(''/'')'
+ - message: vaultNamespace cannot contain spaces
+ rule: '!self.contains('' '')'
+ - message: vaultNamespace cannot be a reserved string
+ (root, sys, audit, auth, cubbyhole, identity)
+ rule: '!(self in [''root'', ''sys'', ''audit'', ''auth'',
+ ''cubbyhole'', ''identity''])'
+ required:
+ - authentication
+ - kmsPluginImage
+ - transitKey
+ - transitMount
+ - vaultAddress
+ type: object
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: vault config is required when kms provider type is
+ Vault, and forbidden otherwise
+ rule: 'self.type == ''Vault'' ? has(self.vault) : !has(self.vault)'
type:
description: |-
type defines what encryption type should be used to encrypt resources at the datastore layer.
@@ -181,6 +452,11 @@ spec:
- KMS
type: string
type: object
+ x-kubernetes-validations:
+ - message: kms config is required when encryption type is KMS, and
+ forbidden otherwise
+ rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
+ !has(self.kms)'
servingCerts:
description: |-
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates
@@ -224,6 +500,42 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
+ tlsAdherence:
+ description: |-
+ tlsAdherence controls if components in the cluster adhere to the TLS security profile
+ configured on this APIServer resource.
+
+ Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents".
+
+ When set to "LegacyAdheringComponentsOnly", components that already honor the
+ cluster-wide TLS profile continue to do so. Components that do not already honor
+ it continue to use their individual TLS configurations.
+
+ When set to "StrictAllComponents", all components must honor the configured TLS
+ profile unless they have a component-specific TLS configuration that overrides
+ it. This mode is recommended for security-conscious deployments and is required
+ for certain compliance frameworks.
+
+ Note: Some components such as Kubelet and IngressController have their own
+ dedicated TLS configuration mechanisms via KubeletConfig and IngressController
+ CRs respectively. When these component-specific TLS configurations are set,
+ they take precedence over the cluster-wide tlsSecurityProfile. When not set,
+ these components fall back to the cluster-wide default.
+
+ Components that encounter an unknown value for tlsAdherence should treat it
+ as "StrictAllComponents" and log a warning to ensure forward compatibility
+ while defaulting to the more secure behavior.
+
+ This field is optional.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is LegacyAdheringComponentsOnly.
+
+ Once set, this field may be changed to a different value, but may not be removed.
+ enum:
+ - LegacyAdheringComponentsOnly
+ - StrictAllComponents
+ type: string
tlsSecurityProfile:
description: |-
tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
@@ -234,8 +546,11 @@ spec:
custom:
description: |-
custom is a user-defined TLS security profile. Be extremely careful using a custom
- profile as invalid configurations can be catastrophic. An example custom profile
- looks like this:
+ profile as invalid configurations can be catastrophic.
+
+ The supported groups list for this profile is empty by default.
+
+ An example custom profile looks like this:
minTLSVersion: VersionTLS11
ciphers:
@@ -260,6 +575,46 @@ spec:
type: string
type: array
x-kubernetes-list-type: atomic
+ groups:
+ description: |-
+ groups is an optional, ordered field used to specify the supported groups (formerly known as
+ elliptic curves) that are used during the TLS handshake. The order of the groups represents
+ a suggested preference, with the most preferred group first. Note that not all platform
+ components honor the ordering: Go-based components use Go's internal preference order and
+ treat this list as a filter of allowed groups rather than an ordered preference.
+ Operators may remove entries their operands do not support.
+
+ When omitted, this means no opinion and the platform is left to choose reasonable defaults which are
+ subject to change over time and may be different per platform component depending on the underlying TLS
+ libraries they use. If specified, the list must contain at least one and at most 7 groups,
+ and each group must be unique.
+
+ For example, to use X25519 and secp256r1 (yaml):
+
+ groups:
+ - X25519
+ - secp256r1
+ items:
+ description: |-
+ TLSGroup is a supported group identifier that can be used in TLSProfile.Groups.
+ There is a one-to-one mapping between these names and the group IDs defined
+ in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry:
+ https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
+ Note that X25519MLKEM768 is a post-quantum hybrid group that is not
+ FIPS-approved and should be ignored by components running in FIPS mode.
+ enum:
+ - X25519
+ - secp256r1
+ - secp384r1
+ - secp521r1
+ - X25519MLKEM768
+ - SecP256r1MLKEM768
+ - SecP384r1MLKEM1024
+ type: string
+ maxItems: 7
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
minTLSVersion:
description: |-
minTLSVersion is used to specify the minimal version of the TLS protocol
@@ -280,6 +635,10 @@ spec:
legacy clients and want to remain highly secure while being compatible with
most clients currently in use.
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
+
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS12
ciphers:
@@ -298,7 +657,9 @@ spec:
description: |-
modern is a TLS security profile for use with clients that support TLS 1.3 and
do not need backward compatibility for older clients.
-
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS13
ciphers:
@@ -312,6 +673,10 @@ spec:
old is a TLS profile for use when services need to be accessed by very old
clients or libraries and should be used only as a last resort.
+ The supported groups list includes by default the following groups
+ in suggested preference order (ordering may not be honored by all implementations):
+ X25519MLKEM768, X25519, secp256r1, secp384r1.
+
This profile is equivalent to a Custom profile specified as:
minTLSVersion: VersionTLS10
ciphers:
@@ -328,11 +693,14 @@ spec:
- ECDHE-RSA-AES128-SHA256
- ECDHE-ECDSA-AES128-SHA
- ECDHE-RSA-AES128-SHA
+ - ECDHE-ECDSA-AES256-SHA384
+ - ECDHE-RSA-AES256-SHA384
- ECDHE-ECDSA-AES256-SHA
- ECDHE-RSA-AES256-SHA
- AES128-GCM-SHA256
- AES256-GCM-SHA384
- AES128-SHA256
+ - AES256-SHA256
- AES128-SHA
- AES256-SHA
- DES-CBC3-SHA
@@ -343,10 +711,16 @@ spec:
type is one of Old, Intermediate, Modern or Custom. Custom provides the
ability to specify individual TLS security profile parameters.
- The profiles are based on version 5.7 of the Mozilla Server Side TLS
- configuration guidelines. The cipher lists consist of the configuration's
- "ciphersuites" followed by the Go-specific "ciphers" from the guidelines.
- See: https://ssl-config.mozilla.org/guidelines/5.7.json
+ The cipher and groups lists in these profiles are based on version 5.8 of the
+ Mozilla Server Side TLS configuration guidelines.
+ See: https://ssl-config.mozilla.org/guidelines/5.8.json
+
+ The groups are listed in suggested preference order, with the most preferred group first.
+ Note that not all platform components honor the ordering: Go-based components use Go's
+ internal preference order and treat this list as a filter of allowed groups rather than
+ an ordered preference.
+ Note that X25519MLKEM768 is a post-quantum hybrid group that is not
+ FIPS-approved and should be ignored by components running in FIPS mode.
The profiles are intent based, so they may change over time as new ciphers are
developed and existing ciphers are found to be insecure. Depending on
@@ -359,6 +733,9 @@ spec:
type: string
type: object
type: object
+ x-kubernetes-validations:
+ - message: tlsAdherence may not be removed once set
+ rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true'
status:
description: status holds observed values from the cluster. They may not
be overridden.
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml
index b4b8eb306..8c2695a58 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml
@@ -212,12 +212,18 @@ spec:
description: |-
prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.
- When omitted (""), no prefix is applied to the cluster identity attribute.
+ When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute.
+ Must not be set to a non-empty value when expression is set.
Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c".
type: string
type: object
x-kubernetes-validations:
+ - message: prefix must not be set to a non-empty value when
+ expression is set
+ rule: 'has(self.expression) && size(self.expression) >
+ 0 ? (!has(self.prefix) || size(self.prefix) == 0) :
+ true'
- message: expression must not be set if claim is specified
and is not an empty string
rule: '(size(self.?claim.orValue("")) > 0) ? !has(self.expression)
@@ -316,11 +322,9 @@ spec:
Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim.
-
The prefix field must be set when prefixPolicy is 'Prefix'.
-
+ Must not be set to 'Prefix' when expression is set.
When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim.
-
When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time.
Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'.
@@ -341,6 +345,11 @@ spec:
- message: precisely one of claim or expression must be
set
rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
+ - message: prefixPolicy must not be set to 'Prefix' when
+ expression is set
+ rule: 'has(self.expression) && size(self.expression) >
+ 0 ? !has(self.prefixPolicy) || self.prefixPolicy !=
+ ''Prefix'' : true'
- message: prefix must be set if prefixPolicy is 'Prefix',
but must remain unset otherwise
rule: 'has(self.prefixPolicy) && self.prefixPolicy ==
@@ -437,6 +446,434 @@ spec:
? has(self.requiredClaim) : !has(self.requiredClaim)'
type: array
x-kubernetes-list-type: atomic
+ externalClaimsSources:
+ description: |-
+ externalClaimsSources is an optional field that can be used to configure
+ sources, external to the token provided in a request, in which claims
+ should be fetched from and made available to the claim mapping process
+ that is used to build the identity of a token holder.
+
+ For example, fetching additional user metadata from an OIDC provider's UserInfo endpoint.
+
+ When not specified, only claims present in the token itself will be available
+ in the claim mapping process.
+
+ When specified, at least one external claim source must be specified and no more than 5
+ sources may be specified.
+ All external claim sources must have unique claim mappings.
+ When an external source responds and resolves additional claims successfully, they will
+ be made available as claims during the claim mapping process.
+ Externally sourced claims with the same name as a claim existing within the token will
+ overwrite the claim data from the token with the externally sourced information.
+ If an external source does not respond, responds with an error, or the additional
+ claim data cannot be resolved from the response successfully it will not be
+ included in the claim data passed to the claim mapping process.
+ items:
+ description: ExternalClaimsSource provides the configuration
+ for a single external claim source.
+ properties:
+ authentication:
+ description: |-
+ authentication is an optional field that configures how the apiserver authenticates with an external claims source.
+ When not specified, anonymous authentication is used which means no 'Authorization' header
+ is sent in the HTTP request to fetch the external claims.
+ properties:
+ clientCredential:
+ description: |-
+ clientCredential configures the client credentials
+ and token endpoint to use to get an access token.
+ clientCredential is required when type is 'ClientCredential', and forbidden otherwise.
+ properties:
+ clientID:
+ description: |-
+ clientID is a required client identifier to use during the OAuth2 client credentials flow.
+ clientID must be at least 1 character in length, must not exceed 256 characters in length,
+ and must only contain printable ASCII characters.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: clientID must only contain printable
+ ASCII characters
+ rule: self.matches('^[[:print:]]+$')
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to a Secret in the openshift-config namespace to be used
+ as the client secret during the OAuth2 client credentials flow.
+
+ The key 'client-secret' is used to locate the client secret data in the Secret.
+ properties:
+ name:
+ description: |-
+ name is the required name of the Secret that exists in the openshift-config namespace.
+
+ It must be at least 1 character in length, must not exceed 253 characters in length,
+ must start and end with a lowercase alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or '.'.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must start and end with a
+ lowercase alphanumeric character, and
+ must only contain lowercase alphanumeric
+ characters, '-' or '.'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ scopes:
+ description: |-
+ scopes is an optional list of OAuth2 scopes to request when obtaining
+ an access token.
+
+ If not specified, the token endpoint's default scopes
+ will be used.
+
+ When specified, there must be at least 1 entry and must not exceed 16 entries.
+ Each entry must be at least 1 character in length and must not exceed 256 characters in length.
+ Each entry must only contain printable ASCII characters, excluding spaces, double quotes and backslashes.
+ Entries must be unique.
+ items:
+ description: |-
+ OAuth2Scope is a string alias that represents an OAuth2 Scope as defined by https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.4
+ Must be at least 1 character in length, must not exceed 256 characters in length and must only contain printable ASCII characters, excluding spaces, double quotes and backslashes.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: scopes must only contain printable
+ ASCII characters excluding spaces, double
+ quotes and backslashes
+ rule: self.matches('^[!#-[\\]-~]+$')
+ maxItems: 16
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ tls:
+ description: |-
+ tls is an optional field that allows configuring the TLS
+ settings used to interact with the identity provider
+ as an OAuth2 client.
+
+ When omitted, system default TLS settings will be used
+ for the OAuth2 client.
+ properties:
+ certificateAuthority:
+ description: |-
+ certificateAuthority is a required reference to a ConfigMap in the openshift-config
+ namespace that contains the CA certificate to use to validate TLS connections with the external claims source.
+ The key "ca-bundle.crt" must be present in the referenced ConfigMap and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+ properties:
+ name:
+ description: |-
+ name is the required name of the ConfigMap that exists in the openshift-config namespace.
+ The key "ca-bundle.crt" must be present and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+
+ It must be at least 1 character in length, must not exceed 253 characters in length,
+ must start and end with a lowercase alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or '.'.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must start and end with
+ a lowercase alphanumeric character,
+ and must only contain lowercase alphanumeric
+ characters, '-' or '.'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ required:
+ - certificateAuthority
+ type: object
+ tokenEndpoint:
+ description: |-
+ tokenEndpoint is a required URL to query for an access token using
+ the client credential OAuth2 flow.
+ tokenEndpoint must be at least 1 character in length and must not exceed 2048 characters in length.
+ tokenEndpoint must be a valid HTTPS URL.
+ tokenEndpoint must have a host and a path.
+ tokenEndpoint must not contain query parameters, fragments,
+ or user information (e.g., "user:password@host").
+ maxLength: 2048
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: tokenEndpoint must be a valid HTTPS
+ url
+ rule: isURL(self)
+ - message: tokenEndpoint must be a valid HTTPS
+ url
+ rule: isURL(self) && url(self).getScheme() ==
+ 'https'
+ - message: tokenEndpoint must have a hostname
+ rule: isURL(self) && url(self).getHost() !=
+ ''
+ - message: tokenEndpoint must have a path
+ rule: isURL(self) && url(self).getEscapedPath()
+ != ''
+ - message: tokenEndpoint must not have query parameters
+ rule: isURL(self) && url(self).getQuery() ==
+ {}
+ - message: tokenEndpoint must not have a fragment
+ rule: isURL(self) && self.find('#(.+)$') ==
+ ''
+ - message: tokenEndpoint must not have user info
+ rule: isURL(self) && !self.matches('^https://[^/]+@.+$')
+ required:
+ - clientID
+ - clientSecret
+ - tokenEndpoint
+ type: object
+ type:
+ description: |-
+ type is a required field that sets the type of
+ authentication method used by the authenticator
+ when fetching external claims.
+
+ Allowed values are 'RequestProvidedToken' and 'ClientCredential'.
+
+ When set to 'RequestProvidedToken', the authenticator will
+ use the token provided to the kube-apiserver as part of the
+ request to authenticate with the external claims source.
+
+ When set to 'ClientCredential', the authenticator will
+ use the configured client-id, client-secret, and token endpoint
+ to fetch an access token using the OAuth2 client credentials grant
+ flow. The fetched access token will then be used to authenticate
+ with the external claims source.
+ enum:
+ - RequestProvidedToken
+ - ClientCredential
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: clientCredential is required when type is ClientCredential,
+ and forbidden otherwise
+ rule: 'self.type == ''ClientCredential'' ? has(self.clientCredential)
+ : !has(self.clientCredential)'
+ mappings:
+ description: |-
+ mappings is a required list of the claim
+ and response handling expression pairs
+ that produces the claims from the external source.
+ mappings must have at least 1 entry and must not exceed 16 entries.
+ Entries must have a unique name across all external claim sources.
+ items:
+ description: |-
+ SourcedClaimMapping configures the mapping behavior for a single external claim
+ from the response the apiserver received from the external claim source.
+ properties:
+ expression:
+ description: |-
+ expression is a required CEL expression that
+ will produce a value to be assigned to the claim.
+ The full response body from the request to the
+ external claim source is provided via the
+ `response.body` variable.
+
+ The contents of the `response.body` variable varies based on the response received
+ from the external source. It is the responsibility of those configuring
+ this expression to understand what is returned from the external source.
+
+ expression must be at least 1 character and must not exceed 1024 characters in length.
+ maxLength: 1024
+ minLength: 1
+ type: string
+ name:
+ description: |-
+ name is a required name of the claim that
+ will be produced and made available during
+ the claim-to-identity mapping process.
+ name must consist of only lowercase alpha characters and underscores ('_').
+ name must be at least 1 character and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must consist of only lowercase alpha
+ characters and underscores
+ rule: self.matches('^[a-z_]+$')
+ required:
+ - expression
+ - name
+ type: object
+ maxItems: 16
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ predicates:
+ description: |-
+ predicates is an optional list of constraints in
+ which claims should attempt to be fetched from this
+ external source.
+
+ When omitted, claims are always fetched
+ from this external source.
+
+ When specified, all predicates must evaluate to 'true'
+ before claims are attempted to be fetched from this external source.
+ predicates must have at least 1 entry and must not exceed 16 entries.
+ Entries must have unique expressions.
+ items:
+ description: |-
+ ExternalSourcePredicate configures a singular condition
+ that must return true before the external source is queried
+ to retrieve external claims.
+ properties:
+ expression:
+ description: |-
+ expression is a required CEL expression that
+ is used to determine whether or not an external
+ source should be used to fetch external claims.
+
+ The expression must return a boolean value,
+ where true means that the source should be consulted
+ and false means that it should not.
+
+ Claims from the token used for the request to the kube-apiserver
+ are made available via the `claims` variable.
+
+ The contents of the `claims` variable varies based on the claims that are
+ present in the token being validated. It is the responsibility of those configuring this
+ field to understand what claims the identity provider includes when issuing tokens.
+
+ expression must be at least 1 character and must not exceed 1024 characters in length.
+ maxLength: 1024
+ minLength: 1
+ type: string
+ required:
+ - expression
+ type: object
+ maxItems: 16
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - expression
+ x-kubernetes-list-type: map
+ tls:
+ description: |-
+ tls is an optional field that configures the http client TLS
+ settings when fetching external claims from this source.
+
+ When omitted, system default TLS settings will be used
+ for fetching claims from the external source.
+ properties:
+ certificateAuthority:
+ description: |-
+ certificateAuthority is a required reference to a ConfigMap in the openshift-config
+ namespace that contains the CA certificate to use to validate TLS connections with the external claims source.
+ The key "ca-bundle.crt" must be present in the referenced ConfigMap and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+ properties:
+ name:
+ description: |-
+ name is the required name of the ConfigMap that exists in the openshift-config namespace.
+ The key "ca-bundle.crt" must be present and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+
+ It must be at least 1 character in length, must not exceed 253 characters in length,
+ must start and end with a lowercase alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or '.'.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must start and end with a lowercase
+ alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or
+ '.'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ required:
+ - certificateAuthority
+ type: object
+ url:
+ description: |-
+ url is a required configuration of the URL
+ for which the external claims are located.
+ properties:
+ hostname:
+ description: |-
+ hostname is a required hostname for which the external claims are located.
+
+ It must be a valid DNS subdomain name as per RFC1123.
+
+ This means that it must start and end with a lowercase alphanumeric character,
+ must only consist of lowercase alphanumeric characters, '-', and '.'.
+ hostname may optionally specify a port in the format ':{port}'.
+ If a port is specified it must not exceed 65535.
+
+ hostname must be at least 1 character in length.
+ When specifying a port, hostname must not exceed 259 characters in length.
+ When not specifying a port, hostname must not exceed 253 characters in length.
+ maxLength: 259
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid hostname
+ rule: isURL('https://'+self)
+ - message: hostname before port must start and end
+ with a lowercase alphanumeric character, and must
+ only contain lowercase alphanumeric characters,
+ '-' or '.'
+ rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()'
+ - message: port must not exceed 65535
+ rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1])
+ <= 65535 : true'
+ pathExpression:
+ description: |-
+ pathExpression is a required CEL expression that returns a list
+ of string values used to construct the URL path.
+ Claims from the token used for the request to the kube-apiserver
+ are made available via the `claims` variable.
+ expression must be at least 1 character in length and must not exceed 1024 characters in length.
+
+ Values in the returned list will be joined with the hostname using a forward slash
+ (`/`) as a separator. Values in the returned list do not need to include the forward slash.
+ If a forward slash is included in a returned value, it will be encoded as `%2F`.
+
+ Example of a static path configuration:
+
+ pathExpression: ['realms', 'k8s', 'protocol', 'openid-connect', 'userinfo']
+
+ The above example would resolve to the path: '/realms/k8s/protocol/openid-connect/userinfo'
+
+ Example of a dynamic path configuration:
+
+ pathExpression: "['admin', 'realms', 'k8s', 'users'] + [claims.sub] + ['groups']"
+
+ Assuming 'claims.sub' is set to '12345', the above example would resolve to the path: '/admin/realms/k8s/users/12345/groups'
+ maxLength: 1024
+ minLength: 1
+ type: string
+ required:
+ - hostname
+ - pathExpression
+ type: object
+ required:
+ - mappings
+ - url
+ type: object
+ maxItems: 5
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: mapping names must be unique across all external
+ claim sources.
+ rule: self.all(s, s.mappings.all(m, self.filter(s2, s2.mappings.exists(m2,
+ m2.name == m.name)).size() == 1))
issuer:
description: issuer is a required field that configures how
the platform interacts with the identity provider and how
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml
index d1e44f6ce..5e6be8db9 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml
@@ -199,7 +199,8 @@ spec:
description: |-
prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.
- When omitted (""), no prefix is applied to the cluster identity attribute.
+ When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute.
+ Must not be set to a non-empty value when expression is set.
Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c".
type: string
@@ -288,11 +289,9 @@ spec:
Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim.
-
The prefix field must be set when prefixPolicy is 'Prefix'.
-
+ Must not be set to 'Prefix' when expression is set.
When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim.
-
When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time.
Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'.
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml
index c46017aa3..09111b08c 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml
@@ -212,12 +212,18 @@ spec:
description: |-
prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.
- When omitted (""), no prefix is applied to the cluster identity attribute.
+ When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute.
+ Must not be set to a non-empty value when expression is set.
Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c".
type: string
type: object
x-kubernetes-validations:
+ - message: prefix must not be set to a non-empty value when
+ expression is set
+ rule: 'has(self.expression) && size(self.expression) >
+ 0 ? (!has(self.prefix) || size(self.prefix) == 0) :
+ true'
- message: expression must not be set if claim is specified
and is not an empty string
rule: '(size(self.?claim.orValue("")) > 0) ? !has(self.expression)
@@ -316,11 +322,9 @@ spec:
Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim.
-
The prefix field must be set when prefixPolicy is 'Prefix'.
-
+ Must not be set to 'Prefix' when expression is set.
When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim.
-
When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time.
Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'.
@@ -341,6 +345,11 @@ spec:
- message: precisely one of claim or expression must be
set
rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
+ - message: prefixPolicy must not be set to 'Prefix' when
+ expression is set
+ rule: 'has(self.expression) && size(self.expression) >
+ 0 ? !has(self.prefixPolicy) || self.prefixPolicy !=
+ ''Prefix'' : true'
- message: prefix must be set if prefixPolicy is 'Prefix',
but must remain unset otherwise
rule: 'has(self.prefixPolicy) && self.prefixPolicy ==
@@ -437,6 +446,434 @@ spec:
? has(self.requiredClaim) : !has(self.requiredClaim)'
type: array
x-kubernetes-list-type: atomic
+ externalClaimsSources:
+ description: |-
+ externalClaimsSources is an optional field that can be used to configure
+ sources, external to the token provided in a request, in which claims
+ should be fetched from and made available to the claim mapping process
+ that is used to build the identity of a token holder.
+
+ For example, fetching additional user metadata from an OIDC provider's UserInfo endpoint.
+
+ When not specified, only claims present in the token itself will be available
+ in the claim mapping process.
+
+ When specified, at least one external claim source must be specified and no more than 5
+ sources may be specified.
+ All external claim sources must have unique claim mappings.
+ When an external source responds and resolves additional claims successfully, they will
+ be made available as claims during the claim mapping process.
+ Externally sourced claims with the same name as a claim existing within the token will
+ overwrite the claim data from the token with the externally sourced information.
+ If an external source does not respond, responds with an error, or the additional
+ claim data cannot be resolved from the response successfully it will not be
+ included in the claim data passed to the claim mapping process.
+ items:
+ description: ExternalClaimsSource provides the configuration
+ for a single external claim source.
+ properties:
+ authentication:
+ description: |-
+ authentication is an optional field that configures how the apiserver authenticates with an external claims source.
+ When not specified, anonymous authentication is used which means no 'Authorization' header
+ is sent in the HTTP request to fetch the external claims.
+ properties:
+ clientCredential:
+ description: |-
+ clientCredential configures the client credentials
+ and token endpoint to use to get an access token.
+ clientCredential is required when type is 'ClientCredential', and forbidden otherwise.
+ properties:
+ clientID:
+ description: |-
+ clientID is a required client identifier to use during the OAuth2 client credentials flow.
+ clientID must be at least 1 character in length, must not exceed 256 characters in length,
+ and must only contain printable ASCII characters.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: clientID must only contain printable
+ ASCII characters
+ rule: self.matches('^[[:print:]]+$')
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to a Secret in the openshift-config namespace to be used
+ as the client secret during the OAuth2 client credentials flow.
+
+ The key 'client-secret' is used to locate the client secret data in the Secret.
+ properties:
+ name:
+ description: |-
+ name is the required name of the Secret that exists in the openshift-config namespace.
+
+ It must be at least 1 character in length, must not exceed 253 characters in length,
+ must start and end with a lowercase alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or '.'.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must start and end with a
+ lowercase alphanumeric character, and
+ must only contain lowercase alphanumeric
+ characters, '-' or '.'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ scopes:
+ description: |-
+ scopes is an optional list of OAuth2 scopes to request when obtaining
+ an access token.
+
+ If not specified, the token endpoint's default scopes
+ will be used.
+
+ When specified, there must be at least 1 entry and must not exceed 16 entries.
+ Each entry must be at least 1 character in length and must not exceed 256 characters in length.
+ Each entry must only contain printable ASCII characters, excluding spaces, double quotes and backslashes.
+ Entries must be unique.
+ items:
+ description: |-
+ OAuth2Scope is a string alias that represents an OAuth2 Scope as defined by https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.4
+ Must be at least 1 character in length, must not exceed 256 characters in length and must only contain printable ASCII characters, excluding spaces, double quotes and backslashes.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: scopes must only contain printable
+ ASCII characters excluding spaces, double
+ quotes and backslashes
+ rule: self.matches('^[!#-[\\]-~]+$')
+ maxItems: 16
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ tls:
+ description: |-
+ tls is an optional field that allows configuring the TLS
+ settings used to interact with the identity provider
+ as an OAuth2 client.
+
+ When omitted, system default TLS settings will be used
+ for the OAuth2 client.
+ properties:
+ certificateAuthority:
+ description: |-
+ certificateAuthority is a required reference to a ConfigMap in the openshift-config
+ namespace that contains the CA certificate to use to validate TLS connections with the external claims source.
+ The key "ca-bundle.crt" must be present in the referenced ConfigMap and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+ properties:
+ name:
+ description: |-
+ name is the required name of the ConfigMap that exists in the openshift-config namespace.
+ The key "ca-bundle.crt" must be present and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+
+ It must be at least 1 character in length, must not exceed 253 characters in length,
+ must start and end with a lowercase alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or '.'.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must start and end with
+ a lowercase alphanumeric character,
+ and must only contain lowercase alphanumeric
+ characters, '-' or '.'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ required:
+ - certificateAuthority
+ type: object
+ tokenEndpoint:
+ description: |-
+ tokenEndpoint is a required URL to query for an access token using
+ the client credential OAuth2 flow.
+ tokenEndpoint must be at least 1 character in length and must not exceed 2048 characters in length.
+ tokenEndpoint must be a valid HTTPS URL.
+ tokenEndpoint must have a host and a path.
+ tokenEndpoint must not contain query parameters, fragments,
+ or user information (e.g., "user:password@host").
+ maxLength: 2048
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: tokenEndpoint must be a valid HTTPS
+ url
+ rule: isURL(self)
+ - message: tokenEndpoint must be a valid HTTPS
+ url
+ rule: isURL(self) && url(self).getScheme() ==
+ 'https'
+ - message: tokenEndpoint must have a hostname
+ rule: isURL(self) && url(self).getHost() !=
+ ''
+ - message: tokenEndpoint must have a path
+ rule: isURL(self) && url(self).getEscapedPath()
+ != ''
+ - message: tokenEndpoint must not have query parameters
+ rule: isURL(self) && url(self).getQuery() ==
+ {}
+ - message: tokenEndpoint must not have a fragment
+ rule: isURL(self) && self.find('#(.+)$') ==
+ ''
+ - message: tokenEndpoint must not have user info
+ rule: isURL(self) && !self.matches('^https://[^/]+@.+$')
+ required:
+ - clientID
+ - clientSecret
+ - tokenEndpoint
+ type: object
+ type:
+ description: |-
+ type is a required field that sets the type of
+ authentication method used by the authenticator
+ when fetching external claims.
+
+ Allowed values are 'RequestProvidedToken' and 'ClientCredential'.
+
+ When set to 'RequestProvidedToken', the authenticator will
+ use the token provided to the kube-apiserver as part of the
+ request to authenticate with the external claims source.
+
+ When set to 'ClientCredential', the authenticator will
+ use the configured client-id, client-secret, and token endpoint
+ to fetch an access token using the OAuth2 client credentials grant
+ flow. The fetched access token will then be used to authenticate
+ with the external claims source.
+ enum:
+ - RequestProvidedToken
+ - ClientCredential
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: clientCredential is required when type is ClientCredential,
+ and forbidden otherwise
+ rule: 'self.type == ''ClientCredential'' ? has(self.clientCredential)
+ : !has(self.clientCredential)'
+ mappings:
+ description: |-
+ mappings is a required list of the claim
+ and response handling expression pairs
+ that produces the claims from the external source.
+ mappings must have at least 1 entry and must not exceed 16 entries.
+ Entries must have a unique name across all external claim sources.
+ items:
+ description: |-
+ SourcedClaimMapping configures the mapping behavior for a single external claim
+ from the response the apiserver received from the external claim source.
+ properties:
+ expression:
+ description: |-
+ expression is a required CEL expression that
+ will produce a value to be assigned to the claim.
+ The full response body from the request to the
+ external claim source is provided via the
+ `response.body` variable.
+
+ The contents of the `response.body` variable varies based on the response received
+ from the external source. It is the responsibility of those configuring
+ this expression to understand what is returned from the external source.
+
+ expression must be at least 1 character and must not exceed 1024 characters in length.
+ maxLength: 1024
+ minLength: 1
+ type: string
+ name:
+ description: |-
+ name is a required name of the claim that
+ will be produced and made available during
+ the claim-to-identity mapping process.
+ name must consist of only lowercase alpha characters and underscores ('_').
+ name must be at least 1 character and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must consist of only lowercase alpha
+ characters and underscores
+ rule: self.matches('^[a-z_]+$')
+ required:
+ - expression
+ - name
+ type: object
+ maxItems: 16
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ predicates:
+ description: |-
+ predicates is an optional list of constraints in
+ which claims should attempt to be fetched from this
+ external source.
+
+ When omitted, claims are always fetched
+ from this external source.
+
+ When specified, all predicates must evaluate to 'true'
+ before claims are attempted to be fetched from this external source.
+ predicates must have at least 1 entry and must not exceed 16 entries.
+ Entries must have unique expressions.
+ items:
+ description: |-
+ ExternalSourcePredicate configures a singular condition
+ that must return true before the external source is queried
+ to retrieve external claims.
+ properties:
+ expression:
+ description: |-
+ expression is a required CEL expression that
+ is used to determine whether or not an external
+ source should be used to fetch external claims.
+
+ The expression must return a boolean value,
+ where true means that the source should be consulted
+ and false means that it should not.
+
+ Claims from the token used for the request to the kube-apiserver
+ are made available via the `claims` variable.
+
+ The contents of the `claims` variable varies based on the claims that are
+ present in the token being validated. It is the responsibility of those configuring this
+ field to understand what claims the identity provider includes when issuing tokens.
+
+ expression must be at least 1 character and must not exceed 1024 characters in length.
+ maxLength: 1024
+ minLength: 1
+ type: string
+ required:
+ - expression
+ type: object
+ maxItems: 16
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - expression
+ x-kubernetes-list-type: map
+ tls:
+ description: |-
+ tls is an optional field that configures the http client TLS
+ settings when fetching external claims from this source.
+
+ When omitted, system default TLS settings will be used
+ for fetching claims from the external source.
+ properties:
+ certificateAuthority:
+ description: |-
+ certificateAuthority is a required reference to a ConfigMap in the openshift-config
+ namespace that contains the CA certificate to use to validate TLS connections with the external claims source.
+ The key "ca-bundle.crt" must be present in the referenced ConfigMap and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+ properties:
+ name:
+ description: |-
+ name is the required name of the ConfigMap that exists in the openshift-config namespace.
+ The key "ca-bundle.crt" must be present and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+
+ It must be at least 1 character in length, must not exceed 253 characters in length,
+ must start and end with a lowercase alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or '.'.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must start and end with a lowercase
+ alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or
+ '.'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ required:
+ - certificateAuthority
+ type: object
+ url:
+ description: |-
+ url is a required configuration of the URL
+ for which the external claims are located.
+ properties:
+ hostname:
+ description: |-
+ hostname is a required hostname for which the external claims are located.
+
+ It must be a valid DNS subdomain name as per RFC1123.
+
+ This means that it must start and end with a lowercase alphanumeric character,
+ must only consist of lowercase alphanumeric characters, '-', and '.'.
+ hostname may optionally specify a port in the format ':{port}'.
+ If a port is specified it must not exceed 65535.
+
+ hostname must be at least 1 character in length.
+ When specifying a port, hostname must not exceed 259 characters in length.
+ When not specifying a port, hostname must not exceed 253 characters in length.
+ maxLength: 259
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid hostname
+ rule: isURL('https://'+self)
+ - message: hostname before port must start and end
+ with a lowercase alphanumeric character, and must
+ only contain lowercase alphanumeric characters,
+ '-' or '.'
+ rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()'
+ - message: port must not exceed 65535
+ rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1])
+ <= 65535 : true'
+ pathExpression:
+ description: |-
+ pathExpression is a required CEL expression that returns a list
+ of string values used to construct the URL path.
+ Claims from the token used for the request to the kube-apiserver
+ are made available via the `claims` variable.
+ expression must be at least 1 character in length and must not exceed 1024 characters in length.
+
+ Values in the returned list will be joined with the hostname using a forward slash
+ (`/`) as a separator. Values in the returned list do not need to include the forward slash.
+ If a forward slash is included in a returned value, it will be encoded as `%2F`.
+
+ Example of a static path configuration:
+
+ pathExpression: ['realms', 'k8s', 'protocol', 'openid-connect', 'userinfo']
+
+ The above example would resolve to the path: '/realms/k8s/protocol/openid-connect/userinfo'
+
+ Example of a dynamic path configuration:
+
+ pathExpression: "['admin', 'realms', 'k8s', 'users'] + [claims.sub] + ['groups']"
+
+ Assuming 'claims.sub' is set to '12345', the above example would resolve to the path: '/admin/realms/k8s/users/12345/groups'
+ maxLength: 1024
+ minLength: 1
+ type: string
+ required:
+ - hostname
+ - pathExpression
+ type: object
+ required:
+ - mappings
+ - url
+ type: object
+ maxItems: 5
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: mapping names must be unique across all external
+ claim sources.
+ rule: self.all(s, s.mappings.all(m, self.filter(s2, s2.mappings.exists(m2,
+ m2.name == m.name)).size() == 1))
issuer:
description: issuer is a required field that configures how
the platform interacts with the identity provider and how
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml
index 5b5956b1f..dcfe61e69 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml
@@ -199,7 +199,8 @@ spec:
description: |-
prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.
- When omitted (""), no prefix is applied to the cluster identity attribute.
+ When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute.
+ Must not be set to a non-empty value when expression is set.
Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c".
type: string
@@ -288,11 +289,9 @@ spec:
Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim.
-
The prefix field must be set when prefixPolicy is 'Prefix'.
-
+ Must not be set to 'Prefix' when expression is set.
When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim.
-
When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time.
Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'.
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml
index 9da4945a7..d883307d8 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml
@@ -212,12 +212,18 @@ spec:
description: |-
prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.
- When omitted (""), no prefix is applied to the cluster identity attribute.
+ When omitted or set to an empty string (""), no prefix is applied to the cluster identity attribute.
+ Must not be set to a non-empty value when expression is set.
Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c".
type: string
type: object
x-kubernetes-validations:
+ - message: prefix must not be set to a non-empty value when
+ expression is set
+ rule: 'has(self.expression) && size(self.expression) >
+ 0 ? (!has(self.prefix) || size(self.prefix) == 0) :
+ true'
- message: expression must not be set if claim is specified
and is not an empty string
rule: '(size(self.?claim.orValue("")) > 0) ? !has(self.expression)
@@ -316,11 +322,9 @@ spec:
Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
When set to 'Prefix', the value specified in the prefix field will be prepended to the value of the JWT claim.
-
The prefix field must be set when prefixPolicy is 'Prefix'.
-
+ Must not be set to 'Prefix' when expression is set.
When set to 'NoPrefix', no prefix will be prepended to the value of the JWT claim.
-
When omitted, this means no opinion and the platform is left to choose any prefixes that are applied which is subject to change over time.
Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim when the claim is not 'email'.
@@ -341,6 +345,11 @@ spec:
- message: precisely one of claim or expression must be
set
rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
+ - message: prefixPolicy must not be set to 'Prefix' when
+ expression is set
+ rule: 'has(self.expression) && size(self.expression) >
+ 0 ? !has(self.prefixPolicy) || self.prefixPolicy !=
+ ''Prefix'' : true'
- message: prefix must be set if prefixPolicy is 'Prefix',
but must remain unset otherwise
rule: 'has(self.prefixPolicy) && self.prefixPolicy ==
@@ -437,6 +446,434 @@ spec:
? has(self.requiredClaim) : !has(self.requiredClaim)'
type: array
x-kubernetes-list-type: atomic
+ externalClaimsSources:
+ description: |-
+ externalClaimsSources is an optional field that can be used to configure
+ sources, external to the token provided in a request, in which claims
+ should be fetched from and made available to the claim mapping process
+ that is used to build the identity of a token holder.
+
+ For example, fetching additional user metadata from an OIDC provider's UserInfo endpoint.
+
+ When not specified, only claims present in the token itself will be available
+ in the claim mapping process.
+
+ When specified, at least one external claim source must be specified and no more than 5
+ sources may be specified.
+ All external claim sources must have unique claim mappings.
+ When an external source responds and resolves additional claims successfully, they will
+ be made available as claims during the claim mapping process.
+ Externally sourced claims with the same name as a claim existing within the token will
+ overwrite the claim data from the token with the externally sourced information.
+ If an external source does not respond, responds with an error, or the additional
+ claim data cannot be resolved from the response successfully it will not be
+ included in the claim data passed to the claim mapping process.
+ items:
+ description: ExternalClaimsSource provides the configuration
+ for a single external claim source.
+ properties:
+ authentication:
+ description: |-
+ authentication is an optional field that configures how the apiserver authenticates with an external claims source.
+ When not specified, anonymous authentication is used which means no 'Authorization' header
+ is sent in the HTTP request to fetch the external claims.
+ properties:
+ clientCredential:
+ description: |-
+ clientCredential configures the client credentials
+ and token endpoint to use to get an access token.
+ clientCredential is required when type is 'ClientCredential', and forbidden otherwise.
+ properties:
+ clientID:
+ description: |-
+ clientID is a required client identifier to use during the OAuth2 client credentials flow.
+ clientID must be at least 1 character in length, must not exceed 256 characters in length,
+ and must only contain printable ASCII characters.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: clientID must only contain printable
+ ASCII characters
+ rule: self.matches('^[[:print:]]+$')
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to a Secret in the openshift-config namespace to be used
+ as the client secret during the OAuth2 client credentials flow.
+
+ The key 'client-secret' is used to locate the client secret data in the Secret.
+ properties:
+ name:
+ description: |-
+ name is the required name of the Secret that exists in the openshift-config namespace.
+
+ It must be at least 1 character in length, must not exceed 253 characters in length,
+ must start and end with a lowercase alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or '.'.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must start and end with a
+ lowercase alphanumeric character, and
+ must only contain lowercase alphanumeric
+ characters, '-' or '.'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ scopes:
+ description: |-
+ scopes is an optional list of OAuth2 scopes to request when obtaining
+ an access token.
+
+ If not specified, the token endpoint's default scopes
+ will be used.
+
+ When specified, there must be at least 1 entry and must not exceed 16 entries.
+ Each entry must be at least 1 character in length and must not exceed 256 characters in length.
+ Each entry must only contain printable ASCII characters, excluding spaces, double quotes and backslashes.
+ Entries must be unique.
+ items:
+ description: |-
+ OAuth2Scope is a string alias that represents an OAuth2 Scope as defined by https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.4
+ Must be at least 1 character in length, must not exceed 256 characters in length and must only contain printable ASCII characters, excluding spaces, double quotes and backslashes.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: scopes must only contain printable
+ ASCII characters excluding spaces, double
+ quotes and backslashes
+ rule: self.matches('^[!#-[\\]-~]+$')
+ maxItems: 16
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ tls:
+ description: |-
+ tls is an optional field that allows configuring the TLS
+ settings used to interact with the identity provider
+ as an OAuth2 client.
+
+ When omitted, system default TLS settings will be used
+ for the OAuth2 client.
+ properties:
+ certificateAuthority:
+ description: |-
+ certificateAuthority is a required reference to a ConfigMap in the openshift-config
+ namespace that contains the CA certificate to use to validate TLS connections with the external claims source.
+ The key "ca-bundle.crt" must be present in the referenced ConfigMap and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+ properties:
+ name:
+ description: |-
+ name is the required name of the ConfigMap that exists in the openshift-config namespace.
+ The key "ca-bundle.crt" must be present and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+
+ It must be at least 1 character in length, must not exceed 253 characters in length,
+ must start and end with a lowercase alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or '.'.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must start and end with
+ a lowercase alphanumeric character,
+ and must only contain lowercase alphanumeric
+ characters, '-' or '.'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ required:
+ - certificateAuthority
+ type: object
+ tokenEndpoint:
+ description: |-
+ tokenEndpoint is a required URL to query for an access token using
+ the client credential OAuth2 flow.
+ tokenEndpoint must be at least 1 character in length and must not exceed 2048 characters in length.
+ tokenEndpoint must be a valid HTTPS URL.
+ tokenEndpoint must have a host and a path.
+ tokenEndpoint must not contain query parameters, fragments,
+ or user information (e.g., "user:password@host").
+ maxLength: 2048
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: tokenEndpoint must be a valid HTTPS
+ url
+ rule: isURL(self)
+ - message: tokenEndpoint must be a valid HTTPS
+ url
+ rule: isURL(self) && url(self).getScheme() ==
+ 'https'
+ - message: tokenEndpoint must have a hostname
+ rule: isURL(self) && url(self).getHost() !=
+ ''
+ - message: tokenEndpoint must have a path
+ rule: isURL(self) && url(self).getEscapedPath()
+ != ''
+ - message: tokenEndpoint must not have query parameters
+ rule: isURL(self) && url(self).getQuery() ==
+ {}
+ - message: tokenEndpoint must not have a fragment
+ rule: isURL(self) && self.find('#(.+)$') ==
+ ''
+ - message: tokenEndpoint must not have user info
+ rule: isURL(self) && !self.matches('^https://[^/]+@.+$')
+ required:
+ - clientID
+ - clientSecret
+ - tokenEndpoint
+ type: object
+ type:
+ description: |-
+ type is a required field that sets the type of
+ authentication method used by the authenticator
+ when fetching external claims.
+
+ Allowed values are 'RequestProvidedToken' and 'ClientCredential'.
+
+ When set to 'RequestProvidedToken', the authenticator will
+ use the token provided to the kube-apiserver as part of the
+ request to authenticate with the external claims source.
+
+ When set to 'ClientCredential', the authenticator will
+ use the configured client-id, client-secret, and token endpoint
+ to fetch an access token using the OAuth2 client credentials grant
+ flow. The fetched access token will then be used to authenticate
+ with the external claims source.
+ enum:
+ - RequestProvidedToken
+ - ClientCredential
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: clientCredential is required when type is ClientCredential,
+ and forbidden otherwise
+ rule: 'self.type == ''ClientCredential'' ? has(self.clientCredential)
+ : !has(self.clientCredential)'
+ mappings:
+ description: |-
+ mappings is a required list of the claim
+ and response handling expression pairs
+ that produces the claims from the external source.
+ mappings must have at least 1 entry and must not exceed 16 entries.
+ Entries must have a unique name across all external claim sources.
+ items:
+ description: |-
+ SourcedClaimMapping configures the mapping behavior for a single external claim
+ from the response the apiserver received from the external claim source.
+ properties:
+ expression:
+ description: |-
+ expression is a required CEL expression that
+ will produce a value to be assigned to the claim.
+ The full response body from the request to the
+ external claim source is provided via the
+ `response.body` variable.
+
+ The contents of the `response.body` variable varies based on the response received
+ from the external source. It is the responsibility of those configuring
+ this expression to understand what is returned from the external source.
+
+ expression must be at least 1 character and must not exceed 1024 characters in length.
+ maxLength: 1024
+ minLength: 1
+ type: string
+ name:
+ description: |-
+ name is a required name of the claim that
+ will be produced and made available during
+ the claim-to-identity mapping process.
+ name must consist of only lowercase alpha characters and underscores ('_').
+ name must be at least 1 character and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must consist of only lowercase alpha
+ characters and underscores
+ rule: self.matches('^[a-z_]+$')
+ required:
+ - expression
+ - name
+ type: object
+ maxItems: 16
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ predicates:
+ description: |-
+ predicates is an optional list of constraints in
+ which claims should attempt to be fetched from this
+ external source.
+
+ When omitted, claims are always fetched
+ from this external source.
+
+ When specified, all predicates must evaluate to 'true'
+ before claims are attempted to be fetched from this external source.
+ predicates must have at least 1 entry and must not exceed 16 entries.
+ Entries must have unique expressions.
+ items:
+ description: |-
+ ExternalSourcePredicate configures a singular condition
+ that must return true before the external source is queried
+ to retrieve external claims.
+ properties:
+ expression:
+ description: |-
+ expression is a required CEL expression that
+ is used to determine whether or not an external
+ source should be used to fetch external claims.
+
+ The expression must return a boolean value,
+ where true means that the source should be consulted
+ and false means that it should not.
+
+ Claims from the token used for the request to the kube-apiserver
+ are made available via the `claims` variable.
+
+ The contents of the `claims` variable varies based on the claims that are
+ present in the token being validated. It is the responsibility of those configuring this
+ field to understand what claims the identity provider includes when issuing tokens.
+
+ expression must be at least 1 character and must not exceed 1024 characters in length.
+ maxLength: 1024
+ minLength: 1
+ type: string
+ required:
+ - expression
+ type: object
+ maxItems: 16
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - expression
+ x-kubernetes-list-type: map
+ tls:
+ description: |-
+ tls is an optional field that configures the http client TLS
+ settings when fetching external claims from this source.
+
+ When omitted, system default TLS settings will be used
+ for fetching claims from the external source.
+ properties:
+ certificateAuthority:
+ description: |-
+ certificateAuthority is a required reference to a ConfigMap in the openshift-config
+ namespace that contains the CA certificate to use to validate TLS connections with the external claims source.
+ The key "ca-bundle.crt" must be present in the referenced ConfigMap and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+ properties:
+ name:
+ description: |-
+ name is the required name of the ConfigMap that exists in the openshift-config namespace.
+ The key "ca-bundle.crt" must be present and must contain the CA certificate to be used
+ to verify the external source's TLS certificate.
+
+ It must be at least 1 character in length, must not exceed 253 characters in length,
+ must start and end with a lowercase alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or '.'.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: name must start and end with a lowercase
+ alphanumeric character, and must only contain
+ lowercase alphanumeric characters, '-' or
+ '.'
+ rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+ required:
+ - name
+ type: object
+ required:
+ - certificateAuthority
+ type: object
+ url:
+ description: |-
+ url is a required configuration of the URL
+ for which the external claims are located.
+ properties:
+ hostname:
+ description: |-
+ hostname is a required hostname for which the external claims are located.
+
+ It must be a valid DNS subdomain name as per RFC1123.
+
+ This means that it must start and end with a lowercase alphanumeric character,
+ must only consist of lowercase alphanumeric characters, '-', and '.'.
+ hostname may optionally specify a port in the format ':{port}'.
+ If a port is specified it must not exceed 65535.
+
+ hostname must be at least 1 character in length.
+ When specifying a port, hostname must not exceed 259 characters in length.
+ When not specifying a port, hostname must not exceed 253 characters in length.
+ maxLength: 259
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid hostname
+ rule: isURL('https://'+self)
+ - message: hostname before port must start and end
+ with a lowercase alphanumeric character, and must
+ only contain lowercase alphanumeric characters,
+ '-' or '.'
+ rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()'
+ - message: port must not exceed 65535
+ rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1])
+ <= 65535 : true'
+ pathExpression:
+ description: |-
+ pathExpression is a required CEL expression that returns a list
+ of string values used to construct the URL path.
+ Claims from the token used for the request to the kube-apiserver
+ are made available via the `claims` variable.
+ expression must be at least 1 character in length and must not exceed 1024 characters in length.
+
+ Values in the returned list will be joined with the hostname using a forward slash
+ (`/`) as a separator. Values in the returned list do not need to include the forward slash.
+ If a forward slash is included in a returned value, it will be encoded as `%2F`.
+
+ Example of a static path configuration:
+
+ pathExpression: ['realms', 'k8s', 'protocol', 'openid-connect', 'userinfo']
+
+ The above example would resolve to the path: '/realms/k8s/protocol/openid-connect/userinfo'
+
+ Example of a dynamic path configuration:
+
+ pathExpression: "['admin', 'realms', 'k8s', 'users'] + [claims.sub] + ['groups']"
+
+ Assuming 'claims.sub' is set to '12345', the above example would resolve to the path: '/admin/realms/k8s/users/12345/groups'
+ maxLength: 1024
+ minLength: 1
+ type: string
+ required:
+ - hostname
+ - pathExpression
+ type: object
+ required:
+ - mappings
+ - url
+ type: object
+ maxItems: 5
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: mapping names must be unique across all external
+ claim sources.
+ rule: self.all(s, s.mappings.all(m, self.filter(s2, s2.mappings.exists(m2,
+ m2.name == m.name)).size() == 1))
issuer:
description: issuer is a required field that configures how
the platform interacts with the identity provider and how
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs.crd.yaml
new file mode 100644
index 000000000..7a720440a
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs.crd.yaml
@@ -0,0 +1,409 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/2725
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: CustomNoUpgrade,DevPreviewNoUpgrade,TechPreviewNoUpgrade
+ name: criocredentialproviderconfigs.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: CRIOCredentialProviderConfig
+ listKind: CRIOCredentialProviderConfigList
+ plural: criocredentialproviderconfigs
+ singular: criocredentialproviderconfig
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is "cluster". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources.
+ For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in.
+ CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation.
+ Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout.
+
+ The resource is a singleton named "cluster".
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: |-
+ spec defines the desired configuration of the CRI-O Credential Provider.
+ This field is required and must be provided when creating the resource.
+ minProperties: 0
+ properties:
+ matchImages:
+ description: |-
+ matchImages is a list of string patterns used to determine whether
+ the CRI-O credential provider should be invoked for a given image. This list is
+ passed to the kubelet CredentialProviderConfig, and if any pattern matches
+ the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling
+ that image or its mirrors.
+ Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider.
+ Conflicts between the existing platform specific provider image match configuration and this list will be handled by
+ the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those
+ from the CRIOCredentialProviderConfig when both match the same image.
+ To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with
+ existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml).
+ You can check the resource's Status conditions
+ to see if any entries were ignored due to exact matches with known built-in provider patterns.
+
+ This field is optional, the items of the list must contain between 1 and 50 entries.
+ The list is treated as a set, so duplicate entries are not allowed.
+
+ For more details, see:
+ https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/
+ https://github.com/cri-o/crio-credential-provider#architecture
+
+ Each entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters.
+ Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io',
+ and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net').
+ A global wildcard '*' (matching any domain) is not allowed.
+ Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path.
+ For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not.
+ Each wildcard matches only a single domain label,
+ so '*.io' does **not** match '*.k8s.io'.
+
+ A match exists between an image and a matchImage when all of the below are true:
+ Both contain the same number of domain parts and each part matches.
+ The URL path of an matchImages must be a prefix of the target image URL path.
+ If the matchImages contains a port, then the port must match in the image as well.
+
+ Example values of matchImages:
+ - 123456789.dkr.ecr.us-east-1.amazonaws.com
+ - *.azurecr.io
+ - gcr.io
+ - *.*.registry.io
+ - registry.io:8080/path
+ items:
+ description: |-
+ MatchImage is a string pattern used to match container image registry addresses.
+ It must be a valid fully qualified domain name with optional wildcard, port, and path.
+ The maximum length is 512 characters.
+
+ Wildcards ('*') are supported for full subdomain labels and top-level domains.
+ Each entry can optionally contain a port (e.g., :8080) and a path (e.g., /path).
+ Wildcards are not allowed in the port or path portions.
+
+ Examples:
+ - "registry.io" - matches exactly registry.io
+ - "*.azurecr.io" - matches any single subdomain of azurecr.io
+ - "registry.io:8080/path" - matches with specific port and path prefix
+ maxLength: 512
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: global wildcard '*' is not allowed
+ rule: self != '*'
+ - message: invalid matchImages value, must be a valid fully qualified
+ domain name in lowercase with optional wildcard, port, and path
+ rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$')
+ maxItems: 50
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ status:
+ description: |-
+ status represents the current state of the CRIOCredentialProviderConfig.
+ When omitted or nil, it indicates that the status has not yet been set by the controller.
+ The controller will populate this field with validation conditions and operational state.
+ minProperties: 1
+ properties:
+ conditions:
+ description: |-
+ conditions represent the latest available observations of the configuration state.
+ When omitted, it indicates that no conditions have been reported yet.
+ The maximum number of conditions is 16.
+ Conditions are stored as a map keyed by condition type, ensuring uniqueness.
+
+ Expected condition types include:
+ "Validated": indicates whether the matchImages configuration is valid
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 16
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ type: object
+ required:
+ - spec
+ type: object
+ x-kubernetes-validations:
+ - message: criocredentialproviderconfig is a singleton, .metadata.name must
+ be 'cluster'
+ rule: self.metadata.name == 'cluster'
+ served: true
+ storage: false
+ subresources:
+ status: {}
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is "cluster". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources.
+ For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in.
+ CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation.
+ Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout.
+
+ The resource is a singleton named "cluster".
+
+ Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: |-
+ spec defines the desired configuration of the CRI-O Credential Provider.
+ This field is required and must be provided when creating the resource.
+ minProperties: 0
+ properties:
+ matchImages:
+ description: |-
+ matchImages is a list of string patterns used to determine whether
+ the CRI-O credential provider should be invoked for a given image. This list is
+ passed to the kubelet CredentialProviderConfig, and if any pattern matches
+ the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling
+ that image or its mirrors.
+ Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider.
+ Conflicts between the existing platform specific provider image match configuration and this list will be handled by
+ the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those
+ from the CRIOCredentialProviderConfig when both match the same image.
+ To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with
+ existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml).
+ You can check the resource's Status conditions
+ to see if any entries were ignored due to exact matches with known built-in provider patterns.
+
+ This field is optional, the items of the list must contain between 1 and 50 entries.
+ The list is treated as a set, so duplicate entries are not allowed.
+
+ For more details, see:
+ https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/
+ https://github.com/cri-o/crio-credential-provider#architecture
+
+ Each entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters.
+ Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io',
+ and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net').
+ A global wildcard '*' (matching any domain) is not allowed.
+ Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path.
+ For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not.
+ Each wildcard matches only a single domain label,
+ so '*.io' does **not** match '*.k8s.io'.
+
+ A match exists between an image and a matchImage when all of the below are true:
+ Both contain the same number of domain parts and each part matches.
+ The URL path of an matchImages must be a prefix of the target image URL path.
+ If the matchImages contains a port, then the port must match in the image as well.
+
+ Example values of matchImages:
+ - 123456789.dkr.ecr.us-east-1.amazonaws.com
+ - *.azurecr.io
+ - gcr.io
+ - *.*.registry.io
+ - registry.io:8080/path
+ items:
+ description: |-
+ MatchImage is a string pattern used to match container image registry addresses.
+ It must be a valid fully qualified domain name with optional wildcard, port, and path.
+ The maximum length is 512 characters.
+
+ Wildcards ('*') are supported for full subdomain labels and top-level domains.
+ Each entry can optionally contain a port (e.g., :8080) and a path (e.g., /path).
+ Wildcards are not allowed in the port or path portions.
+
+ Examples:
+ - "registry.io" - matches exactly registry.io
+ - "*.azurecr.io" - matches any single subdomain of azurecr.io
+ - "registry.io:8080/path" - matches with specific port and path prefix
+ maxLength: 512
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: global wildcard '*' is not allowed
+ rule: self != '*'
+ - message: invalid matchImages value, must be a valid fully qualified
+ domain name in lowercase with optional wildcard, port, and path
+ rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$')
+ maxItems: 50
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ status:
+ description: |-
+ status represents the current state of the CRIOCredentialProviderConfig.
+ When omitted or nil, it indicates that the status has not yet been set by the controller.
+ The controller will populate this field with validation conditions and operational state.
+ minProperties: 1
+ properties:
+ conditions:
+ description: |-
+ conditions represent the latest available observations of the configuration state.
+ When omitted, it indicates that no conditions have been reported yet.
+ The maximum number of conditions is 16.
+ Conditions are stored as a map keyed by condition type, ensuring uniqueness.
+
+ Expected condition types include:
+ "Validated": indicates whether the matchImages configuration is valid
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 16
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ type: object
+ required:
+ - spec
+ type: object
+ x-kubernetes-validations:
+ - message: criocredentialproviderconfig is a singleton, .metadata.name must
+ be 'cluster'
+ rule: self.metadata.name == 'cluster'
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-CustomNoUpgrade.crd.yaml
new file mode 100644
index 000000000..05d56f63c
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-CustomNoUpgrade.crd.yaml
@@ -0,0 +1,198 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: CustomNoUpgrade
+ name: dnses.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: DNS
+ listKind: DNSList
+ plural: dnses
+ singular: dns
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ DNS holds cluster-wide information about DNS. The canonical name is `cluster`
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ baseDomain:
+ description: |-
+ baseDomain is the base domain of the cluster. All managed DNS records will
+ be sub-domains of this base.
+
+ For example, given the base domain `openshift.example.com`, an API server
+ DNS record may be created for `cluster-api.openshift.example.com`.
+
+ Once set, this field cannot be changed.
+ type: string
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for DNS.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains DNS configuration specific to the Amazon
+ Web Services cloud provider.
+ properties:
+ privateZoneIAMRole:
+ description: |-
+ privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
+ operations on the cluster's private hosted zone specified in the cluster DNS config.
+ When left empty, no role should be assumed.
+
+ The ARN must follow the format: arn::iam:::role/, where:
+ is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc),
+ is a 12-digit numeric identifier for the AWS account,
+ is the IAM role name.
+ type: string
+ x-kubernetes-validations:
+ - message: 'privateZoneIAMRole must be a valid AWS IAM role
+ ARN in the format: arn::iam:::role/'
+ rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values: "", "AWS".
+
+ Individual components may not support all platforms,
+ and must handle unrecognized platforms with best-effort defaults.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ x-kubernetes-validations:
+ - message: allowed values are '' and 'AWS'
+ rule: self in ['','AWS']
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: aws configuration is required when platform is AWS, and
+ forbidden otherwise
+ rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) :
+ !has(self.aws)'
+ privateZone:
+ description: |-
+ privateZone is the location where all the DNS records that are only available internally
+ to the cluster exist.
+
+ If this field is nil, no private records should be created.
+
+ Once set, this field cannot be changed.
+ properties:
+ id:
+ description: |-
+ id is the identifier that can be used to find the DNS hosted zone.
+
+ on AWS zone can be fetched using `ID` as id in [1]
+ on Azure zone can be fetched using `ID` as a pre-determined name in [2],
+ on GCP zone can be fetched using `ID` as a pre-determined name in [3].
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
+ [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
+ [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: |-
+ tags can be used to query the DNS hosted zone.
+
+ on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
+ type: object
+ type: object
+ publicZone:
+ description: |-
+ publicZone is the location where all the DNS records that are publicly accessible to
+ the internet exist.
+
+ If this field is nil, no public records should be created.
+
+ Once set, this field cannot be changed.
+ properties:
+ id:
+ description: |-
+ id is the identifier that can be used to find the DNS hosted zone.
+
+ on AWS zone can be fetched using `ID` as id in [1]
+ on Azure zone can be fetched using `ID` as a pre-determined name in [2],
+ on GCP zone can be fetched using `ID` as a pre-determined name in [3].
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
+ [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
+ [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: |-
+ tags can be used to query the DNS hosted zone.
+
+ on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
+ type: object
+ type: object
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-Default.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-Default.crd.yaml
new file mode 100644
index 000000000..93954dcc3
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-Default.crd.yaml
@@ -0,0 +1,198 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: Default
+ name: dnses.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: DNS
+ listKind: DNSList
+ plural: dnses
+ singular: dns
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ DNS holds cluster-wide information about DNS. The canonical name is `cluster`
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ baseDomain:
+ description: |-
+ baseDomain is the base domain of the cluster. All managed DNS records will
+ be sub-domains of this base.
+
+ For example, given the base domain `openshift.example.com`, an API server
+ DNS record may be created for `cluster-api.openshift.example.com`.
+
+ Once set, this field cannot be changed.
+ type: string
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for DNS.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains DNS configuration specific to the Amazon
+ Web Services cloud provider.
+ properties:
+ privateZoneIAMRole:
+ description: |-
+ privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
+ operations on the cluster's private hosted zone specified in the cluster DNS config.
+ When left empty, no role should be assumed.
+
+ The ARN must follow the format: arn::iam:::role/, where:
+ is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc),
+ is a 12-digit numeric identifier for the AWS account,
+ is the IAM role name.
+ type: string
+ x-kubernetes-validations:
+ - message: 'privateZoneIAMRole must be a valid AWS IAM role
+ ARN in the format: arn::iam:::role/'
+ rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values: "", "AWS".
+
+ Individual components may not support all platforms,
+ and must handle unrecognized platforms with best-effort defaults.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ x-kubernetes-validations:
+ - message: allowed values are '' and 'AWS'
+ rule: self in ['','AWS']
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: aws configuration is required when platform is AWS, and
+ forbidden otherwise
+ rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) :
+ !has(self.aws)'
+ privateZone:
+ description: |-
+ privateZone is the location where all the DNS records that are only available internally
+ to the cluster exist.
+
+ If this field is nil, no private records should be created.
+
+ Once set, this field cannot be changed.
+ properties:
+ id:
+ description: |-
+ id is the identifier that can be used to find the DNS hosted zone.
+
+ on AWS zone can be fetched using `ID` as id in [1]
+ on Azure zone can be fetched using `ID` as a pre-determined name in [2],
+ on GCP zone can be fetched using `ID` as a pre-determined name in [3].
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
+ [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
+ [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: |-
+ tags can be used to query the DNS hosted zone.
+
+ on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
+ type: object
+ type: object
+ publicZone:
+ description: |-
+ publicZone is the location where all the DNS records that are publicly accessible to
+ the internet exist.
+
+ If this field is nil, no public records should be created.
+
+ Once set, this field cannot be changed.
+ properties:
+ id:
+ description: |-
+ id is the identifier that can be used to find the DNS hosted zone.
+
+ on AWS zone can be fetched using `ID` as id in [1]
+ on Azure zone can be fetched using `ID` as a pre-determined name in [2],
+ on GCP zone can be fetched using `ID` as a pre-determined name in [3].
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
+ [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
+ [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: |-
+ tags can be used to query the DNS hosted zone.
+
+ on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
+ type: object
+ type: object
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-DevPreviewNoUpgrade.crd.yaml
new file mode 100644
index 000000000..f2d915771
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-DevPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,198 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: DevPreviewNoUpgrade
+ name: dnses.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: DNS
+ listKind: DNSList
+ plural: dnses
+ singular: dns
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ DNS holds cluster-wide information about DNS. The canonical name is `cluster`
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ baseDomain:
+ description: |-
+ baseDomain is the base domain of the cluster. All managed DNS records will
+ be sub-domains of this base.
+
+ For example, given the base domain `openshift.example.com`, an API server
+ DNS record may be created for `cluster-api.openshift.example.com`.
+
+ Once set, this field cannot be changed.
+ type: string
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for DNS.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains DNS configuration specific to the Amazon
+ Web Services cloud provider.
+ properties:
+ privateZoneIAMRole:
+ description: |-
+ privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
+ operations on the cluster's private hosted zone specified in the cluster DNS config.
+ When left empty, no role should be assumed.
+
+ The ARN must follow the format: arn::iam:::role/, where:
+ is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc),
+ is a 12-digit numeric identifier for the AWS account,
+ is the IAM role name.
+ type: string
+ x-kubernetes-validations:
+ - message: 'privateZoneIAMRole must be a valid AWS IAM role
+ ARN in the format: arn::iam:::role/'
+ rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values: "", "AWS".
+
+ Individual components may not support all platforms,
+ and must handle unrecognized platforms with best-effort defaults.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ x-kubernetes-validations:
+ - message: allowed values are '' and 'AWS'
+ rule: self in ['','AWS']
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: aws configuration is required when platform is AWS, and
+ forbidden otherwise
+ rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) :
+ !has(self.aws)'
+ privateZone:
+ description: |-
+ privateZone is the location where all the DNS records that are only available internally
+ to the cluster exist.
+
+ If this field is nil, no private records should be created.
+
+ Once set, this field cannot be changed.
+ properties:
+ id:
+ description: |-
+ id is the identifier that can be used to find the DNS hosted zone.
+
+ on AWS zone can be fetched using `ID` as id in [1]
+ on Azure zone can be fetched using `ID` as a pre-determined name in [2],
+ on GCP zone can be fetched using `ID` as a pre-determined name in [3].
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
+ [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
+ [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: |-
+ tags can be used to query the DNS hosted zone.
+
+ on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
+ type: object
+ type: object
+ publicZone:
+ description: |-
+ publicZone is the location where all the DNS records that are publicly accessible to
+ the internet exist.
+
+ If this field is nil, no public records should be created.
+
+ Once set, this field cannot be changed.
+ properties:
+ id:
+ description: |-
+ id is the identifier that can be used to find the DNS hosted zone.
+
+ on AWS zone can be fetched using `ID` as id in [1]
+ on Azure zone can be fetched using `ID` as a pre-determined name in [2],
+ on GCP zone can be fetched using `ID` as a pre-determined name in [3].
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
+ [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
+ [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: |-
+ tags can be used to query the DNS hosted zone.
+
+ on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
+ type: object
+ type: object
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-OKD.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-OKD.crd.yaml
new file mode 100644
index 000000000..0631512bc
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-OKD.crd.yaml
@@ -0,0 +1,198 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: OKD
+ name: dnses.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: DNS
+ listKind: DNSList
+ plural: dnses
+ singular: dns
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ DNS holds cluster-wide information about DNS. The canonical name is `cluster`
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ baseDomain:
+ description: |-
+ baseDomain is the base domain of the cluster. All managed DNS records will
+ be sub-domains of this base.
+
+ For example, given the base domain `openshift.example.com`, an API server
+ DNS record may be created for `cluster-api.openshift.example.com`.
+
+ Once set, this field cannot be changed.
+ type: string
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for DNS.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains DNS configuration specific to the Amazon
+ Web Services cloud provider.
+ properties:
+ privateZoneIAMRole:
+ description: |-
+ privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
+ operations on the cluster's private hosted zone specified in the cluster DNS config.
+ When left empty, no role should be assumed.
+
+ The ARN must follow the format: arn::iam:::role/, where:
+ is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc),
+ is a 12-digit numeric identifier for the AWS account,
+ is the IAM role name.
+ type: string
+ x-kubernetes-validations:
+ - message: 'privateZoneIAMRole must be a valid AWS IAM role
+ ARN in the format: arn::iam:::role/'
+ rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values: "", "AWS".
+
+ Individual components may not support all platforms,
+ and must handle unrecognized platforms with best-effort defaults.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ x-kubernetes-validations:
+ - message: allowed values are '' and 'AWS'
+ rule: self in ['','AWS']
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: aws configuration is required when platform is AWS, and
+ forbidden otherwise
+ rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) :
+ !has(self.aws)'
+ privateZone:
+ description: |-
+ privateZone is the location where all the DNS records that are only available internally
+ to the cluster exist.
+
+ If this field is nil, no private records should be created.
+
+ Once set, this field cannot be changed.
+ properties:
+ id:
+ description: |-
+ id is the identifier that can be used to find the DNS hosted zone.
+
+ on AWS zone can be fetched using `ID` as id in [1]
+ on Azure zone can be fetched using `ID` as a pre-determined name in [2],
+ on GCP zone can be fetched using `ID` as a pre-determined name in [3].
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
+ [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
+ [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: |-
+ tags can be used to query the DNS hosted zone.
+
+ on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
+ type: object
+ type: object
+ publicZone:
+ description: |-
+ publicZone is the location where all the DNS records that are publicly accessible to
+ the internet exist.
+
+ If this field is nil, no public records should be created.
+
+ Once set, this field cannot be changed.
+ properties:
+ id:
+ description: |-
+ id is the identifier that can be used to find the DNS hosted zone.
+
+ on AWS zone can be fetched using `ID` as id in [1]
+ on Azure zone can be fetched using `ID` as a pre-determined name in [2],
+ on GCP zone can be fetched using `ID` as a pre-determined name in [3].
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
+ [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
+ [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: |-
+ tags can be used to query the DNS hosted zone.
+
+ on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
+ type: object
+ type: object
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-TechPreviewNoUpgrade.crd.yaml
new file mode 100644
index 000000000..ce4e9b77f
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-TechPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,198 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: TechPreviewNoUpgrade
+ name: dnses.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: DNS
+ listKind: DNSList
+ plural: dnses
+ singular: dns
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ DNS holds cluster-wide information about DNS. The canonical name is `cluster`
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ baseDomain:
+ description: |-
+ baseDomain is the base domain of the cluster. All managed DNS records will
+ be sub-domains of this base.
+
+ For example, given the base domain `openshift.example.com`, an API server
+ DNS record may be created for `cluster-api.openshift.example.com`.
+
+ Once set, this field cannot be changed.
+ type: string
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for DNS.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains DNS configuration specific to the Amazon
+ Web Services cloud provider.
+ properties:
+ privateZoneIAMRole:
+ description: |-
+ privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
+ operations on the cluster's private hosted zone specified in the cluster DNS config.
+ When left empty, no role should be assumed.
+
+ The ARN must follow the format: arn::iam:::role/, where:
+ is the AWS partition (aws, aws-cn, aws-us-gov, or aws-eusc),
+ is a 12-digit numeric identifier for the AWS account,
+ is the IAM role name.
+ type: string
+ x-kubernetes-validations:
+ - message: 'privateZoneIAMRole must be a valid AWS IAM role
+ ARN in the format: arn::iam:::role/'
+ rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values: "", "AWS".
+
+ Individual components may not support all platforms,
+ and must handle unrecognized platforms with best-effort defaults.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ x-kubernetes-validations:
+ - message: allowed values are '' and 'AWS'
+ rule: self in ['','AWS']
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: aws configuration is required when platform is AWS, and
+ forbidden otherwise
+ rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) :
+ !has(self.aws)'
+ privateZone:
+ description: |-
+ privateZone is the location where all the DNS records that are only available internally
+ to the cluster exist.
+
+ If this field is nil, no private records should be created.
+
+ Once set, this field cannot be changed.
+ properties:
+ id:
+ description: |-
+ id is the identifier that can be used to find the DNS hosted zone.
+
+ on AWS zone can be fetched using `ID` as id in [1]
+ on Azure zone can be fetched using `ID` as a pre-determined name in [2],
+ on GCP zone can be fetched using `ID` as a pre-determined name in [3].
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
+ [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
+ [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: |-
+ tags can be used to query the DNS hosted zone.
+
+ on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
+ type: object
+ type: object
+ publicZone:
+ description: |-
+ publicZone is the location where all the DNS records that are publicly accessible to
+ the internet exist.
+
+ If this field is nil, no public records should be created.
+
+ Once set, this field cannot be changed.
+ properties:
+ id:
+ description: |-
+ id is the identifier that can be used to find the DNS hosted zone.
+
+ on AWS zone can be fetched using `ID` as id in [1]
+ on Azure zone can be fetched using `ID` as a pre-determined name in [2],
+ on GCP zone can be fetched using `ID` as a pre-determined name in [3].
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
+ [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
+ [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: |-
+ tags can be used to query the DNS hosted zone.
+
+ on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
+
+ [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
+ type: object
+ type: object
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses.crd.yaml
deleted file mode 100644
index 06fb0be0b..000000000
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses.crd.yaml
+++ /dev/null
@@ -1,189 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.openshift.io: https://github.com/openshift/api/pull/470
- api.openshift.io/merged-by-featuregates: "true"
- include.release.openshift.io/ibm-cloud-managed: "true"
- include.release.openshift.io/self-managed-high-availability: "true"
- release.openshift.io/bootstrap-required: "true"
- name: dnses.config.openshift.io
-spec:
- group: config.openshift.io
- names:
- kind: DNS
- listKind: DNSList
- plural: dnses
- singular: dns
- scope: Cluster
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- description: |-
- DNS holds cluster-wide information about DNS. The canonical name is `cluster`
-
- Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: spec holds user settable values for configuration
- properties:
- baseDomain:
- description: |-
- baseDomain is the base domain of the cluster. All managed DNS records will
- be sub-domains of this base.
-
- For example, given the base domain `openshift.example.com`, an API server
- DNS record may be created for `cluster-api.openshift.example.com`.
-
- Once set, this field cannot be changed.
- type: string
- platform:
- description: |-
- platform holds configuration specific to the underlying
- infrastructure provider for DNS.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- properties:
- aws:
- description: aws contains DNS configuration specific to the Amazon
- Web Services cloud provider.
- properties:
- privateZoneIAMRole:
- description: |-
- privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
- operations on the cluster's private hosted zone specified in the cluster DNS config.
- When left empty, no role should be assumed.
- pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
- type: string
- type: object
- type:
- description: |-
- type is the underlying infrastructure provider for the cluster.
- Allowed values: "", "AWS".
-
- Individual components may not support all platforms,
- and must handle unrecognized platforms with best-effort defaults.
- enum:
- - ""
- - AWS
- - Azure
- - BareMetal
- - GCP
- - Libvirt
- - OpenStack
- - None
- - VSphere
- - oVirt
- - IBMCloud
- - KubeVirt
- - EquinixMetal
- - PowerVS
- - AlibabaCloud
- - Nutanix
- - External
- type: string
- x-kubernetes-validations:
- - message: allowed values are '' and 'AWS'
- rule: self in ['','AWS']
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: aws configuration is required when platform is AWS, and
- forbidden otherwise
- rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) :
- !has(self.aws)'
- privateZone:
- description: |-
- privateZone is the location where all the DNS records that are only available internally
- to the cluster exist.
-
- If this field is nil, no private records should be created.
-
- Once set, this field cannot be changed.
- properties:
- id:
- description: |-
- id is the identifier that can be used to find the DNS hosted zone.
-
- on AWS zone can be fetched using `ID` as id in [1]
- on Azure zone can be fetched using `ID` as a pre-determined name in [2],
- on GCP zone can be fetched using `ID` as a pre-determined name in [3].
-
- [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
- [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
- [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
- type: string
- tags:
- additionalProperties:
- type: string
- description: |-
- tags can be used to query the DNS hosted zone.
-
- on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
-
- [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
- type: object
- type: object
- publicZone:
- description: |-
- publicZone is the location where all the DNS records that are publicly accessible to
- the internet exist.
-
- If this field is nil, no public records should be created.
-
- Once set, this field cannot be changed.
- properties:
- id:
- description: |-
- id is the identifier that can be used to find the DNS hosted zone.
-
- on AWS zone can be fetched using `ID` as id in [1]
- on Azure zone can be fetched using `ID` as a pre-determined name in [2],
- on GCP zone can be fetched using `ID` as a pre-determined name in [3].
-
- [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options
- [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show
- [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get
- type: string
- tags:
- additionalProperties:
- type: string
- description: |-
- tags can be used to query the DNS hosted zone.
-
- on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters,
-
- [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options
- type: object
- type: object
- type: object
- status:
- description: status holds observed values from the cluster. They may not
- be overridden.
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_images.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_images.crd.yaml
index 52ea2a9a5..815a0de5b 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_images.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_images.crd.yaml
@@ -129,19 +129,45 @@ spec:
allowedRegistries:
description: |-
allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied.
+ Each entry must be a valid registry scope in the format hostname[:port][/path],
+ optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com").
+ The hostname must consist of valid DNS labels separated by dots, where each label
+ contains only alphanumeric characters and hyphens and does not start or end with a hyphen.
+ Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."),
+ and must be at most 256 characters in length. The list may contain at most 1024 entries.
Only one of BlockedRegistries or AllowedRegistries may be set.
items:
+ maxLength: 256
+ minLength: 1
type: string
+ x-kubernetes-validations:
+ - message: each registry must be a valid hostname[:port][/path]
+ or wildcard *.hostname format without tags or digests
+ rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$')
+ maxItems: 1024
type: array
x-kubernetes-list-type: atomic
blockedRegistries:
description: |-
blockedRegistries cannot be used for image pull and push actions. All other registries are permitted.
+ Each entry must be a valid registry scope in the format hostname[:port][/path],
+ optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com").
+ The hostname must consist of valid DNS labels separated by dots, where each label
+ contains only alphanumeric characters and hyphens and does not start or end with a hyphen.
+ Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."),
+ and must be at most 256 characters in length. The list may contain at most 1024 entries.
Only one of BlockedRegistries or AllowedRegistries may be set.
items:
+ maxLength: 256
+ minLength: 1
type: string
+ x-kubernetes-validations:
+ - message: each registry must be a valid hostname[:port][/path]
+ or wildcard *.hostname format without tags or digests
+ rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$')
+ maxItems: 1024
type: array
x-kubernetes-list-type: atomic
containerRuntimeSearchRegistries:
@@ -156,10 +182,23 @@ spec:
type: array
x-kubernetes-list-type: set
insecureRegistries:
- description: insecureRegistries are registries which do not have
- a valid TLS certificates or only support HTTP connections.
+ description: |-
+ insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections.
+ Each entry must be a valid registry scope in the format hostname[:port][/path],
+ optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com").
+ The hostname must consist of valid DNS labels separated by dots, where each label
+ contains only alphanumeric characters and hyphens and does not start or end with a hyphen.
+ Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."),
+ and must be at most 256 characters in length. The list may contain at most 1024 entries.
items:
+ maxLength: 256
+ minLength: 1
type: string
+ x-kubernetes-validations:
+ - message: each registry must be a valid hostname[:port][/path]
+ or wildcard *.hostname format without tags or digests
+ rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$')
+ maxItems: 1024
type: array
x-kubernetes-list-type: atomic
type: object
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-CustomNoUpgrade.crd.yaml
deleted file mode 100644
index 9086d4a57..000000000
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-CustomNoUpgrade.crd.yaml
+++ /dev/null
@@ -1,2770 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.openshift.io: https://github.com/openshift/api/pull/470
- api.openshift.io/merged-by-featuregates: "true"
- include.release.openshift.io/ibm-cloud-managed: "true"
- include.release.openshift.io/self-managed-high-availability: "true"
- release.openshift.io/bootstrap-required: "true"
- release.openshift.io/feature-set: CustomNoUpgrade
- name: infrastructures.config.openshift.io
-spec:
- group: config.openshift.io
- names:
- kind: Infrastructure
- listKind: InfrastructureList
- plural: infrastructures
- singular: infrastructure
- scope: Cluster
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Infrastructure holds cluster-wide information about Infrastructure. The canonical name is `cluster`
-
- Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: spec holds user settable values for configuration
- properties:
- cloudConfig:
- description: |-
- cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file.
- This configuration file is used to configure the Kubernetes cloud provider integration
- when using the built-in cloud provider integration or the external cloud controller manager.
- The namespace for this config map is openshift-config.
-
- cloudConfig should only be consumed by the kube_cloud_config controller.
- The controller is responsible for using the user configuration in the spec
- for various platforms and combining that with the user provided ConfigMap in this field
- to create a stitched kube cloud config.
- The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace
- with the kube cloud config is stored in `cloud.conf` key.
- All the clients are expected to use the generated ConfigMap only.
- properties:
- key:
- description: key allows pointing to a specific key/value inside
- of the configmap. This is useful for logical file references.
- type: string
- name:
- type: string
- type: object
- platformSpec:
- description: |-
- platformSpec holds desired information specific to the underlying
- infrastructure provider.
- properties:
- alibabaCloud:
- description: alibabaCloud contains settings specific to the Alibaba
- Cloud infrastructure provider.
- type: object
- aws:
- description: aws contains settings specific to the Amazon Web
- Services infrastructure provider.
- properties:
- serviceEndpoints:
- description: |-
- serviceEndpoints list contains custom endpoints which will override default
- service endpoint of AWS Services.
- There must be only one ServiceEndpoint for a service.
- items:
- description: |-
- AWSServiceEndpoint store the configuration of a custom url to
- override existing defaults of AWS Services.
- properties:
- name:
- description: |-
- name is the name of the AWS service.
- The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
- This must be provided and cannot be empty.
- pattern: ^[a-z0-9-]+$
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- pattern: ^https://
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- azure:
- description: azure contains settings specific to the Azure infrastructure
- provider.
- type: object
- baremetal:
- description: baremetal contains settings specific to the BareMetal
- platform.
- properties:
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.apiServerInternalIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.ingressIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- machineNetworks:
- description: |-
- machineNetworks are IP networks used to connect all the OpenShift cluster
- nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
- for example "10.0.0.0/8" or "fd00::/8".
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- type: object
- x-kubernetes-validations:
- - message: apiServerInternalIPs list is required once set
- rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
- - message: ingressIPs list is required once set
- rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
- equinixMetal:
- description: equinixMetal contains settings specific to the Equinix
- Metal infrastructure provider.
- type: object
- external:
- description: |-
- ExternalPlatformType represents generic infrastructure provider.
- Platform-specific components should be supplemented separately.
- properties:
- platformName:
- default: Unknown
- description: |-
- platformName holds the arbitrary string representing the infrastructure provider name, expected to be set at the installation time.
- This field is solely for informational and reporting purposes and is not expected to be used for decision-making.
- type: string
- x-kubernetes-validations:
- - message: platform name cannot be changed once set
- rule: oldSelf == 'Unknown' || self == oldSelf
- type: object
- gcp:
- description: gcp contains settings specific to the Google Cloud
- Platform infrastructure provider.
- type: object
- ibmcloud:
- description: ibmcloud contains settings specific to the IBMCloud
- infrastructure provider.
- properties:
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of an IBM service. These endpoints are used by components
- within the cluster when trying to reach the IBM Cloud Services that have been
- overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
- endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
- are updated to reflect the same custom endpoints.
- A maximum of 13 service endpoints overrides are supported.
- items:
- description: |-
- IBMCloudServiceEndpoint stores the configuration of a custom url to
- override existing defaults of IBM Cloud Services.
- properties:
- name:
- description: |-
- name is the name of the IBM Cloud service.
- Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
- For example, the IBM Cloud Private IAM service could be configured with the
- service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
- Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
- with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty. The path must follow the pattern
- /v[0,9]+ or /api/v[0,9]+
- maxLength: 300
- type: string
- x-kubernetes-validations:
- - message: url must use https scheme
- rule: url(self).getScheme() == "https"
- - message: url path must match /v[0,9]+ or /api/v[0,9]+
- rule: matches((url(self).getEscapedPath()), '^/(api/)?v[0-9]+/{0,1}$')
- - message: url must be a valid absolute URL
- rule: isURL(self)
- required:
- - name
- - url
- type: object
- maxItems: 13
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- kubevirt:
- description: kubevirt contains settings specific to the kubevirt
- infrastructure provider.
- type: object
- nutanix:
- description: nutanix contains settings specific to the Nutanix
- infrastructure provider.
- properties:
- failureDomains:
- description: |-
- failureDomains configures failure domains information for the Nutanix platform.
- When set, the failure domains defined here may be used to spread Machines across
- prism element clusters to improve fault tolerance of the cluster.
- items:
- description: NutanixFailureDomain configures failure domain
- information for the Nutanix platform.
- properties:
- cluster:
- description: |-
- cluster is to identify the cluster (the Prism Element under management of the Prism Central),
- in which the Machine's VM will be created. The cluster identifier (uuid or name) can be obtained
- from the Prism Central console or using the prism_central API.
- properties:
- name:
- description: name is the resource name in the PC.
- It cannot be empty if the type is Name.
- type: string
- type:
- description: type is the identifier type to use
- for this resource.
- enum:
- - UUID
- - Name
- type: string
- uuid:
- description: uuid is the UUID of the resource in
- the PC. It cannot be empty if the type is UUID.
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: uuid configuration is required when type
- is UUID, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
- : !has(self.uuid)'
- - message: name configuration is required when type
- is Name, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
- : !has(self.name)'
- name:
- description: |-
- name defines the unique name of a failure domain.
- Name is required and must be at most 64 characters in length.
- It must consist of only lower case alphanumeric characters and hyphens (-).
- It must start and end with an alphanumeric character.
- This value is arbitrary and is used to identify the failure domain within the platform.
- maxLength: 64
- minLength: 1
- pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?'
- type: string
- subnets:
- description: |-
- subnets holds a list of identifiers (one or more) of the cluster's network subnets
- If the feature gate NutanixMultiSubnets is enabled, up to 32 subnets may be configured.
- for the Machine's VM to connect to. The subnet identifiers (uuid or name) can be
- obtained from the Prism Central console or using the prism_central API.
- items:
- description: NutanixResourceIdentifier holds the identity
- of a Nutanix PC resource (cluster, image, subnet,
- etc.)
- properties:
- name:
- description: name is the resource name in the
- PC. It cannot be empty if the type is Name.
- type: string
- type:
- description: type is the identifier type to use
- for this resource.
- enum:
- - UUID
- - Name
- type: string
- uuid:
- description: uuid is the UUID of the resource
- in the PC. It cannot be empty if the type is
- UUID.
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: uuid configuration is required when type
- is UUID, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
- : !has(self.uuid)'
- - message: name configuration is required when type
- is Name, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
- : !has(self.name)'
- maxItems: 32
- minItems: 1
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: each subnet must be unique
- rule: self.all(x, self.exists_one(y, x == y))
- required:
- - cluster
- - name
- - subnets
- type: object
- maxItems: 32
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- prismCentral:
- description: |-
- prismCentral holds the endpoint address and port to access the Nutanix Prism Central.
- When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
- Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
- proxy spec.noProxy list.
- properties:
- address:
- description: address is the endpoint address (DNS name
- or IP address) of the Nutanix Prism Central or Element
- (cluster)
- maxLength: 256
- type: string
- port:
- description: port is the port number to access the Nutanix
- Prism Central or Element (cluster)
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - address
- - port
- type: object
- prismElements:
- description: |-
- prismElements holds one or more endpoint address and port data to access the Nutanix
- Prism Elements (clusters) of the Nutanix Prism Central. Currently we only support one
- Prism Element (cluster) for an OpenShift cluster, where all the Nutanix resources (VMs, subnets, volumes, etc.)
- used in the OpenShift cluster are located. In the future, we may support Nutanix resources (VMs, etc.)
- spread over multiple Prism Elements (clusters) of the Prism Central.
- items:
- description: NutanixPrismElementEndpoint holds the name
- and endpoint data for a Prism Element (cluster)
- properties:
- endpoint:
- description: |-
- endpoint holds the endpoint address and port data of the Prism Element (cluster).
- When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
- Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
- proxy spec.noProxy list.
- properties:
- address:
- description: address is the endpoint address (DNS
- name or IP address) of the Nutanix Prism Central
- or Element (cluster)
- maxLength: 256
- type: string
- port:
- description: port is the port number to access the
- Nutanix Prism Central or Element (cluster)
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - address
- - port
- type: object
- name:
- description: |-
- name is the name of the Prism Element (cluster). This value will correspond with
- the cluster field configured on other resources (eg Machines, PVCs, etc).
- maxLength: 256
- type: string
- required:
- - endpoint
- - name
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- required:
- - prismCentral
- - prismElements
- type: object
- openstack:
- description: openstack contains settings specific to the OpenStack
- infrastructure provider.
- properties:
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.apiServerInternalIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.ingressIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- machineNetworks:
- description: |-
- machineNetworks are IP networks used to connect all the OpenShift cluster
- nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
- for example "10.0.0.0/8" or "fd00::/8".
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- type: object
- x-kubernetes-validations:
- - message: apiServerInternalIPs list is required once set
- rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
- - message: ingressIPs list is required once set
- rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
- ovirt:
- description: ovirt contains settings specific to the oVirt infrastructure
- provider.
- type: object
- powervs:
- description: powervs contains settings specific to the IBM Power
- Systems Virtual Servers infrastructure provider.
- properties:
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of a Power VS service.
- items:
- description: |-
- PowervsServiceEndpoint stores the configuration of a custom url to
- override existing defaults of PowerVS Services.
- properties:
- name:
- description: |-
- name is the name of the Power VS service.
- Few of the services are
- IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
- ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
- Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - Power
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- format: uri
- pattern: ^https://
- type: string
- required:
- - name
- - url
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |-
- type is the underlying infrastructure provider for the cluster. This
- value controls whether infrastructure automation such as service load
- balancers, dynamic volume provisioning, machine creation and deletion, and
- other integrations are enabled. If None, no infrastructure automation is
- enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
- "OpenStack", "VSphere", "oVirt", "IBMCloud", "KubeVirt", "EquinixMetal",
- "PowerVS", "AlibabaCloud", "Nutanix", "External", and "None". Individual
- components may not support all platforms, and must handle unrecognized
- platforms as None if they do not support that platform.
- enum:
- - ""
- - AWS
- - Azure
- - BareMetal
- - GCP
- - Libvirt
- - OpenStack
- - None
- - VSphere
- - oVirt
- - IBMCloud
- - KubeVirt
- - EquinixMetal
- - PowerVS
- - AlibabaCloud
- - Nutanix
- - External
- type: string
- vsphere:
- description: vsphere contains settings specific to the VSphere
- infrastructure provider.
- properties:
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.apiServerInternalIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- failureDomains:
- description: |-
- failureDomains contains the definition of region, zone and the vCenter topology.
- If this is omitted failure domains (regions and zones) will not be used.
- items:
- description: VSpherePlatformFailureDomainSpec holds the
- region and zone failure domain and the vCenter topology
- of that failure domain.
- properties:
- name:
- description: |-
- name defines the arbitrary but unique name
- of a failure domain.
- maxLength: 256
- minLength: 1
- type: string
- region:
- description: |-
- region defines the name of a region tag that will
- be attached to a vCenter datacenter. The tag
- category in vCenter must be named openshift-region.
- maxLength: 80
- minLength: 1
- type: string
- regionAffinity:
- description: |-
- regionAffinity holds the type of region, Datacenter or ComputeCluster.
- When set to Datacenter, this means the region is a vCenter Datacenter as defined in topology.
- When set to ComputeCluster, this means the region is a vCenter Cluster as defined in topology.
- properties:
- type:
- description: |-
- type determines the vSphere object type for a region within this failure domain.
- Available types are Datacenter and ComputeCluster.
- When set to Datacenter, this means the vCenter Datacenter defined is the region.
- When set to ComputeCluster, this means the vCenter cluster defined is the region.
- enum:
- - ComputeCluster
- - Datacenter
- type: string
- required:
- - type
- type: object
- server:
- anyOf:
- - format: ipv4
- - format: ipv6
- - format: hostname
- description: server is the fully-qualified domain name
- or the IP address of the vCenter server.
- maxLength: 255
- minLength: 1
- type: string
- topology:
- description: topology describes a given failure domain
- using vSphere constructs
- properties:
- computeCluster:
- description: |-
- computeCluster the absolute path of the vCenter cluster
- in which virtual machine will be located.
- The absolute path is of the form //host/.
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/host/.*?
- type: string
- datacenter:
- description: |-
- datacenter is the name of vCenter datacenter in which virtual machines will be located.
- The maximum length of the datacenter name is 80 characters.
- maxLength: 80
- type: string
- datastore:
- description: |-
- datastore is the absolute path of the datastore in which the
- virtual machine is located.
- The absolute path is of the form //datastore/
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/datastore/.*?
- type: string
- folder:
- description: |-
- folder is the absolute path of the folder where
- virtual machines are located. The absolute path
- is of the form //vm/.
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/vm/.*?
- type: string
- networks:
- description: |-
- networks is the list of port group network names within this failure domain.
- If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined.
- 10 is the maximum number of virtual network devices which may be attached to a VM as defined by:
- https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0
- The available networks (port groups) can be listed using
- `govc ls 'network/*'`
- Networks should be in the form of an absolute path:
- //network/.
- items:
- type: string
- maxItems: 10
- minItems: 1
- type: array
- x-kubernetes-list-type: atomic
- resourcePool:
- description: |-
- resourcePool is the absolute path of the resource pool where virtual machines will be
- created. The absolute path is of the form //host//Resources/.
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/host/.*?/Resources.*
- type: string
- template:
- description: |-
- template is the full inventory path of the virtual machine or template
- that will be cloned when creating new machines in this failure domain.
- The maximum length of the path is 2048 characters.
-
- When omitted, the template will be calculated by the control plane
- machineset operator based on the region and zone defined in
- VSpherePlatformFailureDomainSpec.
- For example, for zone=zonea, region=region1, and infrastructure name=test,
- the template path would be calculated as //vm/test-rhcos-region1-zonea.
- maxLength: 2048
- minLength: 1
- pattern: ^/.*?/vm/.*?
- type: string
- required:
- - computeCluster
- - datacenter
- - datastore
- - networks
- type: object
- zone:
- description: |-
- zone defines the name of a zone tag that will
- be attached to a vCenter cluster. The tag
- category in vCenter must be named openshift-zone.
- maxLength: 80
- minLength: 1
- type: string
- zoneAffinity:
- description: |-
- zoneAffinity holds the type of the zone and the hostGroup which
- vmGroup and the hostGroup names in vCenter corresponds to
- a vm-host group of type Virtual Machine and Host respectively. Is also
- contains the vmHostRule which is an affinity vm-host rule in vCenter.
- properties:
- hostGroup:
- description: |-
- hostGroup holds the vmGroup and the hostGroup names in vCenter
- corresponds to a vm-host group of type Virtual Machine and Host respectively. Is also
- contains the vmHostRule which is an affinity vm-host rule in vCenter.
- properties:
- hostGroup:
- description: |-
- hostGroup is the name of the vm-host group of type host within vCenter for this failure domain.
- hostGroup is limited to 80 characters.
- This field is required when the VSphereFailureDomain ZoneType is HostGroup
- maxLength: 80
- minLength: 1
- type: string
- vmGroup:
- description: |-
- vmGroup is the name of the vm-host group of type virtual machine within vCenter for this failure domain.
- vmGroup is limited to 80 characters.
- This field is required when the VSphereFailureDomain ZoneType is HostGroup
- maxLength: 80
- minLength: 1
- type: string
- vmHostRule:
- description: |-
- vmHostRule is the name of the affinity vm-host rule within vCenter for this failure domain.
- vmHostRule is limited to 80 characters.
- This field is required when the VSphereFailureDomain ZoneType is HostGroup
- maxLength: 80
- minLength: 1
- type: string
- required:
- - hostGroup
- - vmGroup
- - vmHostRule
- type: object
- type:
- description: |-
- type determines the vSphere object type for a zone within this failure domain.
- Available types are ComputeCluster and HostGroup.
- When set to ComputeCluster, this means the vCenter cluster defined is the zone.
- When set to HostGroup, hostGroup must be configured with hostGroup, vmGroup and vmHostRule and
- this means the zone is defined by the grouping of those fields.
- enum:
- - HostGroup
- - ComputeCluster
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: hostGroup is required when type is HostGroup,
- and forbidden otherwise
- rule: 'has(self.type) && self.type == ''HostGroup''
- ? has(self.hostGroup) : !has(self.hostGroup)'
- required:
- - name
- - region
- - server
- - topology
- - zone
- type: object
- x-kubernetes-validations:
- - message: when zoneAffinity type is HostGroup, regionAffinity
- type must be ComputeCluster
- rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
- == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type
- == ''ComputeCluster'' : true'
- - message: when zoneAffinity type is ComputeCluster, regionAffinity
- type must be Datacenter
- rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
- == ''ComputeCluster'' ? has(self.regionAffinity) &&
- self.regionAffinity.type == ''Datacenter'' : true'
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.ingressIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- machineNetworks:
- description: |-
- machineNetworks are IP networks used to connect all the OpenShift cluster
- nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
- for example "10.0.0.0/8" or "fd00::/8".
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeNetworking:
- description: |-
- nodeNetworking contains the definition of internal and external network constraints for
- assigning the node's networking.
- If this field is omitted, networking defaults to the legacy
- address selection behavior which is to only support a single address and
- return the first one found.
- properties:
- external:
- description: external represents the network configuration
- of the node that is externally routable.
- properties:
- excludeNetworkSubnetCidr:
- description: |-
- excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
- the IP address from the VirtualMachine's VM for use in the status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: atomic
- network:
- description: |-
- network VirtualMachine's VM Network names that will be used to when searching
- for status.addresses fields. Note that if internal.networkSubnetCIDR and
- external.networkSubnetCIDR are not set, then the vNIC associated to this network must
- only have a single IP address assigned to it.
- The available networks (port groups) can be listed using
- `govc ls 'network/*'`
- type: string
- networkSubnetCidr:
- description: |-
- networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
- that will be used in respective status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: set
- type: object
- internal:
- description: internal represents the network configuration
- of the node that is routable only within the cluster.
- properties:
- excludeNetworkSubnetCidr:
- description: |-
- excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
- the IP address from the VirtualMachine's VM for use in the status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: atomic
- network:
- description: |-
- network VirtualMachine's VM Network names that will be used to when searching
- for status.addresses fields. Note that if internal.networkSubnetCIDR and
- external.networkSubnetCIDR are not set, then the vNIC associated to this network must
- only have a single IP address assigned to it.
- The available networks (port groups) can be listed using
- `govc ls 'network/*'`
- type: string
- networkSubnetCidr:
- description: |-
- networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
- that will be used in respective status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: set
- type: object
- type: object
- vcenters:
- description: |-
- vcenters holds the connection details for services to communicate with vCenter.
- Currently, only a single vCenter is supported, but in tech preview 3 vCenters are supported.
- Once the cluster has been installed, you are unable to change the current number of defined
- vCenters except in the case where the cluster has been upgraded from a version of OpenShift
- where the vsphere platform spec was not present. You may make modifications to the existing
- vCenters that are defined in the vcenters list in order to match with any added or modified
- failure domains.
- items:
- description: |-
- VSpherePlatformVCenterSpec stores the vCenter connection fields.
- This is used by the vSphere CCM.
- properties:
- datacenters:
- description: |-
- The vCenter Datacenters in which the RHCOS
- vm guests are located. This field will
- be used by the Cloud Controller Manager.
- Each datacenter listed here should be used within
- a topology.
- items:
- type: string
- minItems: 1
- type: array
- x-kubernetes-list-type: set
- port:
- description: |-
- port is the TCP port that will be used to communicate to
- the vCenter endpoint.
- When omitted, this means the user has no opinion and
- it is up to the platform to choose a sensible default,
- which is subject to change over time.
- format: int32
- maximum: 32767
- minimum: 1
- type: integer
- server:
- anyOf:
- - format: ipv4
- - format: ipv6
- - format: hostname
- description: server is the fully-qualified domain name
- or the IP address of the vCenter server.
- maxLength: 255
- type: string
- required:
- - datacenters
- - server
- type: object
- maxItems: 3
- minItems: 0
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: vcenters cannot be added or removed once set
- rule: 'size(self) != size(oldSelf) ? size(oldSelf) == 0
- && size(self) < 2 : true'
- type: object
- x-kubernetes-validations:
- - message: apiServerInternalIPs list is required once set
- rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
- - message: ingressIPs list is required once set
- rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
- - message: vcenters can have at most 1 item when configured post-install
- rule: '!has(oldSelf.vcenters) && has(self.vcenters) ? size(self.vcenters)
- < 2 : true'
- type: object
- x-kubernetes-validations:
- - message: vcenters can have at most 1 item when configured post-install
- rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? size(self.vsphere.vcenters)
- < 2 : true'
- type: object
- status:
- description: status holds observed values from the cluster. They may not
- be overridden.
- properties:
- apiServerInternalURI:
- description: |-
- apiServerInternalURL is a valid URI with scheme 'https',
- address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components
- like kubelets, to contact the Kubernetes API server using the
- infrastructure provider rather than Kubernetes networking.
- type: string
- apiServerURL:
- description: |-
- apiServerURL is a valid URI with scheme 'https', address and
- optionally a port (defaulting to 443). apiServerURL can be used by components like the web console
- to tell users where to find the Kubernetes API.
- type: string
- controlPlaneTopology:
- default: HighlyAvailable
- description: |-
- controlPlaneTopology expresses the expectations for operands that normally run on control nodes.
- The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
- The 'SingleReplica' mode will be used in single-node deployments
- and the operators should not configure the operand for highly-available operation
- The 'External' mode indicates that the control plane is hosted externally to the cluster and that
- its components are not visible within the cluster.
- enum:
- - HighlyAvailable
- - HighlyAvailableArbiter
- - SingleReplica
- - DualReplica
- - External
- type: string
- cpuPartitioning:
- default: None
- description: |-
- cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster.
- CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets.
- Valid values are "None" and "AllNodes". When omitted, the default value is "None".
- The default value of "None" indicates that no nodes will be setup with CPU partitioning.
- The "AllNodes" value indicates that all nodes have been setup with CPU partitioning,
- and can then be further configured via the PerformanceProfile API.
- enum:
- - None
- - AllNodes
- type: string
- etcdDiscoveryDomain:
- description: |-
- etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering
- etcd servers and clients.
- For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery
- deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.
- type: string
- infrastructureName:
- description: |-
- infrastructureName uniquely identifies a cluster with a human friendly name.
- Once set it should not be changed. Must be of max length 27 and must have only
- alphanumeric or hyphen characters.
- type: string
- infrastructureTopology:
- default: HighlyAvailable
- description: |-
- infrastructureTopology expresses the expectations for infrastructure services that do not run on control
- plane nodes, usually indicated by a node selector for a `role` value
- other than `master`.
- The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
- The 'SingleReplica' mode will be used in single-node deployments
- and the operators should not configure the operand for highly-available operation
- NOTE: External topology mode is not applicable for this field.
- enum:
- - HighlyAvailable
- - SingleReplica
- type: string
- platform:
- description: |-
- platform is the underlying infrastructure provider for the cluster.
-
- Deprecated: Use platformStatus.type instead.
- enum:
- - ""
- - AWS
- - Azure
- - BareMetal
- - GCP
- - Libvirt
- - OpenStack
- - None
- - VSphere
- - oVirt
- - IBMCloud
- - KubeVirt
- - EquinixMetal
- - PowerVS
- - AlibabaCloud
- - Nutanix
- - External
- type: string
- platformStatus:
- description: |-
- platformStatus holds status information specific to the underlying
- infrastructure provider.
- properties:
- alibabaCloud:
- description: alibabaCloud contains settings specific to the Alibaba
- Cloud infrastructure provider.
- properties:
- region:
- description: region specifies the region for Alibaba Cloud
- resources created for the cluster.
- pattern: ^[0-9A-Za-z-]+$
- type: string
- resourceGroupID:
- description: resourceGroupID is the ID of the resource group
- for the cluster.
- pattern: ^(rg-[0-9A-Za-z]+)?$
- type: string
- resourceTags:
- description: resourceTags is a list of additional tags to
- apply to Alibaba Cloud resources created for the cluster.
- items:
- description: AlibabaCloudResourceTag is the set of tags
- to add to apply to resources.
- properties:
- key:
- description: key is the key of the tag.
- maxLength: 128
- minLength: 1
- type: string
- value:
- description: value is the value of the tag.
- maxLength: 128
- minLength: 1
- type: string
- required:
- - key
- - value
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- required:
- - region
- type: object
- aws:
- description: aws contains settings specific to the Amazon Web
- Services infrastructure provider.
- properties:
- cloudLoadBalancerConfig:
- default:
- dnsType: PlatformDefault
- description: |-
- cloudLoadBalancerConfig holds configuration related to DNS and cloud
- load balancers. It allows configuration of in-cluster DNS as an alternative
- to the platform default DNS implementation.
- When using the ClusterHosted DNS type, Load Balancer IP addresses
- must be provided for the API and internal API load balancers as well as the
- ingress load balancer.
- nullable: true
- properties:
- clusterHosted:
- description: |-
- clusterHosted holds the IP addresses of API, API-Int and Ingress Load
- Balancers on Cloud Platforms. The DNS solution hosted within the cluster
- use these IP addresses to provide resolution for API, API-Int and Ingress
- services.
- properties:
- apiIntLoadBalancerIPs:
- description: |-
- apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the apiIntLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- apiLoadBalancerIPs:
- description: |-
- apiLoadBalancerIPs holds Load Balancer IPs for the API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Could be empty for private clusters.
- Entries in the apiLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- ingressLoadBalancerIPs:
- description: |-
- ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the ingressLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- type: object
- dnsType:
- default: PlatformDefault
- description: |-
- dnsType indicates the type of DNS solution in use within the cluster. Its default value of
- `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
- It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
- the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
- The cluster's use of the cloud's Load Balancers is unaffected by this setting.
- The value is immutable after it has been set at install time.
- Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
- Enabling this functionality allows the user to start their own DNS solution outside the cluster after
- installation is complete. The customer would be responsible for configuring this custom DNS solution,
- and it can be run in addition to the in-cluster DNS solution.
- enum:
- - ClusterHosted
- - PlatformDefault
- type: string
- x-kubernetes-validations:
- - message: dnsType is immutable
- rule: oldSelf == '' || self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: clusterHosted is permitted only when dnsType is
- ClusterHosted
- rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
- ? !has(self.clusterHosted) : true'
- ipFamily:
- default: IPv4
- description: |-
- ipFamily specifies the IP protocol family that should be used for AWS
- network resources. This controls whether AWS resources are created with
- IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
- protocol family.
- enum:
- - IPv4
- - DualStackIPv6Primary
- - DualStackIPv4Primary
- type: string
- x-kubernetes-validations:
- - message: ipFamily is immutable once set
- rule: oldSelf == '' || self == oldSelf
- region:
- description: region holds the default AWS region for new AWS
- resources created by the cluster.
- type: string
- resourceTags:
- description: |-
- resourceTags is a list of additional tags to apply to AWS resources created for the cluster.
- See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources.
- AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags
- available for the user.
- items:
- description: AWSResourceTag is a tag to apply to AWS resources
- created for the cluster.
- properties:
- key:
- description: |-
- key sets the key of the AWS resource tag key-value pair. Key is required when defining an AWS resource tag.
- Key should consist of between 1 and 128 characters, and may
- contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
- maxLength: 128
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: invalid AWS resource tag key. The string
- can contain only the set of alphanumeric characters,
- space (' '), '_', '.', '/', '=', '+', '-', ':',
- '@'
- rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
- value:
- description: |-
- value sets the value of the AWS resource tag key-value pair. Value is required when defining an AWS resource tag.
- Value should consist of between 1 and 256 characters, and may
- contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
- Some AWS service do not support empty values. Since tags are added to resources in many services, the
- length of the tag value must meet the requirements of all services.
- maxLength: 256
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: invalid AWS resource tag value. The string
- can contain only the set of alphanumeric characters,
- space (' '), '_', '.', '/', '=', '+', '-', ':',
- '@'
- rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
- required:
- - key
- - value
- type: object
- maxItems: 25
- type: array
- x-kubernetes-list-type: atomic
- serviceEndpoints:
- description: |-
- serviceEndpoints list contains custom endpoints which will override default
- service endpoint of AWS Services.
- There must be only one ServiceEndpoint for a service.
- items:
- description: |-
- AWSServiceEndpoint store the configuration of a custom url to
- override existing defaults of AWS Services.
- properties:
- name:
- description: |-
- name is the name of the AWS service.
- The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
- This must be provided and cannot be empty.
- pattern: ^[a-z0-9-]+$
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- pattern: ^https://
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- azure:
- description: azure contains settings specific to the Azure infrastructure
- provider.
- properties:
- armEndpoint:
- description: armEndpoint specifies a URL to use for resource
- management in non-soverign clouds such as Azure Stack.
- type: string
- cloudLoadBalancerConfig:
- default:
- dnsType: PlatformDefault
- description: |-
- cloudLoadBalancerConfig holds configuration related to DNS and cloud
- load balancers. It allows configuration of in-cluster DNS as an alternative
- to the platform default DNS implementation.
- When using the ClusterHosted DNS type, Load Balancer IP addresses
- must be provided for the API and internal API load balancers as well as the
- ingress load balancer.
- properties:
- clusterHosted:
- description: |-
- clusterHosted holds the IP addresses of API, API-Int and Ingress Load
- Balancers on Cloud Platforms. The DNS solution hosted within the cluster
- use these IP addresses to provide resolution for API, API-Int and Ingress
- services.
- properties:
- apiIntLoadBalancerIPs:
- description: |-
- apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the apiIntLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- apiLoadBalancerIPs:
- description: |-
- apiLoadBalancerIPs holds Load Balancer IPs for the API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Could be empty for private clusters.
- Entries in the apiLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- ingressLoadBalancerIPs:
- description: |-
- ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the ingressLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- type: object
- dnsType:
- default: PlatformDefault
- description: |-
- dnsType indicates the type of DNS solution in use within the cluster. Its default value of
- `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
- It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
- the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
- The cluster's use of the cloud's Load Balancers is unaffected by this setting.
- The value is immutable after it has been set at install time.
- Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
- Enabling this functionality allows the user to start their own DNS solution outside the cluster after
- installation is complete. The customer would be responsible for configuring this custom DNS solution,
- and it can be run in addition to the in-cluster DNS solution.
- enum:
- - ClusterHosted
- - PlatformDefault
- type: string
- x-kubernetes-validations:
- - message: dnsType is immutable
- rule: oldSelf == '' || self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: clusterHosted is permitted only when dnsType is
- ClusterHosted
- rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
- ? !has(self.clusterHosted) : true'
- cloudName:
- description: |-
- cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
- with the appropriate Azure API endpoints.
- If empty, the value is equal to `AzurePublicCloud`.
- enum:
- - ""
- - AzurePublicCloud
- - AzureUSGovernmentCloud
- - AzureChinaCloud
- - AzureGermanCloud
- - AzureStackCloud
- type: string
- ipFamily:
- default: IPv4
- description: |-
- ipFamily specifies the IP protocol family that should be used for Azure
- network resources. This controls whether Azure resources are created with
- IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
- protocol family.
- enum:
- - IPv4
- - DualStackIPv6Primary
- - DualStackIPv4Primary
- type: string
- x-kubernetes-validations:
- - message: ipFamily is immutable once set
- rule: oldSelf == '' || self == oldSelf
- networkResourceGroupName:
- description: |-
- networkResourceGroupName is the Resource Group for network resources like the Virtual Network and Subnets used by the cluster.
- If empty, the value is same as ResourceGroupName.
- type: string
- resourceGroupName:
- description: resourceGroupName is the Resource Group for new
- Azure resources created for the cluster.
- type: string
- resourceTags:
- description: |-
- resourceTags is a list of additional tags to apply to Azure resources created for the cluster.
- See https://docs.microsoft.com/en-us/rest/api/resources/tags for information on tagging Azure resources.
- Due to limitations on Automation, Content Delivery Network, DNS Azure resources, a maximum of 15 tags
- may be applied. OpenShift reserves 5 tags for internal use, allowing 10 tags for user configuration.
- items:
- description: AzureResourceTag is a tag to apply to Azure
- resources created for the cluster.
- properties:
- key:
- description: |-
- key is the key part of the tag. A tag key can have a maximum of 128 characters and cannot be empty. Key
- must begin with a letter, end with a letter, number or underscore, and must contain only alphanumeric
- characters and the following special characters `_ . -`.
- maxLength: 128
- minLength: 1
- pattern: ^[a-zA-Z]([0-9A-Za-z_.-]*[0-9A-Za-z_])?$
- type: string
- value:
- description: |-
- value is the value part of the tag. A tag value can have a maximum of 256 characters and cannot be empty. Value
- must contain only alphanumeric characters and the following special characters `_ + , - . / : ; < = > ? @`.
- maxLength: 256
- minLength: 1
- pattern: ^[0-9A-Za-z_.=+-@]+$
- type: string
- required:
- - key
- - value
- type: object
- maxItems: 10
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: resourceTags are immutable and may only be configured
- during installation
- rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
- type: object
- x-kubernetes-validations:
- - message: resourceTags may only be configured during installation
- rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
- || has(oldSelf.resourceTags) && has(self.resourceTags)'
- baremetal:
- description: baremetal contains settings specific to the BareMetal
- platform.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on BareMetal platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- machineNetworks:
- description: machineNetworks are IP networks used to connect
- all the OpenShift cluster nodes.
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeDNSIP:
- description: |-
- nodeDNSIP is the IP address for the internal DNS used by the
- nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
- provides name resolution for the nodes themselves. There is no DNS-as-a-service for
- BareMetal deployments. In order to minimize necessary changes to the
- datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
- to the nodes in the cluster.
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- equinixMetal:
- description: equinixMetal contains settings specific to the Equinix
- Metal infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
- type: string
- type: object
- external:
- description: external contains settings specific to the generic
- External infrastructure provider.
- properties:
- cloudControllerManager:
- description: |-
- cloudControllerManager contains settings specific to the external Cloud Controller Manager (a.k.a. CCM or CPI).
- When omitted, new nodes will be not tainted
- and no extra initialization from the cloud controller manager is expected.
- properties:
- state:
- description: |-
- state determines whether or not an external Cloud Controller Manager is expected to
- be installed within the cluster.
- https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager
-
- Valid values are "External", "None" and omitted.
- When set to "External", new nodes will be tainted as uninitialized when created,
- preventing them from running workloads until they are initialized by the cloud controller manager.
- When omitted or set to "None", new nodes will be not tainted
- and no extra initialization from the cloud controller manager is expected.
- enum:
- - ""
- - External
- - None
- type: string
- x-kubernetes-validations:
- - message: state is immutable once set
- rule: self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: state may not be added or removed once set
- rule: (has(self.state) == has(oldSelf.state)) || (!has(oldSelf.state)
- && self.state != "External")
- type: object
- x-kubernetes-validations:
- - message: cloudControllerManager may not be added or removed
- once set
- rule: has(self.cloudControllerManager) == has(oldSelf.cloudControllerManager)
- gcp:
- description: gcp contains settings specific to the Google Cloud
- Platform infrastructure provider.
- properties:
- cloudLoadBalancerConfig:
- default:
- dnsType: PlatformDefault
- description: |-
- cloudLoadBalancerConfig holds configuration related to DNS and cloud
- load balancers. It allows configuration of in-cluster DNS as an alternative
- to the platform default DNS implementation.
- When using the ClusterHosted DNS type, Load Balancer IP addresses
- must be provided for the API and internal API load balancers as well as the
- ingress load balancer.
- nullable: true
- properties:
- clusterHosted:
- description: |-
- clusterHosted holds the IP addresses of API, API-Int and Ingress Load
- Balancers on Cloud Platforms. The DNS solution hosted within the cluster
- use these IP addresses to provide resolution for API, API-Int and Ingress
- services.
- properties:
- apiIntLoadBalancerIPs:
- description: |-
- apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the apiIntLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- apiLoadBalancerIPs:
- description: |-
- apiLoadBalancerIPs holds Load Balancer IPs for the API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Could be empty for private clusters.
- Entries in the apiLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- ingressLoadBalancerIPs:
- description: |-
- ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the ingressLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- type: object
- dnsType:
- default: PlatformDefault
- description: |-
- dnsType indicates the type of DNS solution in use within the cluster. Its default value of
- `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
- It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
- the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
- The cluster's use of the cloud's Load Balancers is unaffected by this setting.
- The value is immutable after it has been set at install time.
- Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
- Enabling this functionality allows the user to start their own DNS solution outside the cluster after
- installation is complete. The customer would be responsible for configuring this custom DNS solution,
- and it can be run in addition to the in-cluster DNS solution.
- enum:
- - ClusterHosted
- - PlatformDefault
- type: string
- x-kubernetes-validations:
- - message: dnsType is immutable
- rule: oldSelf == '' || self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: clusterHosted is permitted only when dnsType is
- ClusterHosted
- rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
- ? !has(self.clusterHosted) : true'
- projectID:
- description: resourceGroupName is the Project ID for new GCP
- resources created for the cluster.
- type: string
- region:
- description: region holds the region for new GCP resources
- created for the cluster.
- type: string
- resourceLabels:
- description: |-
- resourceLabels is a list of additional labels to apply to GCP resources created for the cluster.
- See https://cloud.google.com/compute/docs/labeling-resources for information on labeling GCP resources.
- GCP supports a maximum of 64 labels per resource. OpenShift reserves 32 labels for internal use,
- allowing 32 labels for user configuration.
- items:
- description: GCPResourceLabel is a label to apply to GCP
- resources created for the cluster.
- properties:
- key:
- description: |-
- key is the key part of the label. A label key can have a maximum of 63 characters and cannot be empty.
- Label key must begin with a lowercase letter, and must contain only lowercase letters, numeric characters,
- and the following special characters `_-`. Label key must not have the reserved prefixes `kubernetes-io`
- and `openshift-io`.
- maxLength: 63
- minLength: 1
- pattern: ^[a-z][0-9a-z_-]{0,62}$
- type: string
- x-kubernetes-validations:
- - message: label keys must not start with either `openshift-io`
- or `kubernetes-io`
- rule: '!self.startsWith(''openshift-io'') && !self.startsWith(''kubernetes-io'')'
- value:
- description: |-
- value is the value part of the label. A label value can have a maximum of 63 characters and cannot be empty.
- Value must contain only lowercase letters, numeric characters, and the following special characters `_-`.
- maxLength: 63
- minLength: 1
- pattern: ^[0-9a-z_-]{1,63}$
- type: string
- required:
- - key
- - value
- type: object
- maxItems: 32
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- x-kubernetes-validations:
- - message: resourceLabels are immutable and may only be configured
- during installation
- rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
- resourceTags:
- description: |-
- resourceTags is a list of additional tags to apply to GCP resources created for the cluster.
- See https://cloud.google.com/resource-manager/docs/tags/tags-overview for information on
- tagging GCP resources. GCP supports a maximum of 50 tags per resource.
- items:
- description: GCPResourceTag is a tag to apply to GCP resources
- created for the cluster.
- properties:
- key:
- description: |-
- key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot be empty.
- Tag key must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
- alphanumeric characters, and the following special characters `._-`.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$
- type: string
- parentID:
- description: |-
- parentID is the ID of the hierarchical resource where the tags are defined,
- e.g. at the Organization or the Project level. To find the Organization or Project ID refer to the following pages:
- https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id,
- https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects.
- An OrganizationID must consist of decimal numbers, and cannot have leading zeroes.
- A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters, numbers,
- and hyphens, and must start with a letter, and cannot end with a hyphen.
- maxLength: 32
- minLength: 1
- pattern: (^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)
- type: string
- value:
- description: |-
- value is the value part of the tag. A tag value can have a maximum of 63 characters and cannot be empty.
- Tag value must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
- alphanumeric characters, and the following special characters `_-.@%=+:,*#&(){}[]` and spaces.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$
- type: string
- required:
- - key
- - parentID
- - value
- type: object
- maxItems: 50
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- x-kubernetes-validations:
- - message: resourceTags are immutable and may only be configured
- during installation
- rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
- type: object
- x-kubernetes-validations:
- - message: resourceLabels may only be configured during installation
- rule: '!has(oldSelf.resourceLabels) && !has(self.resourceLabels)
- || has(oldSelf.resourceLabels) && has(self.resourceLabels)'
- - message: resourceTags may only be configured during installation
- rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
- || has(oldSelf.resourceTags) && has(self.resourceTags)'
- ibmcloud:
- description: ibmcloud contains settings specific to the IBMCloud
- infrastructure provider.
- properties:
- cisInstanceCRN:
- description: |-
- cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
- the DNS zone for the cluster's base domain
- type: string
- dnsInstanceCRN:
- description: |-
- dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
- for the cluster's base domain
- type: string
- location:
- description: location is where the cluster has been deployed
- type: string
- providerType:
- description: providerType indicates the type of cluster that
- was created
- type: string
- resourceGroupName:
- description: resourceGroupName is the Resource Group for new
- IBMCloud resources created for the cluster.
- type: string
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of an IBM service. These endpoints are used by components
- within the cluster when trying to reach the IBM Cloud Services that have been
- overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
- endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
- are updated to reflect the same custom endpoints.
- items:
- description: |-
- IBMCloudServiceEndpoint stores the configuration of a custom url to
- override existing defaults of IBM Cloud Services.
- properties:
- name:
- description: |-
- name is the name of the IBM Cloud service.
- Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
- For example, the IBM Cloud Private IAM service could be configured with the
- service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
- Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
- with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty. The path must follow the pattern
- /v[0,9]+ or /api/v[0,9]+
- maxLength: 300
- type: string
- x-kubernetes-validations:
- - message: url must be a valid absolute URL
- rule: isURL(self)
- required:
- - name
- - url
- type: object
- maxItems: 13
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- kubevirt:
- description: kubevirt contains settings specific to the kubevirt
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
- type: string
- type: object
- nutanix:
- description: nutanix contains settings specific to the Nutanix
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on Nutanix platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- openstack:
- description: openstack contains settings specific to the OpenStack
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- cloudName:
- description: |-
- cloudName is the name of the desired OpenStack cloud in the
- client configuration file (`clouds.yaml`).
- type: string
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on OpenStack platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- machineNetworks:
- description: machineNetworks are IP networks used to connect
- all the OpenShift cluster nodes.
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeDNSIP:
- description: |-
- nodeDNSIP is the IP address for the internal DNS used by the
- nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
- provides name resolution for the nodes themselves. There is no DNS-as-a-service for
- OpenStack deployments. In order to minimize necessary changes to the
- datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
- to the nodes in the cluster.
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- ovirt:
- description: ovirt contains settings specific to the oVirt infrastructure
- provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on Ovirt platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- nodeDNSIP:
- description: 'deprecated: as of 4.6, this field is no longer
- set or honored. It will be removed in a future release.'
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- powervs:
- description: powervs contains settings specific to the Power Systems
- Virtual Servers infrastructure provider.
- properties:
- cisInstanceCRN:
- description: |-
- cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
- the DNS zone for the cluster's base domain
- type: string
- dnsInstanceCRN:
- description: |-
- dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
- for the cluster's base domain
- type: string
- region:
- description: region holds the default Power VS region for
- new Power VS resources created by the cluster.
- type: string
- resourceGroup:
- description: |-
- resourceGroup is the resource group name for new IBMCloud resources created for a cluster.
- The resource group specified here will be used by cluster-image-registry-operator to set up a COS Instance in IBMCloud for the cluster registry.
- More about resource groups can be found here: https://cloud.ibm.com/docs/account?topic=account-rgs.
- When omitted, the image registry operator won't be able to configure storage,
- which results in the image registry cluster operator not being in an available state.
- maxLength: 40
- pattern: ^[a-zA-Z0-9-_ ]+$
- type: string
- x-kubernetes-validations:
- - message: resourceGroup is immutable once set
- rule: oldSelf == '' || self == oldSelf
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of a Power VS service.
- items:
- description: |-
- PowervsServiceEndpoint stores the configuration of a custom url to
- override existing defaults of PowerVS Services.
- properties:
- name:
- description: |-
- name is the name of the Power VS service.
- Few of the services are
- IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
- ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
- Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - Power
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- format: uri
- pattern: ^https://
- type: string
- required:
- - name
- - url
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- zone:
- description: |-
- zone holds the default zone for the new Power VS resources created by the cluster.
- Note: Currently only single-zone OCP clusters are supported
- type: string
- type: object
- x-kubernetes-validations:
- - message: cannot unset resourceGroup once set
- rule: '!has(oldSelf.resourceGroup) || has(self.resourceGroup)'
- type:
- description: |-
- type is the underlying infrastructure provider for the cluster. This
- value controls whether infrastructure automation such as service load
- balancers, dynamic volume provisioning, machine creation and deletion, and
- other integrations are enabled. If None, no infrastructure automation is
- enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
- "OpenStack", "VSphere", "oVirt", "EquinixMetal", "PowerVS", "AlibabaCloud", "Nutanix" and "None".
- Individual components may not support all platforms, and must handle
- unrecognized platforms as None if they do not support that platform.
-
- This value will be synced with to the `status.platform` and `status.platformStatus.type`.
- Currently this value cannot be changed once set.
- enum:
- - ""
- - AWS
- - Azure
- - BareMetal
- - GCP
- - Libvirt
- - OpenStack
- - None
- - VSphere
- - oVirt
- - IBMCloud
- - KubeVirt
- - EquinixMetal
- - PowerVS
- - AlibabaCloud
- - Nutanix
- - External
- type: string
- vsphere:
- description: vsphere contains settings specific to the VSphere
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on VSphere platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- machineNetworks:
- description: machineNetworks are IP networks used to connect
- all the OpenShift cluster nodes.
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeDNSIP:
- description: |-
- nodeDNSIP is the IP address for the internal DNS used by the
- nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
- provides name resolution for the nodes themselves. There is no DNS-as-a-service for
- vSphere deployments. In order to minimize necessary changes to the
- datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
- to the nodes in the cluster.
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- type: object
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml
index 803c48a1e..0305366df 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml
@@ -828,6 +828,17 @@ spec:
- topology
- zone
type: object
+ x-kubernetes-validations:
+ - message: when zoneAffinity type is HostGroup, regionAffinity
+ type must be ComputeCluster
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type
+ == ''ComputeCluster'' : true'
+ - message: when zoneAffinity type is ComputeCluster, regionAffinity
+ type must be Datacenter
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''ComputeCluster'' ? has(self.regionAffinity) &&
+ self.regionAffinity.type == ''Datacenter'' : true'
type: array
x-kubernetes-list-map-keys:
- name
@@ -954,10 +965,11 @@ spec:
vcenters:
description: |-
vcenters holds the connection details for services to communicate with vCenter.
- Currently, only a single vCenter is supported, but in tech preview 3 vCenters are supported.
+ Up to 3 vCenters are supported.
Once the cluster has been installed, you are unable to change the current number of defined
- vCenters except in the case where the cluster has been upgraded from a version of OpenShift
- where the vsphere platform spec was not present. You may make modifications to the existing
+ vCenters except when 1.) the cluster has been upgraded from a version of OpenShift
+ where the vsphere platform spec was not present or 2.) in TechPreview you are able to add and
+ remove vCenters but may not remove all vCenters. You may make modifications to the existing
vCenters that are defined in the vcenters list in order to match with any added or modified
failure domains.
items:
@@ -1002,27 +1014,23 @@ spec:
- server
type: object
maxItems: 3
- minItems: 0
+ minItems: 1
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- - message: vcenters cannot be added or removed once set
- rule: 'size(self) != size(oldSelf) ? size(oldSelf) == 0
- && size(self) < 2 : true'
+ - message: vcenters must have unique server values
+ rule: self.all(x, self.exists_one(y, y.server == x.server))
type: object
x-kubernetes-validations:
- message: apiServerInternalIPs list is required once set
rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
- message: ingressIPs list is required once set
rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
- - message: vcenters can have at most 1 item when configured post-install
- rule: '!has(oldSelf.vcenters) && has(self.vcenters) ? size(self.vcenters)
- < 2 : true'
type: object
x-kubernetes-validations:
- message: vcenters can have at most 1 item when configured post-install
- rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? size(self.vsphere.vcenters)
- < 2 : true'
+ rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? (has(self.vsphere.vcenters)
+ && size(self.vsphere.vcenters) < 2) : true'
type: object
status:
description: status holds observed values from the cluster. They may not
@@ -1050,10 +1058,13 @@ spec:
and the operators should not configure the operand for highly-available operation
The 'External' mode indicates that the control plane is hosted externally to the cluster and that
its components are not visible within the cluster.
+ The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes
+ that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.
enum:
- HighlyAvailable
- HighlyAvailableArbiter
- SingleReplica
+ - DualReplica
- External
type: string
cpuPartitioning:
@@ -1172,6 +1183,110 @@ spec:
description: aws contains settings specific to the Amazon Web
Services infrastructure provider.
properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
region:
description: region holds the default AWS region for new AWS
resources created by the cluster.
@@ -1259,6 +1374,109 @@ spec:
description: armEndpoint specifies a URL to use for resource
management in non-soverign clouds such as Azure Stack.
type: string
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
cloudName:
description: |-
cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-DevPreviewNoUpgrade.crd.yaml
deleted file mode 100644
index de1a68c90..000000000
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-DevPreviewNoUpgrade.crd.yaml
+++ /dev/null
@@ -1,2770 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.openshift.io: https://github.com/openshift/api/pull/470
- api.openshift.io/merged-by-featuregates: "true"
- include.release.openshift.io/ibm-cloud-managed: "true"
- include.release.openshift.io/self-managed-high-availability: "true"
- release.openshift.io/bootstrap-required: "true"
- release.openshift.io/feature-set: DevPreviewNoUpgrade
- name: infrastructures.config.openshift.io
-spec:
- group: config.openshift.io
- names:
- kind: Infrastructure
- listKind: InfrastructureList
- plural: infrastructures
- singular: infrastructure
- scope: Cluster
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Infrastructure holds cluster-wide information about Infrastructure. The canonical name is `cluster`
-
- Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: spec holds user settable values for configuration
- properties:
- cloudConfig:
- description: |-
- cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file.
- This configuration file is used to configure the Kubernetes cloud provider integration
- when using the built-in cloud provider integration or the external cloud controller manager.
- The namespace for this config map is openshift-config.
-
- cloudConfig should only be consumed by the kube_cloud_config controller.
- The controller is responsible for using the user configuration in the spec
- for various platforms and combining that with the user provided ConfigMap in this field
- to create a stitched kube cloud config.
- The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace
- with the kube cloud config is stored in `cloud.conf` key.
- All the clients are expected to use the generated ConfigMap only.
- properties:
- key:
- description: key allows pointing to a specific key/value inside
- of the configmap. This is useful for logical file references.
- type: string
- name:
- type: string
- type: object
- platformSpec:
- description: |-
- platformSpec holds desired information specific to the underlying
- infrastructure provider.
- properties:
- alibabaCloud:
- description: alibabaCloud contains settings specific to the Alibaba
- Cloud infrastructure provider.
- type: object
- aws:
- description: aws contains settings specific to the Amazon Web
- Services infrastructure provider.
- properties:
- serviceEndpoints:
- description: |-
- serviceEndpoints list contains custom endpoints which will override default
- service endpoint of AWS Services.
- There must be only one ServiceEndpoint for a service.
- items:
- description: |-
- AWSServiceEndpoint store the configuration of a custom url to
- override existing defaults of AWS Services.
- properties:
- name:
- description: |-
- name is the name of the AWS service.
- The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
- This must be provided and cannot be empty.
- pattern: ^[a-z0-9-]+$
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- pattern: ^https://
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- azure:
- description: azure contains settings specific to the Azure infrastructure
- provider.
- type: object
- baremetal:
- description: baremetal contains settings specific to the BareMetal
- platform.
- properties:
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.apiServerInternalIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.ingressIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- machineNetworks:
- description: |-
- machineNetworks are IP networks used to connect all the OpenShift cluster
- nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
- for example "10.0.0.0/8" or "fd00::/8".
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- type: object
- x-kubernetes-validations:
- - message: apiServerInternalIPs list is required once set
- rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
- - message: ingressIPs list is required once set
- rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
- equinixMetal:
- description: equinixMetal contains settings specific to the Equinix
- Metal infrastructure provider.
- type: object
- external:
- description: |-
- ExternalPlatformType represents generic infrastructure provider.
- Platform-specific components should be supplemented separately.
- properties:
- platformName:
- default: Unknown
- description: |-
- platformName holds the arbitrary string representing the infrastructure provider name, expected to be set at the installation time.
- This field is solely for informational and reporting purposes and is not expected to be used for decision-making.
- type: string
- x-kubernetes-validations:
- - message: platform name cannot be changed once set
- rule: oldSelf == 'Unknown' || self == oldSelf
- type: object
- gcp:
- description: gcp contains settings specific to the Google Cloud
- Platform infrastructure provider.
- type: object
- ibmcloud:
- description: ibmcloud contains settings specific to the IBMCloud
- infrastructure provider.
- properties:
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of an IBM service. These endpoints are used by components
- within the cluster when trying to reach the IBM Cloud Services that have been
- overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
- endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
- are updated to reflect the same custom endpoints.
- A maximum of 13 service endpoints overrides are supported.
- items:
- description: |-
- IBMCloudServiceEndpoint stores the configuration of a custom url to
- override existing defaults of IBM Cloud Services.
- properties:
- name:
- description: |-
- name is the name of the IBM Cloud service.
- Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
- For example, the IBM Cloud Private IAM service could be configured with the
- service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
- Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
- with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty. The path must follow the pattern
- /v[0,9]+ or /api/v[0,9]+
- maxLength: 300
- type: string
- x-kubernetes-validations:
- - message: url must use https scheme
- rule: url(self).getScheme() == "https"
- - message: url path must match /v[0,9]+ or /api/v[0,9]+
- rule: matches((url(self).getEscapedPath()), '^/(api/)?v[0-9]+/{0,1}$')
- - message: url must be a valid absolute URL
- rule: isURL(self)
- required:
- - name
- - url
- type: object
- maxItems: 13
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- kubevirt:
- description: kubevirt contains settings specific to the kubevirt
- infrastructure provider.
- type: object
- nutanix:
- description: nutanix contains settings specific to the Nutanix
- infrastructure provider.
- properties:
- failureDomains:
- description: |-
- failureDomains configures failure domains information for the Nutanix platform.
- When set, the failure domains defined here may be used to spread Machines across
- prism element clusters to improve fault tolerance of the cluster.
- items:
- description: NutanixFailureDomain configures failure domain
- information for the Nutanix platform.
- properties:
- cluster:
- description: |-
- cluster is to identify the cluster (the Prism Element under management of the Prism Central),
- in which the Machine's VM will be created. The cluster identifier (uuid or name) can be obtained
- from the Prism Central console or using the prism_central API.
- properties:
- name:
- description: name is the resource name in the PC.
- It cannot be empty if the type is Name.
- type: string
- type:
- description: type is the identifier type to use
- for this resource.
- enum:
- - UUID
- - Name
- type: string
- uuid:
- description: uuid is the UUID of the resource in
- the PC. It cannot be empty if the type is UUID.
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: uuid configuration is required when type
- is UUID, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
- : !has(self.uuid)'
- - message: name configuration is required when type
- is Name, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
- : !has(self.name)'
- name:
- description: |-
- name defines the unique name of a failure domain.
- Name is required and must be at most 64 characters in length.
- It must consist of only lower case alphanumeric characters and hyphens (-).
- It must start and end with an alphanumeric character.
- This value is arbitrary and is used to identify the failure domain within the platform.
- maxLength: 64
- minLength: 1
- pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?'
- type: string
- subnets:
- description: |-
- subnets holds a list of identifiers (one or more) of the cluster's network subnets
- If the feature gate NutanixMultiSubnets is enabled, up to 32 subnets may be configured.
- for the Machine's VM to connect to. The subnet identifiers (uuid or name) can be
- obtained from the Prism Central console or using the prism_central API.
- items:
- description: NutanixResourceIdentifier holds the identity
- of a Nutanix PC resource (cluster, image, subnet,
- etc.)
- properties:
- name:
- description: name is the resource name in the
- PC. It cannot be empty if the type is Name.
- type: string
- type:
- description: type is the identifier type to use
- for this resource.
- enum:
- - UUID
- - Name
- type: string
- uuid:
- description: uuid is the UUID of the resource
- in the PC. It cannot be empty if the type is
- UUID.
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: uuid configuration is required when type
- is UUID, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
- : !has(self.uuid)'
- - message: name configuration is required when type
- is Name, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
- : !has(self.name)'
- maxItems: 32
- minItems: 1
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: each subnet must be unique
- rule: self.all(x, self.exists_one(y, x == y))
- required:
- - cluster
- - name
- - subnets
- type: object
- maxItems: 32
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- prismCentral:
- description: |-
- prismCentral holds the endpoint address and port to access the Nutanix Prism Central.
- When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
- Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
- proxy spec.noProxy list.
- properties:
- address:
- description: address is the endpoint address (DNS name
- or IP address) of the Nutanix Prism Central or Element
- (cluster)
- maxLength: 256
- type: string
- port:
- description: port is the port number to access the Nutanix
- Prism Central or Element (cluster)
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - address
- - port
- type: object
- prismElements:
- description: |-
- prismElements holds one or more endpoint address and port data to access the Nutanix
- Prism Elements (clusters) of the Nutanix Prism Central. Currently we only support one
- Prism Element (cluster) for an OpenShift cluster, where all the Nutanix resources (VMs, subnets, volumes, etc.)
- used in the OpenShift cluster are located. In the future, we may support Nutanix resources (VMs, etc.)
- spread over multiple Prism Elements (clusters) of the Prism Central.
- items:
- description: NutanixPrismElementEndpoint holds the name
- and endpoint data for a Prism Element (cluster)
- properties:
- endpoint:
- description: |-
- endpoint holds the endpoint address and port data of the Prism Element (cluster).
- When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
- Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
- proxy spec.noProxy list.
- properties:
- address:
- description: address is the endpoint address (DNS
- name or IP address) of the Nutanix Prism Central
- or Element (cluster)
- maxLength: 256
- type: string
- port:
- description: port is the port number to access the
- Nutanix Prism Central or Element (cluster)
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - address
- - port
- type: object
- name:
- description: |-
- name is the name of the Prism Element (cluster). This value will correspond with
- the cluster field configured on other resources (eg Machines, PVCs, etc).
- maxLength: 256
- type: string
- required:
- - endpoint
- - name
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- required:
- - prismCentral
- - prismElements
- type: object
- openstack:
- description: openstack contains settings specific to the OpenStack
- infrastructure provider.
- properties:
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.apiServerInternalIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.ingressIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- machineNetworks:
- description: |-
- machineNetworks are IP networks used to connect all the OpenShift cluster
- nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
- for example "10.0.0.0/8" or "fd00::/8".
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- type: object
- x-kubernetes-validations:
- - message: apiServerInternalIPs list is required once set
- rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
- - message: ingressIPs list is required once set
- rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
- ovirt:
- description: ovirt contains settings specific to the oVirt infrastructure
- provider.
- type: object
- powervs:
- description: powervs contains settings specific to the IBM Power
- Systems Virtual Servers infrastructure provider.
- properties:
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of a Power VS service.
- items:
- description: |-
- PowervsServiceEndpoint stores the configuration of a custom url to
- override existing defaults of PowerVS Services.
- properties:
- name:
- description: |-
- name is the name of the Power VS service.
- Few of the services are
- IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
- ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
- Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - Power
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- format: uri
- pattern: ^https://
- type: string
- required:
- - name
- - url
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |-
- type is the underlying infrastructure provider for the cluster. This
- value controls whether infrastructure automation such as service load
- balancers, dynamic volume provisioning, machine creation and deletion, and
- other integrations are enabled. If None, no infrastructure automation is
- enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
- "OpenStack", "VSphere", "oVirt", "IBMCloud", "KubeVirt", "EquinixMetal",
- "PowerVS", "AlibabaCloud", "Nutanix", "External", and "None". Individual
- components may not support all platforms, and must handle unrecognized
- platforms as None if they do not support that platform.
- enum:
- - ""
- - AWS
- - Azure
- - BareMetal
- - GCP
- - Libvirt
- - OpenStack
- - None
- - VSphere
- - oVirt
- - IBMCloud
- - KubeVirt
- - EquinixMetal
- - PowerVS
- - AlibabaCloud
- - Nutanix
- - External
- type: string
- vsphere:
- description: vsphere contains settings specific to the VSphere
- infrastructure provider.
- properties:
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.apiServerInternalIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- failureDomains:
- description: |-
- failureDomains contains the definition of region, zone and the vCenter topology.
- If this is omitted failure domains (regions and zones) will not be used.
- items:
- description: VSpherePlatformFailureDomainSpec holds the
- region and zone failure domain and the vCenter topology
- of that failure domain.
- properties:
- name:
- description: |-
- name defines the arbitrary but unique name
- of a failure domain.
- maxLength: 256
- minLength: 1
- type: string
- region:
- description: |-
- region defines the name of a region tag that will
- be attached to a vCenter datacenter. The tag
- category in vCenter must be named openshift-region.
- maxLength: 80
- minLength: 1
- type: string
- regionAffinity:
- description: |-
- regionAffinity holds the type of region, Datacenter or ComputeCluster.
- When set to Datacenter, this means the region is a vCenter Datacenter as defined in topology.
- When set to ComputeCluster, this means the region is a vCenter Cluster as defined in topology.
- properties:
- type:
- description: |-
- type determines the vSphere object type for a region within this failure domain.
- Available types are Datacenter and ComputeCluster.
- When set to Datacenter, this means the vCenter Datacenter defined is the region.
- When set to ComputeCluster, this means the vCenter cluster defined is the region.
- enum:
- - ComputeCluster
- - Datacenter
- type: string
- required:
- - type
- type: object
- server:
- anyOf:
- - format: ipv4
- - format: ipv6
- - format: hostname
- description: server is the fully-qualified domain name
- or the IP address of the vCenter server.
- maxLength: 255
- minLength: 1
- type: string
- topology:
- description: topology describes a given failure domain
- using vSphere constructs
- properties:
- computeCluster:
- description: |-
- computeCluster the absolute path of the vCenter cluster
- in which virtual machine will be located.
- The absolute path is of the form //host/.
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/host/.*?
- type: string
- datacenter:
- description: |-
- datacenter is the name of vCenter datacenter in which virtual machines will be located.
- The maximum length of the datacenter name is 80 characters.
- maxLength: 80
- type: string
- datastore:
- description: |-
- datastore is the absolute path of the datastore in which the
- virtual machine is located.
- The absolute path is of the form //datastore/
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/datastore/.*?
- type: string
- folder:
- description: |-
- folder is the absolute path of the folder where
- virtual machines are located. The absolute path
- is of the form //vm/.
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/vm/.*?
- type: string
- networks:
- description: |-
- networks is the list of port group network names within this failure domain.
- If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined.
- 10 is the maximum number of virtual network devices which may be attached to a VM as defined by:
- https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0
- The available networks (port groups) can be listed using
- `govc ls 'network/*'`
- Networks should be in the form of an absolute path:
- //network/.
- items:
- type: string
- maxItems: 10
- minItems: 1
- type: array
- x-kubernetes-list-type: atomic
- resourcePool:
- description: |-
- resourcePool is the absolute path of the resource pool where virtual machines will be
- created. The absolute path is of the form //host//Resources/.
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/host/.*?/Resources.*
- type: string
- template:
- description: |-
- template is the full inventory path of the virtual machine or template
- that will be cloned when creating new machines in this failure domain.
- The maximum length of the path is 2048 characters.
-
- When omitted, the template will be calculated by the control plane
- machineset operator based on the region and zone defined in
- VSpherePlatformFailureDomainSpec.
- For example, for zone=zonea, region=region1, and infrastructure name=test,
- the template path would be calculated as //vm/test-rhcos-region1-zonea.
- maxLength: 2048
- minLength: 1
- pattern: ^/.*?/vm/.*?
- type: string
- required:
- - computeCluster
- - datacenter
- - datastore
- - networks
- type: object
- zone:
- description: |-
- zone defines the name of a zone tag that will
- be attached to a vCenter cluster. The tag
- category in vCenter must be named openshift-zone.
- maxLength: 80
- minLength: 1
- type: string
- zoneAffinity:
- description: |-
- zoneAffinity holds the type of the zone and the hostGroup which
- vmGroup and the hostGroup names in vCenter corresponds to
- a vm-host group of type Virtual Machine and Host respectively. Is also
- contains the vmHostRule which is an affinity vm-host rule in vCenter.
- properties:
- hostGroup:
- description: |-
- hostGroup holds the vmGroup and the hostGroup names in vCenter
- corresponds to a vm-host group of type Virtual Machine and Host respectively. Is also
- contains the vmHostRule which is an affinity vm-host rule in vCenter.
- properties:
- hostGroup:
- description: |-
- hostGroup is the name of the vm-host group of type host within vCenter for this failure domain.
- hostGroup is limited to 80 characters.
- This field is required when the VSphereFailureDomain ZoneType is HostGroup
- maxLength: 80
- minLength: 1
- type: string
- vmGroup:
- description: |-
- vmGroup is the name of the vm-host group of type virtual machine within vCenter for this failure domain.
- vmGroup is limited to 80 characters.
- This field is required when the VSphereFailureDomain ZoneType is HostGroup
- maxLength: 80
- minLength: 1
- type: string
- vmHostRule:
- description: |-
- vmHostRule is the name of the affinity vm-host rule within vCenter for this failure domain.
- vmHostRule is limited to 80 characters.
- This field is required when the VSphereFailureDomain ZoneType is HostGroup
- maxLength: 80
- minLength: 1
- type: string
- required:
- - hostGroup
- - vmGroup
- - vmHostRule
- type: object
- type:
- description: |-
- type determines the vSphere object type for a zone within this failure domain.
- Available types are ComputeCluster and HostGroup.
- When set to ComputeCluster, this means the vCenter cluster defined is the zone.
- When set to HostGroup, hostGroup must be configured with hostGroup, vmGroup and vmHostRule and
- this means the zone is defined by the grouping of those fields.
- enum:
- - HostGroup
- - ComputeCluster
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: hostGroup is required when type is HostGroup,
- and forbidden otherwise
- rule: 'has(self.type) && self.type == ''HostGroup''
- ? has(self.hostGroup) : !has(self.hostGroup)'
- required:
- - name
- - region
- - server
- - topology
- - zone
- type: object
- x-kubernetes-validations:
- - message: when zoneAffinity type is HostGroup, regionAffinity
- type must be ComputeCluster
- rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
- == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type
- == ''ComputeCluster'' : true'
- - message: when zoneAffinity type is ComputeCluster, regionAffinity
- type must be Datacenter
- rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
- == ''ComputeCluster'' ? has(self.regionAffinity) &&
- self.regionAffinity.type == ''Datacenter'' : true'
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.ingressIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- machineNetworks:
- description: |-
- machineNetworks are IP networks used to connect all the OpenShift cluster
- nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
- for example "10.0.0.0/8" or "fd00::/8".
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeNetworking:
- description: |-
- nodeNetworking contains the definition of internal and external network constraints for
- assigning the node's networking.
- If this field is omitted, networking defaults to the legacy
- address selection behavior which is to only support a single address and
- return the first one found.
- properties:
- external:
- description: external represents the network configuration
- of the node that is externally routable.
- properties:
- excludeNetworkSubnetCidr:
- description: |-
- excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
- the IP address from the VirtualMachine's VM for use in the status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: atomic
- network:
- description: |-
- network VirtualMachine's VM Network names that will be used to when searching
- for status.addresses fields. Note that if internal.networkSubnetCIDR and
- external.networkSubnetCIDR are not set, then the vNIC associated to this network must
- only have a single IP address assigned to it.
- The available networks (port groups) can be listed using
- `govc ls 'network/*'`
- type: string
- networkSubnetCidr:
- description: |-
- networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
- that will be used in respective status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: set
- type: object
- internal:
- description: internal represents the network configuration
- of the node that is routable only within the cluster.
- properties:
- excludeNetworkSubnetCidr:
- description: |-
- excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
- the IP address from the VirtualMachine's VM for use in the status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: atomic
- network:
- description: |-
- network VirtualMachine's VM Network names that will be used to when searching
- for status.addresses fields. Note that if internal.networkSubnetCIDR and
- external.networkSubnetCIDR are not set, then the vNIC associated to this network must
- only have a single IP address assigned to it.
- The available networks (port groups) can be listed using
- `govc ls 'network/*'`
- type: string
- networkSubnetCidr:
- description: |-
- networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
- that will be used in respective status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: set
- type: object
- type: object
- vcenters:
- description: |-
- vcenters holds the connection details for services to communicate with vCenter.
- Currently, only a single vCenter is supported, but in tech preview 3 vCenters are supported.
- Once the cluster has been installed, you are unable to change the current number of defined
- vCenters except in the case where the cluster has been upgraded from a version of OpenShift
- where the vsphere platform spec was not present. You may make modifications to the existing
- vCenters that are defined in the vcenters list in order to match with any added or modified
- failure domains.
- items:
- description: |-
- VSpherePlatformVCenterSpec stores the vCenter connection fields.
- This is used by the vSphere CCM.
- properties:
- datacenters:
- description: |-
- The vCenter Datacenters in which the RHCOS
- vm guests are located. This field will
- be used by the Cloud Controller Manager.
- Each datacenter listed here should be used within
- a topology.
- items:
- type: string
- minItems: 1
- type: array
- x-kubernetes-list-type: set
- port:
- description: |-
- port is the TCP port that will be used to communicate to
- the vCenter endpoint.
- When omitted, this means the user has no opinion and
- it is up to the platform to choose a sensible default,
- which is subject to change over time.
- format: int32
- maximum: 32767
- minimum: 1
- type: integer
- server:
- anyOf:
- - format: ipv4
- - format: ipv6
- - format: hostname
- description: server is the fully-qualified domain name
- or the IP address of the vCenter server.
- maxLength: 255
- type: string
- required:
- - datacenters
- - server
- type: object
- maxItems: 3
- minItems: 0
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: vcenters cannot be added or removed once set
- rule: 'size(self) != size(oldSelf) ? size(oldSelf) == 0
- && size(self) < 2 : true'
- type: object
- x-kubernetes-validations:
- - message: apiServerInternalIPs list is required once set
- rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
- - message: ingressIPs list is required once set
- rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
- - message: vcenters can have at most 1 item when configured post-install
- rule: '!has(oldSelf.vcenters) && has(self.vcenters) ? size(self.vcenters)
- < 2 : true'
- type: object
- x-kubernetes-validations:
- - message: vcenters can have at most 1 item when configured post-install
- rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? size(self.vsphere.vcenters)
- < 2 : true'
- type: object
- status:
- description: status holds observed values from the cluster. They may not
- be overridden.
- properties:
- apiServerInternalURI:
- description: |-
- apiServerInternalURL is a valid URI with scheme 'https',
- address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components
- like kubelets, to contact the Kubernetes API server using the
- infrastructure provider rather than Kubernetes networking.
- type: string
- apiServerURL:
- description: |-
- apiServerURL is a valid URI with scheme 'https', address and
- optionally a port (defaulting to 443). apiServerURL can be used by components like the web console
- to tell users where to find the Kubernetes API.
- type: string
- controlPlaneTopology:
- default: HighlyAvailable
- description: |-
- controlPlaneTopology expresses the expectations for operands that normally run on control nodes.
- The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
- The 'SingleReplica' mode will be used in single-node deployments
- and the operators should not configure the operand for highly-available operation
- The 'External' mode indicates that the control plane is hosted externally to the cluster and that
- its components are not visible within the cluster.
- enum:
- - HighlyAvailable
- - HighlyAvailableArbiter
- - SingleReplica
- - DualReplica
- - External
- type: string
- cpuPartitioning:
- default: None
- description: |-
- cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster.
- CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets.
- Valid values are "None" and "AllNodes". When omitted, the default value is "None".
- The default value of "None" indicates that no nodes will be setup with CPU partitioning.
- The "AllNodes" value indicates that all nodes have been setup with CPU partitioning,
- and can then be further configured via the PerformanceProfile API.
- enum:
- - None
- - AllNodes
- type: string
- etcdDiscoveryDomain:
- description: |-
- etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering
- etcd servers and clients.
- For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery
- deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.
- type: string
- infrastructureName:
- description: |-
- infrastructureName uniquely identifies a cluster with a human friendly name.
- Once set it should not be changed. Must be of max length 27 and must have only
- alphanumeric or hyphen characters.
- type: string
- infrastructureTopology:
- default: HighlyAvailable
- description: |-
- infrastructureTopology expresses the expectations for infrastructure services that do not run on control
- plane nodes, usually indicated by a node selector for a `role` value
- other than `master`.
- The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
- The 'SingleReplica' mode will be used in single-node deployments
- and the operators should not configure the operand for highly-available operation
- NOTE: External topology mode is not applicable for this field.
- enum:
- - HighlyAvailable
- - SingleReplica
- type: string
- platform:
- description: |-
- platform is the underlying infrastructure provider for the cluster.
-
- Deprecated: Use platformStatus.type instead.
- enum:
- - ""
- - AWS
- - Azure
- - BareMetal
- - GCP
- - Libvirt
- - OpenStack
- - None
- - VSphere
- - oVirt
- - IBMCloud
- - KubeVirt
- - EquinixMetal
- - PowerVS
- - AlibabaCloud
- - Nutanix
- - External
- type: string
- platformStatus:
- description: |-
- platformStatus holds status information specific to the underlying
- infrastructure provider.
- properties:
- alibabaCloud:
- description: alibabaCloud contains settings specific to the Alibaba
- Cloud infrastructure provider.
- properties:
- region:
- description: region specifies the region for Alibaba Cloud
- resources created for the cluster.
- pattern: ^[0-9A-Za-z-]+$
- type: string
- resourceGroupID:
- description: resourceGroupID is the ID of the resource group
- for the cluster.
- pattern: ^(rg-[0-9A-Za-z]+)?$
- type: string
- resourceTags:
- description: resourceTags is a list of additional tags to
- apply to Alibaba Cloud resources created for the cluster.
- items:
- description: AlibabaCloudResourceTag is the set of tags
- to add to apply to resources.
- properties:
- key:
- description: key is the key of the tag.
- maxLength: 128
- minLength: 1
- type: string
- value:
- description: value is the value of the tag.
- maxLength: 128
- minLength: 1
- type: string
- required:
- - key
- - value
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- required:
- - region
- type: object
- aws:
- description: aws contains settings specific to the Amazon Web
- Services infrastructure provider.
- properties:
- cloudLoadBalancerConfig:
- default:
- dnsType: PlatformDefault
- description: |-
- cloudLoadBalancerConfig holds configuration related to DNS and cloud
- load balancers. It allows configuration of in-cluster DNS as an alternative
- to the platform default DNS implementation.
- When using the ClusterHosted DNS type, Load Balancer IP addresses
- must be provided for the API and internal API load balancers as well as the
- ingress load balancer.
- nullable: true
- properties:
- clusterHosted:
- description: |-
- clusterHosted holds the IP addresses of API, API-Int and Ingress Load
- Balancers on Cloud Platforms. The DNS solution hosted within the cluster
- use these IP addresses to provide resolution for API, API-Int and Ingress
- services.
- properties:
- apiIntLoadBalancerIPs:
- description: |-
- apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the apiIntLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- apiLoadBalancerIPs:
- description: |-
- apiLoadBalancerIPs holds Load Balancer IPs for the API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Could be empty for private clusters.
- Entries in the apiLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- ingressLoadBalancerIPs:
- description: |-
- ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the ingressLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- type: object
- dnsType:
- default: PlatformDefault
- description: |-
- dnsType indicates the type of DNS solution in use within the cluster. Its default value of
- `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
- It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
- the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
- The cluster's use of the cloud's Load Balancers is unaffected by this setting.
- The value is immutable after it has been set at install time.
- Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
- Enabling this functionality allows the user to start their own DNS solution outside the cluster after
- installation is complete. The customer would be responsible for configuring this custom DNS solution,
- and it can be run in addition to the in-cluster DNS solution.
- enum:
- - ClusterHosted
- - PlatformDefault
- type: string
- x-kubernetes-validations:
- - message: dnsType is immutable
- rule: oldSelf == '' || self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: clusterHosted is permitted only when dnsType is
- ClusterHosted
- rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
- ? !has(self.clusterHosted) : true'
- ipFamily:
- default: IPv4
- description: |-
- ipFamily specifies the IP protocol family that should be used for AWS
- network resources. This controls whether AWS resources are created with
- IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
- protocol family.
- enum:
- - IPv4
- - DualStackIPv6Primary
- - DualStackIPv4Primary
- type: string
- x-kubernetes-validations:
- - message: ipFamily is immutable once set
- rule: oldSelf == '' || self == oldSelf
- region:
- description: region holds the default AWS region for new AWS
- resources created by the cluster.
- type: string
- resourceTags:
- description: |-
- resourceTags is a list of additional tags to apply to AWS resources created for the cluster.
- See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources.
- AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags
- available for the user.
- items:
- description: AWSResourceTag is a tag to apply to AWS resources
- created for the cluster.
- properties:
- key:
- description: |-
- key sets the key of the AWS resource tag key-value pair. Key is required when defining an AWS resource tag.
- Key should consist of between 1 and 128 characters, and may
- contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
- maxLength: 128
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: invalid AWS resource tag key. The string
- can contain only the set of alphanumeric characters,
- space (' '), '_', '.', '/', '=', '+', '-', ':',
- '@'
- rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
- value:
- description: |-
- value sets the value of the AWS resource tag key-value pair. Value is required when defining an AWS resource tag.
- Value should consist of between 1 and 256 characters, and may
- contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
- Some AWS service do not support empty values. Since tags are added to resources in many services, the
- length of the tag value must meet the requirements of all services.
- maxLength: 256
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: invalid AWS resource tag value. The string
- can contain only the set of alphanumeric characters,
- space (' '), '_', '.', '/', '=', '+', '-', ':',
- '@'
- rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
- required:
- - key
- - value
- type: object
- maxItems: 25
- type: array
- x-kubernetes-list-type: atomic
- serviceEndpoints:
- description: |-
- serviceEndpoints list contains custom endpoints which will override default
- service endpoint of AWS Services.
- There must be only one ServiceEndpoint for a service.
- items:
- description: |-
- AWSServiceEndpoint store the configuration of a custom url to
- override existing defaults of AWS Services.
- properties:
- name:
- description: |-
- name is the name of the AWS service.
- The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
- This must be provided and cannot be empty.
- pattern: ^[a-z0-9-]+$
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- pattern: ^https://
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- azure:
- description: azure contains settings specific to the Azure infrastructure
- provider.
- properties:
- armEndpoint:
- description: armEndpoint specifies a URL to use for resource
- management in non-soverign clouds such as Azure Stack.
- type: string
- cloudLoadBalancerConfig:
- default:
- dnsType: PlatformDefault
- description: |-
- cloudLoadBalancerConfig holds configuration related to DNS and cloud
- load balancers. It allows configuration of in-cluster DNS as an alternative
- to the platform default DNS implementation.
- When using the ClusterHosted DNS type, Load Balancer IP addresses
- must be provided for the API and internal API load balancers as well as the
- ingress load balancer.
- properties:
- clusterHosted:
- description: |-
- clusterHosted holds the IP addresses of API, API-Int and Ingress Load
- Balancers on Cloud Platforms. The DNS solution hosted within the cluster
- use these IP addresses to provide resolution for API, API-Int and Ingress
- services.
- properties:
- apiIntLoadBalancerIPs:
- description: |-
- apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the apiIntLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- apiLoadBalancerIPs:
- description: |-
- apiLoadBalancerIPs holds Load Balancer IPs for the API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Could be empty for private clusters.
- Entries in the apiLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- ingressLoadBalancerIPs:
- description: |-
- ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the ingressLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- type: object
- dnsType:
- default: PlatformDefault
- description: |-
- dnsType indicates the type of DNS solution in use within the cluster. Its default value of
- `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
- It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
- the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
- The cluster's use of the cloud's Load Balancers is unaffected by this setting.
- The value is immutable after it has been set at install time.
- Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
- Enabling this functionality allows the user to start their own DNS solution outside the cluster after
- installation is complete. The customer would be responsible for configuring this custom DNS solution,
- and it can be run in addition to the in-cluster DNS solution.
- enum:
- - ClusterHosted
- - PlatformDefault
- type: string
- x-kubernetes-validations:
- - message: dnsType is immutable
- rule: oldSelf == '' || self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: clusterHosted is permitted only when dnsType is
- ClusterHosted
- rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
- ? !has(self.clusterHosted) : true'
- cloudName:
- description: |-
- cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
- with the appropriate Azure API endpoints.
- If empty, the value is equal to `AzurePublicCloud`.
- enum:
- - ""
- - AzurePublicCloud
- - AzureUSGovernmentCloud
- - AzureChinaCloud
- - AzureGermanCloud
- - AzureStackCloud
- type: string
- ipFamily:
- default: IPv4
- description: |-
- ipFamily specifies the IP protocol family that should be used for Azure
- network resources. This controls whether Azure resources are created with
- IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
- protocol family.
- enum:
- - IPv4
- - DualStackIPv6Primary
- - DualStackIPv4Primary
- type: string
- x-kubernetes-validations:
- - message: ipFamily is immutable once set
- rule: oldSelf == '' || self == oldSelf
- networkResourceGroupName:
- description: |-
- networkResourceGroupName is the Resource Group for network resources like the Virtual Network and Subnets used by the cluster.
- If empty, the value is same as ResourceGroupName.
- type: string
- resourceGroupName:
- description: resourceGroupName is the Resource Group for new
- Azure resources created for the cluster.
- type: string
- resourceTags:
- description: |-
- resourceTags is a list of additional tags to apply to Azure resources created for the cluster.
- See https://docs.microsoft.com/en-us/rest/api/resources/tags for information on tagging Azure resources.
- Due to limitations on Automation, Content Delivery Network, DNS Azure resources, a maximum of 15 tags
- may be applied. OpenShift reserves 5 tags for internal use, allowing 10 tags for user configuration.
- items:
- description: AzureResourceTag is a tag to apply to Azure
- resources created for the cluster.
- properties:
- key:
- description: |-
- key is the key part of the tag. A tag key can have a maximum of 128 characters and cannot be empty. Key
- must begin with a letter, end with a letter, number or underscore, and must contain only alphanumeric
- characters and the following special characters `_ . -`.
- maxLength: 128
- minLength: 1
- pattern: ^[a-zA-Z]([0-9A-Za-z_.-]*[0-9A-Za-z_])?$
- type: string
- value:
- description: |-
- value is the value part of the tag. A tag value can have a maximum of 256 characters and cannot be empty. Value
- must contain only alphanumeric characters and the following special characters `_ + , - . / : ; < = > ? @`.
- maxLength: 256
- minLength: 1
- pattern: ^[0-9A-Za-z_.=+-@]+$
- type: string
- required:
- - key
- - value
- type: object
- maxItems: 10
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: resourceTags are immutable and may only be configured
- during installation
- rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
- type: object
- x-kubernetes-validations:
- - message: resourceTags may only be configured during installation
- rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
- || has(oldSelf.resourceTags) && has(self.resourceTags)'
- baremetal:
- description: baremetal contains settings specific to the BareMetal
- platform.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on BareMetal platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- machineNetworks:
- description: machineNetworks are IP networks used to connect
- all the OpenShift cluster nodes.
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeDNSIP:
- description: |-
- nodeDNSIP is the IP address for the internal DNS used by the
- nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
- provides name resolution for the nodes themselves. There is no DNS-as-a-service for
- BareMetal deployments. In order to minimize necessary changes to the
- datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
- to the nodes in the cluster.
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- equinixMetal:
- description: equinixMetal contains settings specific to the Equinix
- Metal infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
- type: string
- type: object
- external:
- description: external contains settings specific to the generic
- External infrastructure provider.
- properties:
- cloudControllerManager:
- description: |-
- cloudControllerManager contains settings specific to the external Cloud Controller Manager (a.k.a. CCM or CPI).
- When omitted, new nodes will be not tainted
- and no extra initialization from the cloud controller manager is expected.
- properties:
- state:
- description: |-
- state determines whether or not an external Cloud Controller Manager is expected to
- be installed within the cluster.
- https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager
-
- Valid values are "External", "None" and omitted.
- When set to "External", new nodes will be tainted as uninitialized when created,
- preventing them from running workloads until they are initialized by the cloud controller manager.
- When omitted or set to "None", new nodes will be not tainted
- and no extra initialization from the cloud controller manager is expected.
- enum:
- - ""
- - External
- - None
- type: string
- x-kubernetes-validations:
- - message: state is immutable once set
- rule: self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: state may not be added or removed once set
- rule: (has(self.state) == has(oldSelf.state)) || (!has(oldSelf.state)
- && self.state != "External")
- type: object
- x-kubernetes-validations:
- - message: cloudControllerManager may not be added or removed
- once set
- rule: has(self.cloudControllerManager) == has(oldSelf.cloudControllerManager)
- gcp:
- description: gcp contains settings specific to the Google Cloud
- Platform infrastructure provider.
- properties:
- cloudLoadBalancerConfig:
- default:
- dnsType: PlatformDefault
- description: |-
- cloudLoadBalancerConfig holds configuration related to DNS and cloud
- load balancers. It allows configuration of in-cluster DNS as an alternative
- to the platform default DNS implementation.
- When using the ClusterHosted DNS type, Load Balancer IP addresses
- must be provided for the API and internal API load balancers as well as the
- ingress load balancer.
- nullable: true
- properties:
- clusterHosted:
- description: |-
- clusterHosted holds the IP addresses of API, API-Int and Ingress Load
- Balancers on Cloud Platforms. The DNS solution hosted within the cluster
- use these IP addresses to provide resolution for API, API-Int and Ingress
- services.
- properties:
- apiIntLoadBalancerIPs:
- description: |-
- apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the apiIntLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- apiLoadBalancerIPs:
- description: |-
- apiLoadBalancerIPs holds Load Balancer IPs for the API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Could be empty for private clusters.
- Entries in the apiLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- ingressLoadBalancerIPs:
- description: |-
- ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the ingressLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- type: object
- dnsType:
- default: PlatformDefault
- description: |-
- dnsType indicates the type of DNS solution in use within the cluster. Its default value of
- `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
- It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
- the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
- The cluster's use of the cloud's Load Balancers is unaffected by this setting.
- The value is immutable after it has been set at install time.
- Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
- Enabling this functionality allows the user to start their own DNS solution outside the cluster after
- installation is complete. The customer would be responsible for configuring this custom DNS solution,
- and it can be run in addition to the in-cluster DNS solution.
- enum:
- - ClusterHosted
- - PlatformDefault
- type: string
- x-kubernetes-validations:
- - message: dnsType is immutable
- rule: oldSelf == '' || self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: clusterHosted is permitted only when dnsType is
- ClusterHosted
- rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
- ? !has(self.clusterHosted) : true'
- projectID:
- description: resourceGroupName is the Project ID for new GCP
- resources created for the cluster.
- type: string
- region:
- description: region holds the region for new GCP resources
- created for the cluster.
- type: string
- resourceLabels:
- description: |-
- resourceLabels is a list of additional labels to apply to GCP resources created for the cluster.
- See https://cloud.google.com/compute/docs/labeling-resources for information on labeling GCP resources.
- GCP supports a maximum of 64 labels per resource. OpenShift reserves 32 labels for internal use,
- allowing 32 labels for user configuration.
- items:
- description: GCPResourceLabel is a label to apply to GCP
- resources created for the cluster.
- properties:
- key:
- description: |-
- key is the key part of the label. A label key can have a maximum of 63 characters and cannot be empty.
- Label key must begin with a lowercase letter, and must contain only lowercase letters, numeric characters,
- and the following special characters `_-`. Label key must not have the reserved prefixes `kubernetes-io`
- and `openshift-io`.
- maxLength: 63
- minLength: 1
- pattern: ^[a-z][0-9a-z_-]{0,62}$
- type: string
- x-kubernetes-validations:
- - message: label keys must not start with either `openshift-io`
- or `kubernetes-io`
- rule: '!self.startsWith(''openshift-io'') && !self.startsWith(''kubernetes-io'')'
- value:
- description: |-
- value is the value part of the label. A label value can have a maximum of 63 characters and cannot be empty.
- Value must contain only lowercase letters, numeric characters, and the following special characters `_-`.
- maxLength: 63
- minLength: 1
- pattern: ^[0-9a-z_-]{1,63}$
- type: string
- required:
- - key
- - value
- type: object
- maxItems: 32
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- x-kubernetes-validations:
- - message: resourceLabels are immutable and may only be configured
- during installation
- rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
- resourceTags:
- description: |-
- resourceTags is a list of additional tags to apply to GCP resources created for the cluster.
- See https://cloud.google.com/resource-manager/docs/tags/tags-overview for information on
- tagging GCP resources. GCP supports a maximum of 50 tags per resource.
- items:
- description: GCPResourceTag is a tag to apply to GCP resources
- created for the cluster.
- properties:
- key:
- description: |-
- key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot be empty.
- Tag key must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
- alphanumeric characters, and the following special characters `._-`.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$
- type: string
- parentID:
- description: |-
- parentID is the ID of the hierarchical resource where the tags are defined,
- e.g. at the Organization or the Project level. To find the Organization or Project ID refer to the following pages:
- https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id,
- https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects.
- An OrganizationID must consist of decimal numbers, and cannot have leading zeroes.
- A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters, numbers,
- and hyphens, and must start with a letter, and cannot end with a hyphen.
- maxLength: 32
- minLength: 1
- pattern: (^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)
- type: string
- value:
- description: |-
- value is the value part of the tag. A tag value can have a maximum of 63 characters and cannot be empty.
- Tag value must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
- alphanumeric characters, and the following special characters `_-.@%=+:,*#&(){}[]` and spaces.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$
- type: string
- required:
- - key
- - parentID
- - value
- type: object
- maxItems: 50
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- x-kubernetes-validations:
- - message: resourceTags are immutable and may only be configured
- during installation
- rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
- type: object
- x-kubernetes-validations:
- - message: resourceLabels may only be configured during installation
- rule: '!has(oldSelf.resourceLabels) && !has(self.resourceLabels)
- || has(oldSelf.resourceLabels) && has(self.resourceLabels)'
- - message: resourceTags may only be configured during installation
- rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
- || has(oldSelf.resourceTags) && has(self.resourceTags)'
- ibmcloud:
- description: ibmcloud contains settings specific to the IBMCloud
- infrastructure provider.
- properties:
- cisInstanceCRN:
- description: |-
- cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
- the DNS zone for the cluster's base domain
- type: string
- dnsInstanceCRN:
- description: |-
- dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
- for the cluster's base domain
- type: string
- location:
- description: location is where the cluster has been deployed
- type: string
- providerType:
- description: providerType indicates the type of cluster that
- was created
- type: string
- resourceGroupName:
- description: resourceGroupName is the Resource Group for new
- IBMCloud resources created for the cluster.
- type: string
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of an IBM service. These endpoints are used by components
- within the cluster when trying to reach the IBM Cloud Services that have been
- overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
- endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
- are updated to reflect the same custom endpoints.
- items:
- description: |-
- IBMCloudServiceEndpoint stores the configuration of a custom url to
- override existing defaults of IBM Cloud Services.
- properties:
- name:
- description: |-
- name is the name of the IBM Cloud service.
- Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
- For example, the IBM Cloud Private IAM service could be configured with the
- service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
- Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
- with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty. The path must follow the pattern
- /v[0,9]+ or /api/v[0,9]+
- maxLength: 300
- type: string
- x-kubernetes-validations:
- - message: url must be a valid absolute URL
- rule: isURL(self)
- required:
- - name
- - url
- type: object
- maxItems: 13
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- kubevirt:
- description: kubevirt contains settings specific to the kubevirt
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
- type: string
- type: object
- nutanix:
- description: nutanix contains settings specific to the Nutanix
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on Nutanix platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- openstack:
- description: openstack contains settings specific to the OpenStack
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- cloudName:
- description: |-
- cloudName is the name of the desired OpenStack cloud in the
- client configuration file (`clouds.yaml`).
- type: string
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on OpenStack platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- machineNetworks:
- description: machineNetworks are IP networks used to connect
- all the OpenShift cluster nodes.
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeDNSIP:
- description: |-
- nodeDNSIP is the IP address for the internal DNS used by the
- nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
- provides name resolution for the nodes themselves. There is no DNS-as-a-service for
- OpenStack deployments. In order to minimize necessary changes to the
- datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
- to the nodes in the cluster.
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- ovirt:
- description: ovirt contains settings specific to the oVirt infrastructure
- provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on Ovirt platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- nodeDNSIP:
- description: 'deprecated: as of 4.6, this field is no longer
- set or honored. It will be removed in a future release.'
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- powervs:
- description: powervs contains settings specific to the Power Systems
- Virtual Servers infrastructure provider.
- properties:
- cisInstanceCRN:
- description: |-
- cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
- the DNS zone for the cluster's base domain
- type: string
- dnsInstanceCRN:
- description: |-
- dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
- for the cluster's base domain
- type: string
- region:
- description: region holds the default Power VS region for
- new Power VS resources created by the cluster.
- type: string
- resourceGroup:
- description: |-
- resourceGroup is the resource group name for new IBMCloud resources created for a cluster.
- The resource group specified here will be used by cluster-image-registry-operator to set up a COS Instance in IBMCloud for the cluster registry.
- More about resource groups can be found here: https://cloud.ibm.com/docs/account?topic=account-rgs.
- When omitted, the image registry operator won't be able to configure storage,
- which results in the image registry cluster operator not being in an available state.
- maxLength: 40
- pattern: ^[a-zA-Z0-9-_ ]+$
- type: string
- x-kubernetes-validations:
- - message: resourceGroup is immutable once set
- rule: oldSelf == '' || self == oldSelf
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of a Power VS service.
- items:
- description: |-
- PowervsServiceEndpoint stores the configuration of a custom url to
- override existing defaults of PowerVS Services.
- properties:
- name:
- description: |-
- name is the name of the Power VS service.
- Few of the services are
- IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
- ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
- Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - Power
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- format: uri
- pattern: ^https://
- type: string
- required:
- - name
- - url
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- zone:
- description: |-
- zone holds the default zone for the new Power VS resources created by the cluster.
- Note: Currently only single-zone OCP clusters are supported
- type: string
- type: object
- x-kubernetes-validations:
- - message: cannot unset resourceGroup once set
- rule: '!has(oldSelf.resourceGroup) || has(self.resourceGroup)'
- type:
- description: |-
- type is the underlying infrastructure provider for the cluster. This
- value controls whether infrastructure automation such as service load
- balancers, dynamic volume provisioning, machine creation and deletion, and
- other integrations are enabled. If None, no infrastructure automation is
- enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
- "OpenStack", "VSphere", "oVirt", "EquinixMetal", "PowerVS", "AlibabaCloud", "Nutanix" and "None".
- Individual components may not support all platforms, and must handle
- unrecognized platforms as None if they do not support that platform.
-
- This value will be synced with to the `status.platform` and `status.platformStatus.type`.
- Currently this value cannot be changed once set.
- enum:
- - ""
- - AWS
- - Azure
- - BareMetal
- - GCP
- - Libvirt
- - OpenStack
- - None
- - VSphere
- - oVirt
- - IBMCloud
- - KubeVirt
- - EquinixMetal
- - PowerVS
- - AlibabaCloud
- - Nutanix
- - External
- type: string
- vsphere:
- description: vsphere contains settings specific to the VSphere
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on VSphere platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- machineNetworks:
- description: machineNetworks are IP networks used to connect
- all the OpenShift cluster nodes.
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeDNSIP:
- description: |-
- nodeDNSIP is the IP address for the internal DNS used by the
- nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
- provides name resolution for the nodes themselves. There is no DNS-as-a-service for
- vSphere deployments. In order to minimize necessary changes to the
- datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
- to the nodes in the cluster.
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- type: object
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-CustomNoUpgrade.crd.yaml
new file mode 100644
index 000000000..2829b41dc
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-CustomNoUpgrade.crd.yaml
@@ -0,0 +1,2798 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: CustomNoUpgrade
+ name: infrastructures.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Infrastructure
+ listKind: InfrastructureList
+ plural: infrastructures
+ singular: infrastructure
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Infrastructure holds cluster-wide information about Infrastructure. The canonical name is `cluster`
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ cloudConfig:
+ description: |-
+ cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file.
+ This configuration file is used to configure the Kubernetes cloud provider integration
+ when using the built-in cloud provider integration or the external cloud controller manager.
+ The namespace for this config map is openshift-config.
+
+ cloudConfig should only be consumed by the kube_cloud_config controller.
+ The controller is responsible for using the user configuration in the spec
+ for various platforms and combining that with the user provided ConfigMap in this field
+ to create a stitched kube cloud config.
+ The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace
+ with the kube cloud config is stored in `cloud.conf` key.
+ All the clients are expected to use the generated ConfigMap only.
+ properties:
+ key:
+ description: key allows pointing to a specific key/value inside
+ of the configmap. This is useful for logical file references.
+ type: string
+ name:
+ type: string
+ type: object
+ controlPlaneTopology:
+ description: |-
+ controlPlaneTopology expresses the desired topology configuration for control nodes.
+
+ When status.controlPlaneTopology is 'SingleReplica' and spec.controlPlaneTopology is set to 'HighlyAvailable',
+ a transition will be triggered to reconfigure the cluster from SingleReplica to HighlyAvailable.
+
+ When left blank or status.controlPlaneTopology and spec.controlPlaneTopology are the same value,
+ no changes are required and no transitions will be triggered.
+
+ This value may be set to match status.controlPlaneTopology regardless of the current value.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ platformSpec:
+ description: |-
+ platformSpec holds desired information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ type: object
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ type: object
+ external:
+ description: |-
+ ExternalPlatformType represents generic infrastructure provider.
+ Platform-specific components should be supplemented separately.
+ properties:
+ platformName:
+ default: Unknown
+ description: |-
+ platformName holds the arbitrary string representing the infrastructure provider name, expected to be set at the installation time.
+ This field is solely for informational and reporting purposes and is not expected to be used for decision-making.
+ type: string
+ x-kubernetes-validations:
+ - message: platform name cannot be changed once set
+ rule: oldSelf == 'Unknown' || self == oldSelf
+ type: object
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ type: object
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ A maximum of 13 service endpoints overrides are supported.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must use https scheme
+ rule: url(self).getScheme() == "https"
+ - message: url path must match /v[0,9]+ or /api/v[0,9]+
+ rule: matches((url(self).getEscapedPath()), '^/(api/)?v[0-9]+/{0,1}$')
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ failureDomains:
+ description: |-
+ failureDomains configures failure domains information for the Nutanix platform.
+ When set, the failure domains defined here may be used to spread Machines across
+ prism element clusters to improve fault tolerance of the cluster.
+ items:
+ description: NutanixFailureDomain configures failure domain
+ information for the Nutanix platform.
+ properties:
+ cluster:
+ description: |-
+ cluster is to identify the cluster (the Prism Element under management of the Prism Central),
+ in which the Machine's VM will be created. The cluster identifier (uuid or name) can be obtained
+ from the Prism Central console or using the prism_central API.
+ properties:
+ name:
+ description: name is the resource name in the PC.
+ It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource in
+ the PC. It cannot be empty if the type is UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ name:
+ description: |-
+ name defines the unique name of a failure domain.
+ Name is required and must be at most 64 characters in length.
+ It must consist of only lower case alphanumeric characters and hyphens (-).
+ It must start and end with an alphanumeric character.
+ This value is arbitrary and is used to identify the failure domain within the platform.
+ maxLength: 64
+ minLength: 1
+ pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?'
+ type: string
+ subnets:
+ description: |-
+ subnets holds a list of identifiers (one or more) of the cluster's network subnets
+ If the feature gate NutanixMultiSubnets is enabled, up to 32 subnets may be configured.
+ for the Machine's VM to connect to. The subnet identifiers (uuid or name) can be
+ obtained from the Prism Central console or using the prism_central API.
+ items:
+ description: NutanixResourceIdentifier holds the identity
+ of a Nutanix PC resource (cluster, image, subnet,
+ etc.)
+ properties:
+ name:
+ description: name is the resource name in the
+ PC. It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource
+ in the PC. It cannot be empty if the type is
+ UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ maxItems: 32
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: each subnet must be unique
+ rule: self.all(x, self.exists_one(y, x == y))
+ required:
+ - cluster
+ - name
+ - subnets
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ prismCentral:
+ description: |-
+ prismCentral holds the endpoint address and port to access the Nutanix Prism Central.
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS name
+ or IP address) of the Nutanix Prism Central or Element
+ (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the Nutanix
+ Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ prismElements:
+ description: |-
+ prismElements holds one or more endpoint address and port data to access the Nutanix
+ Prism Elements (clusters) of the Nutanix Prism Central. Currently we only support one
+ Prism Element (cluster) for an OpenShift cluster, where all the Nutanix resources (VMs, subnets, volumes, etc.)
+ used in the OpenShift cluster are located. In the future, we may support Nutanix resources (VMs, etc.)
+ spread over multiple Prism Elements (clusters) of the Prism Central.
+ items:
+ description: NutanixPrismElementEndpoint holds the name
+ and endpoint data for a Prism Element (cluster)
+ properties:
+ endpoint:
+ description: |-
+ endpoint holds the endpoint address and port data of the Prism Element (cluster).
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS
+ name or IP address) of the Nutanix Prism Central
+ or Element (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the
+ Nutanix Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ name:
+ description: |-
+ name is the name of the Prism Element (cluster). This value will correspond with
+ the cluster field configured on other resources (eg Machines, PVCs, etc).
+ maxLength: 256
+ type: string
+ required:
+ - endpoint
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - prismCentral
+ - prismElements
+ type: object
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ type: object
+ powervs:
+ description: powervs contains settings specific to the IBM Power
+ Systems Virtual Servers infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "IBMCloud", "KubeVirt", "EquinixMetal",
+ "PowerVS", "AlibabaCloud", "Nutanix", "External", and "None". Individual
+ components may not support all platforms, and must handle unrecognized
+ platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ failureDomains:
+ description: |-
+ failureDomains contains the definition of region, zone and the vCenter topology.
+ If this is omitted failure domains (regions and zones) will not be used.
+ items:
+ description: VSpherePlatformFailureDomainSpec holds the
+ region and zone failure domain and the vCenter topology
+ of that failure domain.
+ properties:
+ name:
+ description: |-
+ name defines the arbitrary but unique name
+ of a failure domain.
+ maxLength: 256
+ minLength: 1
+ type: string
+ region:
+ description: |-
+ region defines the name of a region tag that will
+ be attached to a vCenter datacenter. The tag
+ category in vCenter must be named openshift-region.
+ maxLength: 80
+ minLength: 1
+ type: string
+ regionAffinity:
+ description: |-
+ regionAffinity holds the type of region, Datacenter or ComputeCluster.
+ When set to Datacenter, this means the region is a vCenter Datacenter as defined in topology.
+ When set to ComputeCluster, this means the region is a vCenter Cluster as defined in topology.
+ properties:
+ type:
+ description: |-
+ type determines the vSphere object type for a region within this failure domain.
+ Available types are Datacenter and ComputeCluster.
+ When set to Datacenter, this means the vCenter Datacenter defined is the region.
+ When set to ComputeCluster, this means the vCenter cluster defined is the region.
+ enum:
+ - ComputeCluster
+ - Datacenter
+ type: string
+ required:
+ - type
+ type: object
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ minLength: 1
+ type: string
+ topology:
+ description: topology describes a given failure domain
+ using vSphere constructs
+ properties:
+ computeCluster:
+ description: |-
+ computeCluster the absolute path of the vCenter cluster
+ in which virtual machine will be located.
+ The absolute path is of the form //host/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?
+ type: string
+ datacenter:
+ description: |-
+ datacenter is the name of vCenter datacenter in which virtual machines will be located.
+ The maximum length of the datacenter name is 80 characters.
+ maxLength: 80
+ type: string
+ datastore:
+ description: |-
+ datastore is the absolute path of the datastore in which the
+ virtual machine is located.
+ The absolute path is of the form //datastore/
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/datastore/.*?
+ type: string
+ folder:
+ description: |-
+ folder is the absolute path of the folder where
+ virtual machines are located. The absolute path
+ is of the form //vm/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/vm/.*?
+ type: string
+ networks:
+ description: |-
+ networks is the list of port group network names within this failure domain.
+ If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined.
+ 10 is the maximum number of virtual network devices which may be attached to a VM as defined by:
+ https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ Networks should be in the form of an absolute path:
+ //network/.
+ items:
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ resourcePool:
+ description: |-
+ resourcePool is the absolute path of the resource pool where virtual machines will be
+ created. The absolute path is of the form //host//Resources/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?/Resources.*
+ type: string
+ template:
+ description: |-
+ template is the full inventory path of the virtual machine or template
+ that will be cloned when creating new machines in this failure domain.
+ The maximum length of the path is 2048 characters.
+
+ When omitted, the template will be calculated by the control plane
+ machineset operator based on the region and zone defined in
+ VSpherePlatformFailureDomainSpec.
+ For example, for zone=zonea, region=region1, and infrastructure name=test,
+ the template path would be calculated as //vm/test-rhcos-region1-zonea.
+ maxLength: 2048
+ minLength: 1
+ pattern: ^/.*?/vm/.*?
+ type: string
+ required:
+ - computeCluster
+ - datacenter
+ - datastore
+ - networks
+ type: object
+ zone:
+ description: |-
+ zone defines the name of a zone tag that will
+ be attached to a vCenter cluster. The tag
+ category in vCenter must be named openshift-zone.
+ maxLength: 80
+ minLength: 1
+ type: string
+ zoneAffinity:
+ description: |-
+ zoneAffinity holds the type of the zone and the hostGroup which
+ vmGroup and the hostGroup names in vCenter corresponds to
+ a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup holds the vmGroup and the hostGroup names in vCenter
+ corresponds to a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup is the name of the vm-host group of type host within vCenter for this failure domain.
+ hostGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmGroup:
+ description: |-
+ vmGroup is the name of the vm-host group of type virtual machine within vCenter for this failure domain.
+ vmGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmHostRule:
+ description: |-
+ vmHostRule is the name of the affinity vm-host rule within vCenter for this failure domain.
+ vmHostRule is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ required:
+ - hostGroup
+ - vmGroup
+ - vmHostRule
+ type: object
+ type:
+ description: |-
+ type determines the vSphere object type for a zone within this failure domain.
+ Available types are ComputeCluster and HostGroup.
+ When set to ComputeCluster, this means the vCenter cluster defined is the zone.
+ When set to HostGroup, hostGroup must be configured with hostGroup, vmGroup and vmHostRule and
+ this means the zone is defined by the grouping of those fields.
+ enum:
+ - HostGroup
+ - ComputeCluster
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: hostGroup is required when type is HostGroup,
+ and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''HostGroup''
+ ? has(self.hostGroup) : !has(self.hostGroup)'
+ required:
+ - name
+ - region
+ - server
+ - topology
+ - zone
+ type: object
+ x-kubernetes-validations:
+ - message: when zoneAffinity type is HostGroup, regionAffinity
+ type must be ComputeCluster
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type
+ == ''ComputeCluster'' : true'
+ - message: when zoneAffinity type is ComputeCluster, regionAffinity
+ type must be Datacenter
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''ComputeCluster'' ? has(self.regionAffinity) &&
+ self.regionAffinity.type == ''Datacenter'' : true'
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeNetworking:
+ description: |-
+ nodeNetworking contains the definition of internal and external network constraints for
+ assigning the node's networking.
+ If this field is omitted, networking defaults to the legacy
+ address selection behavior which is to only support a single address and
+ return the first one found.
+ properties:
+ external:
+ description: external represents the network configuration
+ of the node that is externally routable.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ internal:
+ description: internal represents the network configuration
+ of the node that is routable only within the cluster.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ type: object
+ vcenters:
+ description: |-
+ vcenters holds the connection details for services to communicate with vCenter.
+ Up to 3 vCenters are supported.
+ Once the cluster has been installed, you are unable to change the current number of defined
+ vCenters except when 1.) the cluster has been upgraded from a version of OpenShift
+ where the vsphere platform spec was not present or 2.) in TechPreview you are able to add and
+ remove vCenters but may not remove all vCenters. You may make modifications to the existing
+ vCenters that are defined in the vcenters list in order to match with any added or modified
+ failure domains.
+ items:
+ description: |-
+ VSpherePlatformVCenterSpec stores the vCenter connection fields.
+ This is used by the vSphere CCM.
+ properties:
+ datacenters:
+ description: |-
+ The vCenter Datacenters in which the RHCOS
+ vm guests are located. This field will
+ be used by the Cloud Controller Manager.
+ Each datacenter listed here should be used within
+ a topology.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the TCP port that will be used to communicate to
+ the vCenter endpoint.
+ When omitted, this means the user has no opinion and
+ it is up to the platform to choose a sensible default,
+ which is subject to change over time.
+ format: int32
+ maximum: 32767
+ minimum: 1
+ type: integer
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ type: string
+ required:
+ - datacenters
+ - server
+ type: object
+ maxItems: 3
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x, self.exists(y,
+ y.server == x.server)) : true'
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) < size(oldSelf) ? self.all(x, oldSelf.exists(y,
+ y.server == x.server)) : true'
+ - message: vcenters must have unique server values
+ rule: self.all(x, self.exists_one(y, y.server == x.server))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ type: object
+ x-kubernetes-validations:
+ - message: vcenters is required once set and cannot be removed
+ rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
+ : true'
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ apiServerInternalURI:
+ description: |-
+ apiServerInternalURL is a valid URI with scheme 'https',
+ address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components
+ like kubelets, to contact the Kubernetes API server using the
+ infrastructure provider rather than Kubernetes networking.
+ type: string
+ apiServerURL:
+ description: |-
+ apiServerURL is a valid URI with scheme 'https', address and
+ optionally a port (defaulting to 443). apiServerURL can be used by components like the web console
+ to tell users where to find the Kubernetes API.
+ type: string
+ controlPlaneTopology:
+ default: HighlyAvailable
+ description: |-
+ controlPlaneTopology expresses the expectations for operands that normally run on control nodes.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ The 'External' mode indicates that the control plane is hosted externally to the cluster and that
+ its components are not visible within the cluster.
+ The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes
+ that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.
+ enum:
+ - HighlyAvailable
+ - HighlyAvailableArbiter
+ - SingleReplica
+ - DualReplica
+ - External
+ type: string
+ cpuPartitioning:
+ default: None
+ description: |-
+ cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster.
+ CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets.
+ Valid values are "None" and "AllNodes". When omitted, the default value is "None".
+ The default value of "None" indicates that no nodes will be setup with CPU partitioning.
+ The "AllNodes" value indicates that all nodes have been setup with CPU partitioning,
+ and can then be further configured via the PerformanceProfile API.
+ enum:
+ - None
+ - AllNodes
+ type: string
+ etcdDiscoveryDomain:
+ description: |-
+ etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering
+ etcd servers and clients.
+ For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery
+ deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.
+ type: string
+ infrastructureName:
+ description: |-
+ infrastructureName uniquely identifies a cluster with a human friendly name.
+ Once set it should not be changed. Must be of max length 27 and must have only
+ alphanumeric or hyphen characters.
+ type: string
+ infrastructureTopology:
+ default: HighlyAvailable
+ description: |-
+ infrastructureTopology expresses the expectations for infrastructure services that do not run on control
+ plane nodes, usually indicated by a node selector for a `role` value
+ other than `master`.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ NOTE: External topology mode is not applicable for this field.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ platform:
+ description: |-
+ platform is the underlying infrastructure provider for the cluster.
+
+ Deprecated: Use platformStatus.type instead.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ platformStatus:
+ description: |-
+ platformStatus holds status information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ properties:
+ region:
+ description: region specifies the region for Alibaba Cloud
+ resources created for the cluster.
+ pattern: ^[0-9A-Za-z-]+$
+ type: string
+ resourceGroupID:
+ description: resourceGroupID is the ID of the resource group
+ for the cluster.
+ pattern: ^(rg-[0-9A-Za-z]+)?$
+ type: string
+ resourceTags:
+ description: resourceTags is a list of additional tags to
+ apply to Alibaba Cloud resources created for the cluster.
+ items:
+ description: AlibabaCloudResourceTag is the set of tags
+ to add to apply to resources.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ value:
+ description: value is the value of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ required:
+ - region
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for AWS
+ network resources. This controls whether AWS resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ region:
+ description: region holds the default AWS region for new AWS
+ resources created by the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created for the cluster.
+ See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources.
+ AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags
+ available for the user.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key sets the key of the AWS resource tag key-value pair. Key is required when defining an AWS resource tag.
+ Key should consist of between 1 and 128 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ maxLength: 128
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag key. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ value:
+ description: |-
+ value sets the value of the AWS resource tag key-value pair. Value is required when defining an AWS resource tag.
+ Value should consist of between 1 and 256 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ Some AWS service do not support empty values. Since tags are added to resources in many services, the
+ length of the tag value must meet the requirements of all services.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag value. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ properties:
+ armEndpoint:
+ description: armEndpoint specifies a URL to use for resource
+ management in non-soverign clouds such as Azure Stack.
+ type: string
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ cloudName:
+ description: |-
+ cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
+ with the appropriate Azure API endpoints.
+ If empty, the value is equal to `AzurePublicCloud`.
+ enum:
+ - ""
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for Azure
+ network resources. This controls whether Azure resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ networkResourceGroupName:
+ description: |-
+ networkResourceGroupName is the Resource Group for network resources like the Virtual Network and Subnets used by the cluster.
+ If empty, the value is same as ResourceGroupName.
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ Azure resources created for the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to Azure resources created for the cluster.
+ See https://docs.microsoft.com/en-us/rest/api/resources/tags for information on tagging Azure resources.
+ Due to limitations on Automation, Content Delivery Network, DNS Azure resources, a maximum of 15 tags
+ may be applied. OpenShift reserves 5 tags for internal use, allowing 10 tags for user configuration.
+ items:
+ description: AzureResourceTag is a tag to apply to Azure
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 128 characters and cannot be empty. Key
+ must begin with a letter, end with a letter, number or underscore, and must contain only alphanumeric
+ characters and the following special characters `_ . -`.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[a-zA-Z]([0-9A-Za-z_.-]*[0-9A-Za-z_])?$
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 256 characters and cannot be empty. Value
+ must contain only alphanumeric characters and the following special characters `_ + , - . / : ; < = > ? @`.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on BareMetal platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ BareMetal deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ external:
+ description: external contains settings specific to the generic
+ External infrastructure provider.
+ properties:
+ cloudControllerManager:
+ description: |-
+ cloudControllerManager contains settings specific to the external Cloud Controller Manager (a.k.a. CCM or CPI).
+ When omitted, new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ properties:
+ state:
+ description: |-
+ state determines whether or not an external Cloud Controller Manager is expected to
+ be installed within the cluster.
+ https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager
+
+ Valid values are "External", "None" and omitted.
+ When set to "External", new nodes will be tainted as uninitialized when created,
+ preventing them from running workloads until they are initialized by the cloud controller manager.
+ When omitted or set to "None", new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ enum:
+ - ""
+ - External
+ - None
+ type: string
+ x-kubernetes-validations:
+ - message: state is immutable once set
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: state may not be added or removed once set
+ rule: (has(self.state) == has(oldSelf.state)) || (!has(oldSelf.state)
+ && self.state != "External")
+ type: object
+ x-kubernetes-validations:
+ - message: cloudControllerManager may not be added or removed
+ once set
+ rule: has(self.cloudControllerManager) == has(oldSelf.cloudControllerManager)
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ projectID:
+ description: resourceGroupName is the Project ID for new GCP
+ resources created for the cluster.
+ type: string
+ region:
+ description: region holds the region for new GCP resources
+ created for the cluster.
+ type: string
+ resourceLabels:
+ description: |-
+ resourceLabels is a list of additional labels to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/compute/docs/labeling-resources for information on labeling GCP resources.
+ GCP supports a maximum of 64 labels per resource. OpenShift reserves 32 labels for internal use,
+ allowing 32 labels for user configuration.
+ items:
+ description: GCPResourceLabel is a label to apply to GCP
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the label. A label key can have a maximum of 63 characters and cannot be empty.
+ Label key must begin with a lowercase letter, and must contain only lowercase letters, numeric characters,
+ and the following special characters `_-`. Label key must not have the reserved prefixes `kubernetes-io`
+ and `openshift-io`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z][0-9a-z_-]{0,62}$
+ type: string
+ x-kubernetes-validations:
+ - message: label keys must not start with either `openshift-io`
+ or `kubernetes-io`
+ rule: '!self.startsWith(''openshift-io'') && !self.startsWith(''kubernetes-io'')'
+ value:
+ description: |-
+ value is the value part of the label. A label value can have a maximum of 63 characters and cannot be empty.
+ Value must contain only lowercase letters, numeric characters, and the following special characters `_-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[0-9a-z_-]{1,63}$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceLabels are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/resource-manager/docs/tags/tags-overview for information on
+ tagging GCP resources. GCP supports a maximum of 50 tags per resource.
+ items:
+ description: GCPResourceTag is a tag to apply to GCP resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot be empty.
+ Tag key must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `._-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$
+ type: string
+ parentID:
+ description: |-
+ parentID is the ID of the hierarchical resource where the tags are defined,
+ e.g. at the Organization or the Project level. To find the Organization or Project ID refer to the following pages:
+ https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id,
+ https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects.
+ An OrganizationID must consist of decimal numbers, and cannot have leading zeroes.
+ A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters, numbers,
+ and hyphens, and must start with a letter, and cannot end with a hyphen.
+ maxLength: 32
+ minLength: 1
+ pattern: (^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 63 characters and cannot be empty.
+ Tag value must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `_-.@%=+:,*#&(){}[]` and spaces.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$
+ type: string
+ required:
+ - key
+ - parentID
+ - value
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceLabels may only be configured during installation
+ rule: '!has(oldSelf.resourceLabels) && !has(self.resourceLabels)
+ || has(oldSelf.resourceLabels) && has(self.resourceLabels)'
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ location:
+ description: location is where the cluster has been deployed
+ type: string
+ providerType:
+ description: providerType indicates the type of cluster that
+ was created
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ IBMCloud resources created for the cluster.
+ type: string
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Nutanix platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ cloudName:
+ description: |-
+ cloudName is the name of the desired OpenStack cloud in the
+ client configuration file (`clouds.yaml`).
+ type: string
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on OpenStack platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ OpenStack deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Ovirt platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ nodeDNSIP:
+ description: 'deprecated: as of 4.6, this field is no longer
+ set or honored. It will be removed in a future release.'
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ powervs:
+ description: powervs contains settings specific to the Power Systems
+ Virtual Servers infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ region:
+ description: region holds the default Power VS region for
+ new Power VS resources created by the cluster.
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the resource group name for new IBMCloud resources created for a cluster.
+ The resource group specified here will be used by cluster-image-registry-operator to set up a COS Instance in IBMCloud for the cluster registry.
+ More about resource groups can be found here: https://cloud.ibm.com/docs/account?topic=account-rgs.
+ When omitted, the image registry operator won't be able to configure storage,
+ which results in the image registry cluster operator not being in an available state.
+ maxLength: 40
+ pattern: ^[a-zA-Z0-9-_ ]+$
+ type: string
+ x-kubernetes-validations:
+ - message: resourceGroup is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ zone:
+ description: |-
+ zone holds the default zone for the new Power VS resources created by the cluster.
+ Note: Currently only single-zone OCP clusters are supported
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot unset resourceGroup once set
+ rule: '!has(oldSelf.resourceGroup) || has(self.resourceGroup)'
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "EquinixMetal", "PowerVS", "AlibabaCloud", "Nutanix" and "None".
+ Individual components may not support all platforms, and must handle
+ unrecognized platforms as None if they do not support that platform.
+
+ This value will be synced with to the `status.platform` and `status.platformStatus.type`.
+ Currently this value cannot be changed once set.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on VSphere platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ vSphere deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ type: object
+ type: object
+ required:
+ - spec
+ type: object
+ x-kubernetes-validations:
+ - message: spec.controlPlaneTopology must match status.controlPlaneTopology
+ or be set to HighlyAvailable when status.controlPlaneTopology is SingleReplica
+ rule: '!has(self.spec.controlPlaneTopology) || (has(oldSelf.spec.controlPlaneTopology)
+ && self.spec.controlPlaneTopology == oldSelf.spec.controlPlaneTopology)
+ || (has(self.status.controlPlaneTopology) && self.spec.controlPlaneTopology
+ == self.status.controlPlaneTopology) || (has(self.status.controlPlaneTopology)
+ && self.status.controlPlaneTopology == ''SingleReplica'' && self.spec.controlPlaneTopology
+ == ''HighlyAvailable'')'
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-DevPreviewNoUpgrade.crd.yaml
new file mode 100644
index 000000000..a3064161f
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-DevPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,2774 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: DevPreviewNoUpgrade
+ name: infrastructures.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Infrastructure
+ listKind: InfrastructureList
+ plural: infrastructures
+ singular: infrastructure
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Infrastructure holds cluster-wide information about Infrastructure. The canonical name is `cluster`
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ cloudConfig:
+ description: |-
+ cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file.
+ This configuration file is used to configure the Kubernetes cloud provider integration
+ when using the built-in cloud provider integration or the external cloud controller manager.
+ The namespace for this config map is openshift-config.
+
+ cloudConfig should only be consumed by the kube_cloud_config controller.
+ The controller is responsible for using the user configuration in the spec
+ for various platforms and combining that with the user provided ConfigMap in this field
+ to create a stitched kube cloud config.
+ The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace
+ with the kube cloud config is stored in `cloud.conf` key.
+ All the clients are expected to use the generated ConfigMap only.
+ properties:
+ key:
+ description: key allows pointing to a specific key/value inside
+ of the configmap. This is useful for logical file references.
+ type: string
+ name:
+ type: string
+ type: object
+ platformSpec:
+ description: |-
+ platformSpec holds desired information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ type: object
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ type: object
+ external:
+ description: |-
+ ExternalPlatformType represents generic infrastructure provider.
+ Platform-specific components should be supplemented separately.
+ properties:
+ platformName:
+ default: Unknown
+ description: |-
+ platformName holds the arbitrary string representing the infrastructure provider name, expected to be set at the installation time.
+ This field is solely for informational and reporting purposes and is not expected to be used for decision-making.
+ type: string
+ x-kubernetes-validations:
+ - message: platform name cannot be changed once set
+ rule: oldSelf == 'Unknown' || self == oldSelf
+ type: object
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ type: object
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ A maximum of 13 service endpoints overrides are supported.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must use https scheme
+ rule: url(self).getScheme() == "https"
+ - message: url path must match /v[0,9]+ or /api/v[0,9]+
+ rule: matches((url(self).getEscapedPath()), '^/(api/)?v[0-9]+/{0,1}$')
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ failureDomains:
+ description: |-
+ failureDomains configures failure domains information for the Nutanix platform.
+ When set, the failure domains defined here may be used to spread Machines across
+ prism element clusters to improve fault tolerance of the cluster.
+ items:
+ description: NutanixFailureDomain configures failure domain
+ information for the Nutanix platform.
+ properties:
+ cluster:
+ description: |-
+ cluster is to identify the cluster (the Prism Element under management of the Prism Central),
+ in which the Machine's VM will be created. The cluster identifier (uuid or name) can be obtained
+ from the Prism Central console or using the prism_central API.
+ properties:
+ name:
+ description: name is the resource name in the PC.
+ It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource in
+ the PC. It cannot be empty if the type is UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ name:
+ description: |-
+ name defines the unique name of a failure domain.
+ Name is required and must be at most 64 characters in length.
+ It must consist of only lower case alphanumeric characters and hyphens (-).
+ It must start and end with an alphanumeric character.
+ This value is arbitrary and is used to identify the failure domain within the platform.
+ maxLength: 64
+ minLength: 1
+ pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?'
+ type: string
+ subnets:
+ description: |-
+ subnets holds a list of identifiers (one or more) of the cluster's network subnets
+ If the feature gate NutanixMultiSubnets is enabled, up to 32 subnets may be configured.
+ for the Machine's VM to connect to. The subnet identifiers (uuid or name) can be
+ obtained from the Prism Central console or using the prism_central API.
+ items:
+ description: NutanixResourceIdentifier holds the identity
+ of a Nutanix PC resource (cluster, image, subnet,
+ etc.)
+ properties:
+ name:
+ description: name is the resource name in the
+ PC. It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource
+ in the PC. It cannot be empty if the type is
+ UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ maxItems: 32
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: each subnet must be unique
+ rule: self.all(x, self.exists_one(y, x == y))
+ required:
+ - cluster
+ - name
+ - subnets
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ prismCentral:
+ description: |-
+ prismCentral holds the endpoint address and port to access the Nutanix Prism Central.
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS name
+ or IP address) of the Nutanix Prism Central or Element
+ (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the Nutanix
+ Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ prismElements:
+ description: |-
+ prismElements holds one or more endpoint address and port data to access the Nutanix
+ Prism Elements (clusters) of the Nutanix Prism Central. Currently we only support one
+ Prism Element (cluster) for an OpenShift cluster, where all the Nutanix resources (VMs, subnets, volumes, etc.)
+ used in the OpenShift cluster are located. In the future, we may support Nutanix resources (VMs, etc.)
+ spread over multiple Prism Elements (clusters) of the Prism Central.
+ items:
+ description: NutanixPrismElementEndpoint holds the name
+ and endpoint data for a Prism Element (cluster)
+ properties:
+ endpoint:
+ description: |-
+ endpoint holds the endpoint address and port data of the Prism Element (cluster).
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS
+ name or IP address) of the Nutanix Prism Central
+ or Element (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the
+ Nutanix Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ name:
+ description: |-
+ name is the name of the Prism Element (cluster). This value will correspond with
+ the cluster field configured on other resources (eg Machines, PVCs, etc).
+ maxLength: 256
+ type: string
+ required:
+ - endpoint
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - prismCentral
+ - prismElements
+ type: object
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ type: object
+ powervs:
+ description: powervs contains settings specific to the IBM Power
+ Systems Virtual Servers infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "IBMCloud", "KubeVirt", "EquinixMetal",
+ "PowerVS", "AlibabaCloud", "Nutanix", "External", and "None". Individual
+ components may not support all platforms, and must handle unrecognized
+ platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ failureDomains:
+ description: |-
+ failureDomains contains the definition of region, zone and the vCenter topology.
+ If this is omitted failure domains (regions and zones) will not be used.
+ items:
+ description: VSpherePlatformFailureDomainSpec holds the
+ region and zone failure domain and the vCenter topology
+ of that failure domain.
+ properties:
+ name:
+ description: |-
+ name defines the arbitrary but unique name
+ of a failure domain.
+ maxLength: 256
+ minLength: 1
+ type: string
+ region:
+ description: |-
+ region defines the name of a region tag that will
+ be attached to a vCenter datacenter. The tag
+ category in vCenter must be named openshift-region.
+ maxLength: 80
+ minLength: 1
+ type: string
+ regionAffinity:
+ description: |-
+ regionAffinity holds the type of region, Datacenter or ComputeCluster.
+ When set to Datacenter, this means the region is a vCenter Datacenter as defined in topology.
+ When set to ComputeCluster, this means the region is a vCenter Cluster as defined in topology.
+ properties:
+ type:
+ description: |-
+ type determines the vSphere object type for a region within this failure domain.
+ Available types are Datacenter and ComputeCluster.
+ When set to Datacenter, this means the vCenter Datacenter defined is the region.
+ When set to ComputeCluster, this means the vCenter cluster defined is the region.
+ enum:
+ - ComputeCluster
+ - Datacenter
+ type: string
+ required:
+ - type
+ type: object
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ minLength: 1
+ type: string
+ topology:
+ description: topology describes a given failure domain
+ using vSphere constructs
+ properties:
+ computeCluster:
+ description: |-
+ computeCluster the absolute path of the vCenter cluster
+ in which virtual machine will be located.
+ The absolute path is of the form //host/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?
+ type: string
+ datacenter:
+ description: |-
+ datacenter is the name of vCenter datacenter in which virtual machines will be located.
+ The maximum length of the datacenter name is 80 characters.
+ maxLength: 80
+ type: string
+ datastore:
+ description: |-
+ datastore is the absolute path of the datastore in which the
+ virtual machine is located.
+ The absolute path is of the form //datastore/
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/datastore/.*?
+ type: string
+ folder:
+ description: |-
+ folder is the absolute path of the folder where
+ virtual machines are located. The absolute path
+ is of the form //vm/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/vm/.*?
+ type: string
+ networks:
+ description: |-
+ networks is the list of port group network names within this failure domain.
+ If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined.
+ 10 is the maximum number of virtual network devices which may be attached to a VM as defined by:
+ https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ Networks should be in the form of an absolute path:
+ //network/.
+ items:
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ resourcePool:
+ description: |-
+ resourcePool is the absolute path of the resource pool where virtual machines will be
+ created. The absolute path is of the form //host//Resources/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?/Resources.*
+ type: string
+ template:
+ description: |-
+ template is the full inventory path of the virtual machine or template
+ that will be cloned when creating new machines in this failure domain.
+ The maximum length of the path is 2048 characters.
+
+ When omitted, the template will be calculated by the control plane
+ machineset operator based on the region and zone defined in
+ VSpherePlatformFailureDomainSpec.
+ For example, for zone=zonea, region=region1, and infrastructure name=test,
+ the template path would be calculated as //vm/test-rhcos-region1-zonea.
+ maxLength: 2048
+ minLength: 1
+ pattern: ^/.*?/vm/.*?
+ type: string
+ required:
+ - computeCluster
+ - datacenter
+ - datastore
+ - networks
+ type: object
+ zone:
+ description: |-
+ zone defines the name of a zone tag that will
+ be attached to a vCenter cluster. The tag
+ category in vCenter must be named openshift-zone.
+ maxLength: 80
+ minLength: 1
+ type: string
+ zoneAffinity:
+ description: |-
+ zoneAffinity holds the type of the zone and the hostGroup which
+ vmGroup and the hostGroup names in vCenter corresponds to
+ a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup holds the vmGroup and the hostGroup names in vCenter
+ corresponds to a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup is the name of the vm-host group of type host within vCenter for this failure domain.
+ hostGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmGroup:
+ description: |-
+ vmGroup is the name of the vm-host group of type virtual machine within vCenter for this failure domain.
+ vmGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmHostRule:
+ description: |-
+ vmHostRule is the name of the affinity vm-host rule within vCenter for this failure domain.
+ vmHostRule is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ required:
+ - hostGroup
+ - vmGroup
+ - vmHostRule
+ type: object
+ type:
+ description: |-
+ type determines the vSphere object type for a zone within this failure domain.
+ Available types are ComputeCluster and HostGroup.
+ When set to ComputeCluster, this means the vCenter cluster defined is the zone.
+ When set to HostGroup, hostGroup must be configured with hostGroup, vmGroup and vmHostRule and
+ this means the zone is defined by the grouping of those fields.
+ enum:
+ - HostGroup
+ - ComputeCluster
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: hostGroup is required when type is HostGroup,
+ and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''HostGroup''
+ ? has(self.hostGroup) : !has(self.hostGroup)'
+ required:
+ - name
+ - region
+ - server
+ - topology
+ - zone
+ type: object
+ x-kubernetes-validations:
+ - message: when zoneAffinity type is HostGroup, regionAffinity
+ type must be ComputeCluster
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type
+ == ''ComputeCluster'' : true'
+ - message: when zoneAffinity type is ComputeCluster, regionAffinity
+ type must be Datacenter
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''ComputeCluster'' ? has(self.regionAffinity) &&
+ self.regionAffinity.type == ''Datacenter'' : true'
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeNetworking:
+ description: |-
+ nodeNetworking contains the definition of internal and external network constraints for
+ assigning the node's networking.
+ If this field is omitted, networking defaults to the legacy
+ address selection behavior which is to only support a single address and
+ return the first one found.
+ properties:
+ external:
+ description: external represents the network configuration
+ of the node that is externally routable.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ internal:
+ description: internal represents the network configuration
+ of the node that is routable only within the cluster.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ type: object
+ vcenters:
+ description: |-
+ vcenters holds the connection details for services to communicate with vCenter.
+ Up to 3 vCenters are supported.
+ Once the cluster has been installed, you are unable to change the current number of defined
+ vCenters except when 1.) the cluster has been upgraded from a version of OpenShift
+ where the vsphere platform spec was not present or 2.) in TechPreview you are able to add and
+ remove vCenters but may not remove all vCenters. You may make modifications to the existing
+ vCenters that are defined in the vcenters list in order to match with any added or modified
+ failure domains.
+ items:
+ description: |-
+ VSpherePlatformVCenterSpec stores the vCenter connection fields.
+ This is used by the vSphere CCM.
+ properties:
+ datacenters:
+ description: |-
+ The vCenter Datacenters in which the RHCOS
+ vm guests are located. This field will
+ be used by the Cloud Controller Manager.
+ Each datacenter listed here should be used within
+ a topology.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the TCP port that will be used to communicate to
+ the vCenter endpoint.
+ When omitted, this means the user has no opinion and
+ it is up to the platform to choose a sensible default,
+ which is subject to change over time.
+ format: int32
+ maximum: 32767
+ minimum: 1
+ type: integer
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ type: string
+ required:
+ - datacenters
+ - server
+ type: object
+ maxItems: 3
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x, self.exists(y,
+ y.server == x.server)) : true'
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) < size(oldSelf) ? self.all(x, oldSelf.exists(y,
+ y.server == x.server)) : true'
+ - message: vcenters must have unique server values
+ rule: self.all(x, self.exists_one(y, y.server == x.server))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ type: object
+ x-kubernetes-validations:
+ - message: vcenters is required once set and cannot be removed
+ rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
+ : true'
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ apiServerInternalURI:
+ description: |-
+ apiServerInternalURL is a valid URI with scheme 'https',
+ address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components
+ like kubelets, to contact the Kubernetes API server using the
+ infrastructure provider rather than Kubernetes networking.
+ type: string
+ apiServerURL:
+ description: |-
+ apiServerURL is a valid URI with scheme 'https', address and
+ optionally a port (defaulting to 443). apiServerURL can be used by components like the web console
+ to tell users where to find the Kubernetes API.
+ type: string
+ controlPlaneTopology:
+ default: HighlyAvailable
+ description: |-
+ controlPlaneTopology expresses the expectations for operands that normally run on control nodes.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ The 'External' mode indicates that the control plane is hosted externally to the cluster and that
+ its components are not visible within the cluster.
+ The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes
+ that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.
+ enum:
+ - HighlyAvailable
+ - HighlyAvailableArbiter
+ - SingleReplica
+ - DualReplica
+ - External
+ type: string
+ cpuPartitioning:
+ default: None
+ description: |-
+ cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster.
+ CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets.
+ Valid values are "None" and "AllNodes". When omitted, the default value is "None".
+ The default value of "None" indicates that no nodes will be setup with CPU partitioning.
+ The "AllNodes" value indicates that all nodes have been setup with CPU partitioning,
+ and can then be further configured via the PerformanceProfile API.
+ enum:
+ - None
+ - AllNodes
+ type: string
+ etcdDiscoveryDomain:
+ description: |-
+ etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering
+ etcd servers and clients.
+ For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery
+ deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.
+ type: string
+ infrastructureName:
+ description: |-
+ infrastructureName uniquely identifies a cluster with a human friendly name.
+ Once set it should not be changed. Must be of max length 27 and must have only
+ alphanumeric or hyphen characters.
+ type: string
+ infrastructureTopology:
+ default: HighlyAvailable
+ description: |-
+ infrastructureTopology expresses the expectations for infrastructure services that do not run on control
+ plane nodes, usually indicated by a node selector for a `role` value
+ other than `master`.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ NOTE: External topology mode is not applicable for this field.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ platform:
+ description: |-
+ platform is the underlying infrastructure provider for the cluster.
+
+ Deprecated: Use platformStatus.type instead.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ platformStatus:
+ description: |-
+ platformStatus holds status information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ properties:
+ region:
+ description: region specifies the region for Alibaba Cloud
+ resources created for the cluster.
+ pattern: ^[0-9A-Za-z-]+$
+ type: string
+ resourceGroupID:
+ description: resourceGroupID is the ID of the resource group
+ for the cluster.
+ pattern: ^(rg-[0-9A-Za-z]+)?$
+ type: string
+ resourceTags:
+ description: resourceTags is a list of additional tags to
+ apply to Alibaba Cloud resources created for the cluster.
+ items:
+ description: AlibabaCloudResourceTag is the set of tags
+ to add to apply to resources.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ value:
+ description: value is the value of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ required:
+ - region
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for AWS
+ network resources. This controls whether AWS resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ region:
+ description: region holds the default AWS region for new AWS
+ resources created by the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created for the cluster.
+ See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources.
+ AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags
+ available for the user.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key sets the key of the AWS resource tag key-value pair. Key is required when defining an AWS resource tag.
+ Key should consist of between 1 and 128 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ maxLength: 128
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag key. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ value:
+ description: |-
+ value sets the value of the AWS resource tag key-value pair. Value is required when defining an AWS resource tag.
+ Value should consist of between 1 and 256 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ Some AWS service do not support empty values. Since tags are added to resources in many services, the
+ length of the tag value must meet the requirements of all services.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag value. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ properties:
+ armEndpoint:
+ description: armEndpoint specifies a URL to use for resource
+ management in non-soverign clouds such as Azure Stack.
+ type: string
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ cloudName:
+ description: |-
+ cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
+ with the appropriate Azure API endpoints.
+ If empty, the value is equal to `AzurePublicCloud`.
+ enum:
+ - ""
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for Azure
+ network resources. This controls whether Azure resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ networkResourceGroupName:
+ description: |-
+ networkResourceGroupName is the Resource Group for network resources like the Virtual Network and Subnets used by the cluster.
+ If empty, the value is same as ResourceGroupName.
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ Azure resources created for the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to Azure resources created for the cluster.
+ See https://docs.microsoft.com/en-us/rest/api/resources/tags for information on tagging Azure resources.
+ Due to limitations on Automation, Content Delivery Network, DNS Azure resources, a maximum of 15 tags
+ may be applied. OpenShift reserves 5 tags for internal use, allowing 10 tags for user configuration.
+ items:
+ description: AzureResourceTag is a tag to apply to Azure
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 128 characters and cannot be empty. Key
+ must begin with a letter, end with a letter, number or underscore, and must contain only alphanumeric
+ characters and the following special characters `_ . -`.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[a-zA-Z]([0-9A-Za-z_.-]*[0-9A-Za-z_])?$
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 256 characters and cannot be empty. Value
+ must contain only alphanumeric characters and the following special characters `_ + , - . / : ; < = > ? @`.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on BareMetal platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ BareMetal deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ external:
+ description: external contains settings specific to the generic
+ External infrastructure provider.
+ properties:
+ cloudControllerManager:
+ description: |-
+ cloudControllerManager contains settings specific to the external Cloud Controller Manager (a.k.a. CCM or CPI).
+ When omitted, new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ properties:
+ state:
+ description: |-
+ state determines whether or not an external Cloud Controller Manager is expected to
+ be installed within the cluster.
+ https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager
+
+ Valid values are "External", "None" and omitted.
+ When set to "External", new nodes will be tainted as uninitialized when created,
+ preventing them from running workloads until they are initialized by the cloud controller manager.
+ When omitted or set to "None", new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ enum:
+ - ""
+ - External
+ - None
+ type: string
+ x-kubernetes-validations:
+ - message: state is immutable once set
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: state may not be added or removed once set
+ rule: (has(self.state) == has(oldSelf.state)) || (!has(oldSelf.state)
+ && self.state != "External")
+ type: object
+ x-kubernetes-validations:
+ - message: cloudControllerManager may not be added or removed
+ once set
+ rule: has(self.cloudControllerManager) == has(oldSelf.cloudControllerManager)
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ projectID:
+ description: resourceGroupName is the Project ID for new GCP
+ resources created for the cluster.
+ type: string
+ region:
+ description: region holds the region for new GCP resources
+ created for the cluster.
+ type: string
+ resourceLabels:
+ description: |-
+ resourceLabels is a list of additional labels to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/compute/docs/labeling-resources for information on labeling GCP resources.
+ GCP supports a maximum of 64 labels per resource. OpenShift reserves 32 labels for internal use,
+ allowing 32 labels for user configuration.
+ items:
+ description: GCPResourceLabel is a label to apply to GCP
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the label. A label key can have a maximum of 63 characters and cannot be empty.
+ Label key must begin with a lowercase letter, and must contain only lowercase letters, numeric characters,
+ and the following special characters `_-`. Label key must not have the reserved prefixes `kubernetes-io`
+ and `openshift-io`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z][0-9a-z_-]{0,62}$
+ type: string
+ x-kubernetes-validations:
+ - message: label keys must not start with either `openshift-io`
+ or `kubernetes-io`
+ rule: '!self.startsWith(''openshift-io'') && !self.startsWith(''kubernetes-io'')'
+ value:
+ description: |-
+ value is the value part of the label. A label value can have a maximum of 63 characters and cannot be empty.
+ Value must contain only lowercase letters, numeric characters, and the following special characters `_-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[0-9a-z_-]{1,63}$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceLabels are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/resource-manager/docs/tags/tags-overview for information on
+ tagging GCP resources. GCP supports a maximum of 50 tags per resource.
+ items:
+ description: GCPResourceTag is a tag to apply to GCP resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot be empty.
+ Tag key must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `._-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$
+ type: string
+ parentID:
+ description: |-
+ parentID is the ID of the hierarchical resource where the tags are defined,
+ e.g. at the Organization or the Project level. To find the Organization or Project ID refer to the following pages:
+ https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id,
+ https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects.
+ An OrganizationID must consist of decimal numbers, and cannot have leading zeroes.
+ A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters, numbers,
+ and hyphens, and must start with a letter, and cannot end with a hyphen.
+ maxLength: 32
+ minLength: 1
+ pattern: (^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 63 characters and cannot be empty.
+ Tag value must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `_-.@%=+:,*#&(){}[]` and spaces.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$
+ type: string
+ required:
+ - key
+ - parentID
+ - value
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceLabels may only be configured during installation
+ rule: '!has(oldSelf.resourceLabels) && !has(self.resourceLabels)
+ || has(oldSelf.resourceLabels) && has(self.resourceLabels)'
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ location:
+ description: location is where the cluster has been deployed
+ type: string
+ providerType:
+ description: providerType indicates the type of cluster that
+ was created
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ IBMCloud resources created for the cluster.
+ type: string
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Nutanix platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ cloudName:
+ description: |-
+ cloudName is the name of the desired OpenStack cloud in the
+ client configuration file (`clouds.yaml`).
+ type: string
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on OpenStack platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ OpenStack deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Ovirt platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ nodeDNSIP:
+ description: 'deprecated: as of 4.6, this field is no longer
+ set or honored. It will be removed in a future release.'
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ powervs:
+ description: powervs contains settings specific to the Power Systems
+ Virtual Servers infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ region:
+ description: region holds the default Power VS region for
+ new Power VS resources created by the cluster.
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the resource group name for new IBMCloud resources created for a cluster.
+ The resource group specified here will be used by cluster-image-registry-operator to set up a COS Instance in IBMCloud for the cluster registry.
+ More about resource groups can be found here: https://cloud.ibm.com/docs/account?topic=account-rgs.
+ When omitted, the image registry operator won't be able to configure storage,
+ which results in the image registry cluster operator not being in an available state.
+ maxLength: 40
+ pattern: ^[a-zA-Z0-9-_ ]+$
+ type: string
+ x-kubernetes-validations:
+ - message: resourceGroup is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ zone:
+ description: |-
+ zone holds the default zone for the new Power VS resources created by the cluster.
+ Note: Currently only single-zone OCP clusters are supported
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot unset resourceGroup once set
+ rule: '!has(oldSelf.resourceGroup) || has(self.resourceGroup)'
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "EquinixMetal", "PowerVS", "AlibabaCloud", "Nutanix" and "None".
+ Individual components may not support all platforms, and must handle
+ unrecognized platforms as None if they do not support that platform.
+
+ This value will be synced with to the `status.platform` and `status.platformStatus.type`.
+ Currently this value cannot be changed once set.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on VSphere platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ vSphere deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ type: object
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-TechPreviewNoUpgrade.crd.yaml
new file mode 100644
index 000000000..cafc698a8
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-TechPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,2774 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: TechPreviewNoUpgrade
+ name: infrastructures.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Infrastructure
+ listKind: InfrastructureList
+ plural: infrastructures
+ singular: infrastructure
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Infrastructure holds cluster-wide information about Infrastructure. The canonical name is `cluster`
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ cloudConfig:
+ description: |-
+ cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file.
+ This configuration file is used to configure the Kubernetes cloud provider integration
+ when using the built-in cloud provider integration or the external cloud controller manager.
+ The namespace for this config map is openshift-config.
+
+ cloudConfig should only be consumed by the kube_cloud_config controller.
+ The controller is responsible for using the user configuration in the spec
+ for various platforms and combining that with the user provided ConfigMap in this field
+ to create a stitched kube cloud config.
+ The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace
+ with the kube cloud config is stored in `cloud.conf` key.
+ All the clients are expected to use the generated ConfigMap only.
+ properties:
+ key:
+ description: key allows pointing to a specific key/value inside
+ of the configmap. This is useful for logical file references.
+ type: string
+ name:
+ type: string
+ type: object
+ platformSpec:
+ description: |-
+ platformSpec holds desired information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ type: object
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ type: object
+ external:
+ description: |-
+ ExternalPlatformType represents generic infrastructure provider.
+ Platform-specific components should be supplemented separately.
+ properties:
+ platformName:
+ default: Unknown
+ description: |-
+ platformName holds the arbitrary string representing the infrastructure provider name, expected to be set at the installation time.
+ This field is solely for informational and reporting purposes and is not expected to be used for decision-making.
+ type: string
+ x-kubernetes-validations:
+ - message: platform name cannot be changed once set
+ rule: oldSelf == 'Unknown' || self == oldSelf
+ type: object
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ type: object
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ A maximum of 13 service endpoints overrides are supported.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must use https scheme
+ rule: url(self).getScheme() == "https"
+ - message: url path must match /v[0,9]+ or /api/v[0,9]+
+ rule: matches((url(self).getEscapedPath()), '^/(api/)?v[0-9]+/{0,1}$')
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ failureDomains:
+ description: |-
+ failureDomains configures failure domains information for the Nutanix platform.
+ When set, the failure domains defined here may be used to spread Machines across
+ prism element clusters to improve fault tolerance of the cluster.
+ items:
+ description: NutanixFailureDomain configures failure domain
+ information for the Nutanix platform.
+ properties:
+ cluster:
+ description: |-
+ cluster is to identify the cluster (the Prism Element under management of the Prism Central),
+ in which the Machine's VM will be created. The cluster identifier (uuid or name) can be obtained
+ from the Prism Central console or using the prism_central API.
+ properties:
+ name:
+ description: name is the resource name in the PC.
+ It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource in
+ the PC. It cannot be empty if the type is UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ name:
+ description: |-
+ name defines the unique name of a failure domain.
+ Name is required and must be at most 64 characters in length.
+ It must consist of only lower case alphanumeric characters and hyphens (-).
+ It must start and end with an alphanumeric character.
+ This value is arbitrary and is used to identify the failure domain within the platform.
+ maxLength: 64
+ minLength: 1
+ pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?'
+ type: string
+ subnets:
+ description: |-
+ subnets holds a list of identifiers (one or more) of the cluster's network subnets
+ If the feature gate NutanixMultiSubnets is enabled, up to 32 subnets may be configured.
+ for the Machine's VM to connect to. The subnet identifiers (uuid or name) can be
+ obtained from the Prism Central console or using the prism_central API.
+ items:
+ description: NutanixResourceIdentifier holds the identity
+ of a Nutanix PC resource (cluster, image, subnet,
+ etc.)
+ properties:
+ name:
+ description: name is the resource name in the
+ PC. It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource
+ in the PC. It cannot be empty if the type is
+ UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ maxItems: 32
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: each subnet must be unique
+ rule: self.all(x, self.exists_one(y, x == y))
+ required:
+ - cluster
+ - name
+ - subnets
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ prismCentral:
+ description: |-
+ prismCentral holds the endpoint address and port to access the Nutanix Prism Central.
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS name
+ or IP address) of the Nutanix Prism Central or Element
+ (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the Nutanix
+ Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ prismElements:
+ description: |-
+ prismElements holds one or more endpoint address and port data to access the Nutanix
+ Prism Elements (clusters) of the Nutanix Prism Central. Currently we only support one
+ Prism Element (cluster) for an OpenShift cluster, where all the Nutanix resources (VMs, subnets, volumes, etc.)
+ used in the OpenShift cluster are located. In the future, we may support Nutanix resources (VMs, etc.)
+ spread over multiple Prism Elements (clusters) of the Prism Central.
+ items:
+ description: NutanixPrismElementEndpoint holds the name
+ and endpoint data for a Prism Element (cluster)
+ properties:
+ endpoint:
+ description: |-
+ endpoint holds the endpoint address and port data of the Prism Element (cluster).
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS
+ name or IP address) of the Nutanix Prism Central
+ or Element (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the
+ Nutanix Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ name:
+ description: |-
+ name is the name of the Prism Element (cluster). This value will correspond with
+ the cluster field configured on other resources (eg Machines, PVCs, etc).
+ maxLength: 256
+ type: string
+ required:
+ - endpoint
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - prismCentral
+ - prismElements
+ type: object
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ type: object
+ powervs:
+ description: powervs contains settings specific to the IBM Power
+ Systems Virtual Servers infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "IBMCloud", "KubeVirt", "EquinixMetal",
+ "PowerVS", "AlibabaCloud", "Nutanix", "External", and "None". Individual
+ components may not support all platforms, and must handle unrecognized
+ platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ failureDomains:
+ description: |-
+ failureDomains contains the definition of region, zone and the vCenter topology.
+ If this is omitted failure domains (regions and zones) will not be used.
+ items:
+ description: VSpherePlatformFailureDomainSpec holds the
+ region and zone failure domain and the vCenter topology
+ of that failure domain.
+ properties:
+ name:
+ description: |-
+ name defines the arbitrary but unique name
+ of a failure domain.
+ maxLength: 256
+ minLength: 1
+ type: string
+ region:
+ description: |-
+ region defines the name of a region tag that will
+ be attached to a vCenter datacenter. The tag
+ category in vCenter must be named openshift-region.
+ maxLength: 80
+ minLength: 1
+ type: string
+ regionAffinity:
+ description: |-
+ regionAffinity holds the type of region, Datacenter or ComputeCluster.
+ When set to Datacenter, this means the region is a vCenter Datacenter as defined in topology.
+ When set to ComputeCluster, this means the region is a vCenter Cluster as defined in topology.
+ properties:
+ type:
+ description: |-
+ type determines the vSphere object type for a region within this failure domain.
+ Available types are Datacenter and ComputeCluster.
+ When set to Datacenter, this means the vCenter Datacenter defined is the region.
+ When set to ComputeCluster, this means the vCenter cluster defined is the region.
+ enum:
+ - ComputeCluster
+ - Datacenter
+ type: string
+ required:
+ - type
+ type: object
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ minLength: 1
+ type: string
+ topology:
+ description: topology describes a given failure domain
+ using vSphere constructs
+ properties:
+ computeCluster:
+ description: |-
+ computeCluster the absolute path of the vCenter cluster
+ in which virtual machine will be located.
+ The absolute path is of the form //host/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?
+ type: string
+ datacenter:
+ description: |-
+ datacenter is the name of vCenter datacenter in which virtual machines will be located.
+ The maximum length of the datacenter name is 80 characters.
+ maxLength: 80
+ type: string
+ datastore:
+ description: |-
+ datastore is the absolute path of the datastore in which the
+ virtual machine is located.
+ The absolute path is of the form //datastore/
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/datastore/.*?
+ type: string
+ folder:
+ description: |-
+ folder is the absolute path of the folder where
+ virtual machines are located. The absolute path
+ is of the form //vm/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/vm/.*?
+ type: string
+ networks:
+ description: |-
+ networks is the list of port group network names within this failure domain.
+ If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined.
+ 10 is the maximum number of virtual network devices which may be attached to a VM as defined by:
+ https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ Networks should be in the form of an absolute path:
+ //network/.
+ items:
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ resourcePool:
+ description: |-
+ resourcePool is the absolute path of the resource pool where virtual machines will be
+ created. The absolute path is of the form //host//Resources/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?/Resources.*
+ type: string
+ template:
+ description: |-
+ template is the full inventory path of the virtual machine or template
+ that will be cloned when creating new machines in this failure domain.
+ The maximum length of the path is 2048 characters.
+
+ When omitted, the template will be calculated by the control plane
+ machineset operator based on the region and zone defined in
+ VSpherePlatformFailureDomainSpec.
+ For example, for zone=zonea, region=region1, and infrastructure name=test,
+ the template path would be calculated as //vm/test-rhcos-region1-zonea.
+ maxLength: 2048
+ minLength: 1
+ pattern: ^/.*?/vm/.*?
+ type: string
+ required:
+ - computeCluster
+ - datacenter
+ - datastore
+ - networks
+ type: object
+ zone:
+ description: |-
+ zone defines the name of a zone tag that will
+ be attached to a vCenter cluster. The tag
+ category in vCenter must be named openshift-zone.
+ maxLength: 80
+ minLength: 1
+ type: string
+ zoneAffinity:
+ description: |-
+ zoneAffinity holds the type of the zone and the hostGroup which
+ vmGroup and the hostGroup names in vCenter corresponds to
+ a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup holds the vmGroup and the hostGroup names in vCenter
+ corresponds to a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup is the name of the vm-host group of type host within vCenter for this failure domain.
+ hostGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmGroup:
+ description: |-
+ vmGroup is the name of the vm-host group of type virtual machine within vCenter for this failure domain.
+ vmGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmHostRule:
+ description: |-
+ vmHostRule is the name of the affinity vm-host rule within vCenter for this failure domain.
+ vmHostRule is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ required:
+ - hostGroup
+ - vmGroup
+ - vmHostRule
+ type: object
+ type:
+ description: |-
+ type determines the vSphere object type for a zone within this failure domain.
+ Available types are ComputeCluster and HostGroup.
+ When set to ComputeCluster, this means the vCenter cluster defined is the zone.
+ When set to HostGroup, hostGroup must be configured with hostGroup, vmGroup and vmHostRule and
+ this means the zone is defined by the grouping of those fields.
+ enum:
+ - HostGroup
+ - ComputeCluster
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: hostGroup is required when type is HostGroup,
+ and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''HostGroup''
+ ? has(self.hostGroup) : !has(self.hostGroup)'
+ required:
+ - name
+ - region
+ - server
+ - topology
+ - zone
+ type: object
+ x-kubernetes-validations:
+ - message: when zoneAffinity type is HostGroup, regionAffinity
+ type must be ComputeCluster
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type
+ == ''ComputeCluster'' : true'
+ - message: when zoneAffinity type is ComputeCluster, regionAffinity
+ type must be Datacenter
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''ComputeCluster'' ? has(self.regionAffinity) &&
+ self.regionAffinity.type == ''Datacenter'' : true'
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeNetworking:
+ description: |-
+ nodeNetworking contains the definition of internal and external network constraints for
+ assigning the node's networking.
+ If this field is omitted, networking defaults to the legacy
+ address selection behavior which is to only support a single address and
+ return the first one found.
+ properties:
+ external:
+ description: external represents the network configuration
+ of the node that is externally routable.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ internal:
+ description: internal represents the network configuration
+ of the node that is routable only within the cluster.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ type: object
+ vcenters:
+ description: |-
+ vcenters holds the connection details for services to communicate with vCenter.
+ Up to 3 vCenters are supported.
+ Once the cluster has been installed, you are unable to change the current number of defined
+ vCenters except when 1.) the cluster has been upgraded from a version of OpenShift
+ where the vsphere platform spec was not present or 2.) in TechPreview you are able to add and
+ remove vCenters but may not remove all vCenters. You may make modifications to the existing
+ vCenters that are defined in the vcenters list in order to match with any added or modified
+ failure domains.
+ items:
+ description: |-
+ VSpherePlatformVCenterSpec stores the vCenter connection fields.
+ This is used by the vSphere CCM.
+ properties:
+ datacenters:
+ description: |-
+ The vCenter Datacenters in which the RHCOS
+ vm guests are located. This field will
+ be used by the Cloud Controller Manager.
+ Each datacenter listed here should be used within
+ a topology.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the TCP port that will be used to communicate to
+ the vCenter endpoint.
+ When omitted, this means the user has no opinion and
+ it is up to the platform to choose a sensible default,
+ which is subject to change over time.
+ format: int32
+ maximum: 32767
+ minimum: 1
+ type: integer
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ type: string
+ required:
+ - datacenters
+ - server
+ type: object
+ maxItems: 3
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x, self.exists(y,
+ y.server == x.server)) : true'
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) < size(oldSelf) ? self.all(x, oldSelf.exists(y,
+ y.server == x.server)) : true'
+ - message: vcenters must have unique server values
+ rule: self.all(x, self.exists_one(y, y.server == x.server))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ type: object
+ x-kubernetes-validations:
+ - message: vcenters is required once set and cannot be removed
+ rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
+ : true'
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ apiServerInternalURI:
+ description: |-
+ apiServerInternalURL is a valid URI with scheme 'https',
+ address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components
+ like kubelets, to contact the Kubernetes API server using the
+ infrastructure provider rather than Kubernetes networking.
+ type: string
+ apiServerURL:
+ description: |-
+ apiServerURL is a valid URI with scheme 'https', address and
+ optionally a port (defaulting to 443). apiServerURL can be used by components like the web console
+ to tell users where to find the Kubernetes API.
+ type: string
+ controlPlaneTopology:
+ default: HighlyAvailable
+ description: |-
+ controlPlaneTopology expresses the expectations for operands that normally run on control nodes.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ The 'External' mode indicates that the control plane is hosted externally to the cluster and that
+ its components are not visible within the cluster.
+ The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes
+ that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.
+ enum:
+ - HighlyAvailable
+ - HighlyAvailableArbiter
+ - SingleReplica
+ - DualReplica
+ - External
+ type: string
+ cpuPartitioning:
+ default: None
+ description: |-
+ cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster.
+ CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets.
+ Valid values are "None" and "AllNodes". When omitted, the default value is "None".
+ The default value of "None" indicates that no nodes will be setup with CPU partitioning.
+ The "AllNodes" value indicates that all nodes have been setup with CPU partitioning,
+ and can then be further configured via the PerformanceProfile API.
+ enum:
+ - None
+ - AllNodes
+ type: string
+ etcdDiscoveryDomain:
+ description: |-
+ etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering
+ etcd servers and clients.
+ For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery
+ deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.
+ type: string
+ infrastructureName:
+ description: |-
+ infrastructureName uniquely identifies a cluster with a human friendly name.
+ Once set it should not be changed. Must be of max length 27 and must have only
+ alphanumeric or hyphen characters.
+ type: string
+ infrastructureTopology:
+ default: HighlyAvailable
+ description: |-
+ infrastructureTopology expresses the expectations for infrastructure services that do not run on control
+ plane nodes, usually indicated by a node selector for a `role` value
+ other than `master`.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ NOTE: External topology mode is not applicable for this field.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ platform:
+ description: |-
+ platform is the underlying infrastructure provider for the cluster.
+
+ Deprecated: Use platformStatus.type instead.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ platformStatus:
+ description: |-
+ platformStatus holds status information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ properties:
+ region:
+ description: region specifies the region for Alibaba Cloud
+ resources created for the cluster.
+ pattern: ^[0-9A-Za-z-]+$
+ type: string
+ resourceGroupID:
+ description: resourceGroupID is the ID of the resource group
+ for the cluster.
+ pattern: ^(rg-[0-9A-Za-z]+)?$
+ type: string
+ resourceTags:
+ description: resourceTags is a list of additional tags to
+ apply to Alibaba Cloud resources created for the cluster.
+ items:
+ description: AlibabaCloudResourceTag is the set of tags
+ to add to apply to resources.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ value:
+ description: value is the value of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ required:
+ - region
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for AWS
+ network resources. This controls whether AWS resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ region:
+ description: region holds the default AWS region for new AWS
+ resources created by the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created for the cluster.
+ See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources.
+ AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags
+ available for the user.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key sets the key of the AWS resource tag key-value pair. Key is required when defining an AWS resource tag.
+ Key should consist of between 1 and 128 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ maxLength: 128
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag key. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ value:
+ description: |-
+ value sets the value of the AWS resource tag key-value pair. Value is required when defining an AWS resource tag.
+ Value should consist of between 1 and 256 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ Some AWS service do not support empty values. Since tags are added to resources in many services, the
+ length of the tag value must meet the requirements of all services.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag value. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ properties:
+ armEndpoint:
+ description: armEndpoint specifies a URL to use for resource
+ management in non-soverign clouds such as Azure Stack.
+ type: string
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ cloudName:
+ description: |-
+ cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
+ with the appropriate Azure API endpoints.
+ If empty, the value is equal to `AzurePublicCloud`.
+ enum:
+ - ""
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for Azure
+ network resources. This controls whether Azure resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ networkResourceGroupName:
+ description: |-
+ networkResourceGroupName is the Resource Group for network resources like the Virtual Network and Subnets used by the cluster.
+ If empty, the value is same as ResourceGroupName.
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ Azure resources created for the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to Azure resources created for the cluster.
+ See https://docs.microsoft.com/en-us/rest/api/resources/tags for information on tagging Azure resources.
+ Due to limitations on Automation, Content Delivery Network, DNS Azure resources, a maximum of 15 tags
+ may be applied. OpenShift reserves 5 tags for internal use, allowing 10 tags for user configuration.
+ items:
+ description: AzureResourceTag is a tag to apply to Azure
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 128 characters and cannot be empty. Key
+ must begin with a letter, end with a letter, number or underscore, and must contain only alphanumeric
+ characters and the following special characters `_ . -`.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[a-zA-Z]([0-9A-Za-z_.-]*[0-9A-Za-z_])?$
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 256 characters and cannot be empty. Value
+ must contain only alphanumeric characters and the following special characters `_ + , - . / : ; < = > ? @`.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on BareMetal platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ BareMetal deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ external:
+ description: external contains settings specific to the generic
+ External infrastructure provider.
+ properties:
+ cloudControllerManager:
+ description: |-
+ cloudControllerManager contains settings specific to the external Cloud Controller Manager (a.k.a. CCM or CPI).
+ When omitted, new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ properties:
+ state:
+ description: |-
+ state determines whether or not an external Cloud Controller Manager is expected to
+ be installed within the cluster.
+ https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager
+
+ Valid values are "External", "None" and omitted.
+ When set to "External", new nodes will be tainted as uninitialized when created,
+ preventing them from running workloads until they are initialized by the cloud controller manager.
+ When omitted or set to "None", new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ enum:
+ - ""
+ - External
+ - None
+ type: string
+ x-kubernetes-validations:
+ - message: state is immutable once set
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: state may not be added or removed once set
+ rule: (has(self.state) == has(oldSelf.state)) || (!has(oldSelf.state)
+ && self.state != "External")
+ type: object
+ x-kubernetes-validations:
+ - message: cloudControllerManager may not be added or removed
+ once set
+ rule: has(self.cloudControllerManager) == has(oldSelf.cloudControllerManager)
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ projectID:
+ description: resourceGroupName is the Project ID for new GCP
+ resources created for the cluster.
+ type: string
+ region:
+ description: region holds the region for new GCP resources
+ created for the cluster.
+ type: string
+ resourceLabels:
+ description: |-
+ resourceLabels is a list of additional labels to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/compute/docs/labeling-resources for information on labeling GCP resources.
+ GCP supports a maximum of 64 labels per resource. OpenShift reserves 32 labels for internal use,
+ allowing 32 labels for user configuration.
+ items:
+ description: GCPResourceLabel is a label to apply to GCP
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the label. A label key can have a maximum of 63 characters and cannot be empty.
+ Label key must begin with a lowercase letter, and must contain only lowercase letters, numeric characters,
+ and the following special characters `_-`. Label key must not have the reserved prefixes `kubernetes-io`
+ and `openshift-io`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z][0-9a-z_-]{0,62}$
+ type: string
+ x-kubernetes-validations:
+ - message: label keys must not start with either `openshift-io`
+ or `kubernetes-io`
+ rule: '!self.startsWith(''openshift-io'') && !self.startsWith(''kubernetes-io'')'
+ value:
+ description: |-
+ value is the value part of the label. A label value can have a maximum of 63 characters and cannot be empty.
+ Value must contain only lowercase letters, numeric characters, and the following special characters `_-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[0-9a-z_-]{1,63}$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceLabels are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/resource-manager/docs/tags/tags-overview for information on
+ tagging GCP resources. GCP supports a maximum of 50 tags per resource.
+ items:
+ description: GCPResourceTag is a tag to apply to GCP resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot be empty.
+ Tag key must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `._-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$
+ type: string
+ parentID:
+ description: |-
+ parentID is the ID of the hierarchical resource where the tags are defined,
+ e.g. at the Organization or the Project level. To find the Organization or Project ID refer to the following pages:
+ https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id,
+ https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects.
+ An OrganizationID must consist of decimal numbers, and cannot have leading zeroes.
+ A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters, numbers,
+ and hyphens, and must start with a letter, and cannot end with a hyphen.
+ maxLength: 32
+ minLength: 1
+ pattern: (^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 63 characters and cannot be empty.
+ Tag value must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `_-.@%=+:,*#&(){}[]` and spaces.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$
+ type: string
+ required:
+ - key
+ - parentID
+ - value
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceLabels may only be configured during installation
+ rule: '!has(oldSelf.resourceLabels) && !has(self.resourceLabels)
+ || has(oldSelf.resourceLabels) && has(self.resourceLabels)'
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ location:
+ description: location is where the cluster has been deployed
+ type: string
+ providerType:
+ description: providerType indicates the type of cluster that
+ was created
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ IBMCloud resources created for the cluster.
+ type: string
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Nutanix platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ cloudName:
+ description: |-
+ cloudName is the name of the desired OpenStack cloud in the
+ client configuration file (`clouds.yaml`).
+ type: string
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on OpenStack platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ OpenStack deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Ovirt platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ nodeDNSIP:
+ description: 'deprecated: as of 4.6, this field is no longer
+ set or honored. It will be removed in a future release.'
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ powervs:
+ description: powervs contains settings specific to the Power Systems
+ Virtual Servers infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ region:
+ description: region holds the default Power VS region for
+ new Power VS resources created by the cluster.
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the resource group name for new IBMCloud resources created for a cluster.
+ The resource group specified here will be used by cluster-image-registry-operator to set up a COS Instance in IBMCloud for the cluster registry.
+ More about resource groups can be found here: https://cloud.ibm.com/docs/account?topic=account-rgs.
+ When omitted, the image registry operator won't be able to configure storage,
+ which results in the image registry cluster operator not being in an available state.
+ maxLength: 40
+ pattern: ^[a-zA-Z0-9-_ ]+$
+ type: string
+ x-kubernetes-validations:
+ - message: resourceGroup is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ zone:
+ description: |-
+ zone holds the default zone for the new Power VS resources created by the cluster.
+ Note: Currently only single-zone OCP clusters are supported
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot unset resourceGroup once set
+ rule: '!has(oldSelf.resourceGroup) || has(self.resourceGroup)'
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "EquinixMetal", "PowerVS", "AlibabaCloud", "Nutanix" and "None".
+ Individual components may not support all platforms, and must handle
+ unrecognized platforms as None if they do not support that platform.
+
+ This value will be synced with to the `status.platform` and `status.platformStatus.type`.
+ Currently this value cannot be changed once set.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on VSphere platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ vSphere deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ type: object
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml
index 245bc3ea6..6cdb3f76a 100644
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml
@@ -828,6 +828,17 @@ spec:
- topology
- zone
type: object
+ x-kubernetes-validations:
+ - message: when zoneAffinity type is HostGroup, regionAffinity
+ type must be ComputeCluster
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type
+ == ''ComputeCluster'' : true'
+ - message: when zoneAffinity type is ComputeCluster, regionAffinity
+ type must be Datacenter
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''ComputeCluster'' ? has(self.regionAffinity) &&
+ self.regionAffinity.type == ''Datacenter'' : true'
type: array
x-kubernetes-list-map-keys:
- name
@@ -954,10 +965,11 @@ spec:
vcenters:
description: |-
vcenters holds the connection details for services to communicate with vCenter.
- Currently, only a single vCenter is supported, but in tech preview 3 vCenters are supported.
+ Up to 3 vCenters are supported.
Once the cluster has been installed, you are unable to change the current number of defined
- vCenters except in the case where the cluster has been upgraded from a version of OpenShift
- where the vsphere platform spec was not present. You may make modifications to the existing
+ vCenters except when 1.) the cluster has been upgraded from a version of OpenShift
+ where the vsphere platform spec was not present or 2.) in TechPreview you are able to add and
+ remove vCenters but may not remove all vCenters. You may make modifications to the existing
vCenters that are defined in the vcenters list in order to match with any added or modified
failure domains.
items:
@@ -1002,27 +1014,23 @@ spec:
- server
type: object
maxItems: 3
- minItems: 0
+ minItems: 1
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- - message: vcenters cannot be added or removed once set
- rule: 'size(self) != size(oldSelf) ? size(oldSelf) == 0
- && size(self) < 2 : true'
+ - message: vcenters must have unique server values
+ rule: self.all(x, self.exists_one(y, y.server == x.server))
type: object
x-kubernetes-validations:
- message: apiServerInternalIPs list is required once set
rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
- message: ingressIPs list is required once set
rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
- - message: vcenters can have at most 1 item when configured post-install
- rule: '!has(oldSelf.vcenters) && has(self.vcenters) ? size(self.vcenters)
- < 2 : true'
type: object
x-kubernetes-validations:
- message: vcenters can have at most 1 item when configured post-install
- rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? size(self.vsphere.vcenters)
- < 2 : true'
+ rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? (has(self.vsphere.vcenters)
+ && size(self.vsphere.vcenters) < 2) : true'
type: object
status:
description: status holds observed values from the cluster. They may not
@@ -1050,10 +1058,13 @@ spec:
and the operators should not configure the operand for highly-available operation
The 'External' mode indicates that the control plane is hosted externally to the cluster and that
its components are not visible within the cluster.
+ The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes
+ that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.
enum:
- HighlyAvailable
- HighlyAvailableArbiter
- SingleReplica
+ - DualReplica
- External
type: string
cpuPartitioning:
@@ -1172,6 +1183,110 @@ spec:
description: aws contains settings specific to the Amazon Web
Services infrastructure provider.
properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
region:
description: region holds the default AWS region for new AWS
resources created by the cluster.
@@ -1259,6 +1374,109 @@ spec:
description: armEndpoint specifies a URL to use for resource
management in non-soverign clouds such as Azure Stack.
type: string
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
cloudName:
description: |-
cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-CustomNoUpgrade.crd.yaml
new file mode 100644
index 000000000..310ba4ad3
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-CustomNoUpgrade.crd.yaml
@@ -0,0 +1,2798 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: CustomNoUpgrade
+ name: infrastructures.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Infrastructure
+ listKind: InfrastructureList
+ plural: infrastructures
+ singular: infrastructure
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Infrastructure holds cluster-wide information about Infrastructure. The canonical name is `cluster`
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ cloudConfig:
+ description: |-
+ cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file.
+ This configuration file is used to configure the Kubernetes cloud provider integration
+ when using the built-in cloud provider integration or the external cloud controller manager.
+ The namespace for this config map is openshift-config.
+
+ cloudConfig should only be consumed by the kube_cloud_config controller.
+ The controller is responsible for using the user configuration in the spec
+ for various platforms and combining that with the user provided ConfigMap in this field
+ to create a stitched kube cloud config.
+ The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace
+ with the kube cloud config is stored in `cloud.conf` key.
+ All the clients are expected to use the generated ConfigMap only.
+ properties:
+ key:
+ description: key allows pointing to a specific key/value inside
+ of the configmap. This is useful for logical file references.
+ type: string
+ name:
+ type: string
+ type: object
+ controlPlaneTopology:
+ description: |-
+ controlPlaneTopology expresses the desired topology configuration for control nodes.
+
+ When status.controlPlaneTopology is 'SingleReplica' and spec.controlPlaneTopology is set to 'HighlyAvailable',
+ a transition will be triggered to reconfigure the cluster from SingleReplica to HighlyAvailable.
+
+ When left blank or status.controlPlaneTopology and spec.controlPlaneTopology are the same value,
+ no changes are required and no transitions will be triggered.
+
+ This value may be set to match status.controlPlaneTopology regardless of the current value.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ platformSpec:
+ description: |-
+ platformSpec holds desired information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ type: object
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ type: object
+ external:
+ description: |-
+ ExternalPlatformType represents generic infrastructure provider.
+ Platform-specific components should be supplemented separately.
+ properties:
+ platformName:
+ default: Unknown
+ description: |-
+ platformName holds the arbitrary string representing the infrastructure provider name, expected to be set at the installation time.
+ This field is solely for informational and reporting purposes and is not expected to be used for decision-making.
+ type: string
+ x-kubernetes-validations:
+ - message: platform name cannot be changed once set
+ rule: oldSelf == 'Unknown' || self == oldSelf
+ type: object
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ type: object
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ A maximum of 13 service endpoints overrides are supported.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must use https scheme
+ rule: url(self).getScheme() == "https"
+ - message: url path must match /v[0,9]+ or /api/v[0,9]+
+ rule: matches((url(self).getEscapedPath()), '^/(api/)?v[0-9]+/{0,1}$')
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ failureDomains:
+ description: |-
+ failureDomains configures failure domains information for the Nutanix platform.
+ When set, the failure domains defined here may be used to spread Machines across
+ prism element clusters to improve fault tolerance of the cluster.
+ items:
+ description: NutanixFailureDomain configures failure domain
+ information for the Nutanix platform.
+ properties:
+ cluster:
+ description: |-
+ cluster is to identify the cluster (the Prism Element under management of the Prism Central),
+ in which the Machine's VM will be created. The cluster identifier (uuid or name) can be obtained
+ from the Prism Central console or using the prism_central API.
+ properties:
+ name:
+ description: name is the resource name in the PC.
+ It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource in
+ the PC. It cannot be empty if the type is UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ name:
+ description: |-
+ name defines the unique name of a failure domain.
+ Name is required and must be at most 64 characters in length.
+ It must consist of only lower case alphanumeric characters and hyphens (-).
+ It must start and end with an alphanumeric character.
+ This value is arbitrary and is used to identify the failure domain within the platform.
+ maxLength: 64
+ minLength: 1
+ pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?'
+ type: string
+ subnets:
+ description: |-
+ subnets holds a list of identifiers (one or more) of the cluster's network subnets
+ If the feature gate NutanixMultiSubnets is enabled, up to 32 subnets may be configured.
+ for the Machine's VM to connect to. The subnet identifiers (uuid or name) can be
+ obtained from the Prism Central console or using the prism_central API.
+ items:
+ description: NutanixResourceIdentifier holds the identity
+ of a Nutanix PC resource (cluster, image, subnet,
+ etc.)
+ properties:
+ name:
+ description: name is the resource name in the
+ PC. It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource
+ in the PC. It cannot be empty if the type is
+ UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ maxItems: 32
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: each subnet must be unique
+ rule: self.all(x, self.exists_one(y, x == y))
+ required:
+ - cluster
+ - name
+ - subnets
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ prismCentral:
+ description: |-
+ prismCentral holds the endpoint address and port to access the Nutanix Prism Central.
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS name
+ or IP address) of the Nutanix Prism Central or Element
+ (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the Nutanix
+ Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ prismElements:
+ description: |-
+ prismElements holds one or more endpoint address and port data to access the Nutanix
+ Prism Elements (clusters) of the Nutanix Prism Central. Currently we only support one
+ Prism Element (cluster) for an OpenShift cluster, where all the Nutanix resources (VMs, subnets, volumes, etc.)
+ used in the OpenShift cluster are located. In the future, we may support Nutanix resources (VMs, etc.)
+ spread over multiple Prism Elements (clusters) of the Prism Central.
+ items:
+ description: NutanixPrismElementEndpoint holds the name
+ and endpoint data for a Prism Element (cluster)
+ properties:
+ endpoint:
+ description: |-
+ endpoint holds the endpoint address and port data of the Prism Element (cluster).
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS
+ name or IP address) of the Nutanix Prism Central
+ or Element (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the
+ Nutanix Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ name:
+ description: |-
+ name is the name of the Prism Element (cluster). This value will correspond with
+ the cluster field configured on other resources (eg Machines, PVCs, etc).
+ maxLength: 256
+ type: string
+ required:
+ - endpoint
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - prismCentral
+ - prismElements
+ type: object
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ type: object
+ powervs:
+ description: powervs contains settings specific to the IBM Power
+ Systems Virtual Servers infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "IBMCloud", "KubeVirt", "EquinixMetal",
+ "PowerVS", "AlibabaCloud", "Nutanix", "External", and "None". Individual
+ components may not support all platforms, and must handle unrecognized
+ platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ failureDomains:
+ description: |-
+ failureDomains contains the definition of region, zone and the vCenter topology.
+ If this is omitted failure domains (regions and zones) will not be used.
+ items:
+ description: VSpherePlatformFailureDomainSpec holds the
+ region and zone failure domain and the vCenter topology
+ of that failure domain.
+ properties:
+ name:
+ description: |-
+ name defines the arbitrary but unique name
+ of a failure domain.
+ maxLength: 256
+ minLength: 1
+ type: string
+ region:
+ description: |-
+ region defines the name of a region tag that will
+ be attached to a vCenter datacenter. The tag
+ category in vCenter must be named openshift-region.
+ maxLength: 80
+ minLength: 1
+ type: string
+ regionAffinity:
+ description: |-
+ regionAffinity holds the type of region, Datacenter or ComputeCluster.
+ When set to Datacenter, this means the region is a vCenter Datacenter as defined in topology.
+ When set to ComputeCluster, this means the region is a vCenter Cluster as defined in topology.
+ properties:
+ type:
+ description: |-
+ type determines the vSphere object type for a region within this failure domain.
+ Available types are Datacenter and ComputeCluster.
+ When set to Datacenter, this means the vCenter Datacenter defined is the region.
+ When set to ComputeCluster, this means the vCenter cluster defined is the region.
+ enum:
+ - ComputeCluster
+ - Datacenter
+ type: string
+ required:
+ - type
+ type: object
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ minLength: 1
+ type: string
+ topology:
+ description: topology describes a given failure domain
+ using vSphere constructs
+ properties:
+ computeCluster:
+ description: |-
+ computeCluster the absolute path of the vCenter cluster
+ in which virtual machine will be located.
+ The absolute path is of the form //host/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?
+ type: string
+ datacenter:
+ description: |-
+ datacenter is the name of vCenter datacenter in which virtual machines will be located.
+ The maximum length of the datacenter name is 80 characters.
+ maxLength: 80
+ type: string
+ datastore:
+ description: |-
+ datastore is the absolute path of the datastore in which the
+ virtual machine is located.
+ The absolute path is of the form //datastore/
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/datastore/.*?
+ type: string
+ folder:
+ description: |-
+ folder is the absolute path of the folder where
+ virtual machines are located. The absolute path
+ is of the form //vm/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/vm/.*?
+ type: string
+ networks:
+ description: |-
+ networks is the list of port group network names within this failure domain.
+ If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined.
+ 10 is the maximum number of virtual network devices which may be attached to a VM as defined by:
+ https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ Networks should be in the form of an absolute path:
+ //network/.
+ items:
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ resourcePool:
+ description: |-
+ resourcePool is the absolute path of the resource pool where virtual machines will be
+ created. The absolute path is of the form //host//Resources/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?/Resources.*
+ type: string
+ template:
+ description: |-
+ template is the full inventory path of the virtual machine or template
+ that will be cloned when creating new machines in this failure domain.
+ The maximum length of the path is 2048 characters.
+
+ When omitted, the template will be calculated by the control plane
+ machineset operator based on the region and zone defined in
+ VSpherePlatformFailureDomainSpec.
+ For example, for zone=zonea, region=region1, and infrastructure name=test,
+ the template path would be calculated as //vm/test-rhcos-region1-zonea.
+ maxLength: 2048
+ minLength: 1
+ pattern: ^/.*?/vm/.*?
+ type: string
+ required:
+ - computeCluster
+ - datacenter
+ - datastore
+ - networks
+ type: object
+ zone:
+ description: |-
+ zone defines the name of a zone tag that will
+ be attached to a vCenter cluster. The tag
+ category in vCenter must be named openshift-zone.
+ maxLength: 80
+ minLength: 1
+ type: string
+ zoneAffinity:
+ description: |-
+ zoneAffinity holds the type of the zone and the hostGroup which
+ vmGroup and the hostGroup names in vCenter corresponds to
+ a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup holds the vmGroup and the hostGroup names in vCenter
+ corresponds to a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup is the name of the vm-host group of type host within vCenter for this failure domain.
+ hostGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmGroup:
+ description: |-
+ vmGroup is the name of the vm-host group of type virtual machine within vCenter for this failure domain.
+ vmGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmHostRule:
+ description: |-
+ vmHostRule is the name of the affinity vm-host rule within vCenter for this failure domain.
+ vmHostRule is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ required:
+ - hostGroup
+ - vmGroup
+ - vmHostRule
+ type: object
+ type:
+ description: |-
+ type determines the vSphere object type for a zone within this failure domain.
+ Available types are ComputeCluster and HostGroup.
+ When set to ComputeCluster, this means the vCenter cluster defined is the zone.
+ When set to HostGroup, hostGroup must be configured with hostGroup, vmGroup and vmHostRule and
+ this means the zone is defined by the grouping of those fields.
+ enum:
+ - HostGroup
+ - ComputeCluster
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: hostGroup is required when type is HostGroup,
+ and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''HostGroup''
+ ? has(self.hostGroup) : !has(self.hostGroup)'
+ required:
+ - name
+ - region
+ - server
+ - topology
+ - zone
+ type: object
+ x-kubernetes-validations:
+ - message: when zoneAffinity type is HostGroup, regionAffinity
+ type must be ComputeCluster
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type
+ == ''ComputeCluster'' : true'
+ - message: when zoneAffinity type is ComputeCluster, regionAffinity
+ type must be Datacenter
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''ComputeCluster'' ? has(self.regionAffinity) &&
+ self.regionAffinity.type == ''Datacenter'' : true'
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeNetworking:
+ description: |-
+ nodeNetworking contains the definition of internal and external network constraints for
+ assigning the node's networking.
+ If this field is omitted, networking defaults to the legacy
+ address selection behavior which is to only support a single address and
+ return the first one found.
+ properties:
+ external:
+ description: external represents the network configuration
+ of the node that is externally routable.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ internal:
+ description: internal represents the network configuration
+ of the node that is routable only within the cluster.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ type: object
+ vcenters:
+ description: |-
+ vcenters holds the connection details for services to communicate with vCenter.
+ Up to 3 vCenters are supported.
+ Once the cluster has been installed, you are unable to change the current number of defined
+ vCenters except when 1.) the cluster has been upgraded from a version of OpenShift
+ where the vsphere platform spec was not present or 2.) in TechPreview you are able to add and
+ remove vCenters but may not remove all vCenters. You may make modifications to the existing
+ vCenters that are defined in the vcenters list in order to match with any added or modified
+ failure domains.
+ items:
+ description: |-
+ VSpherePlatformVCenterSpec stores the vCenter connection fields.
+ This is used by the vSphere CCM.
+ properties:
+ datacenters:
+ description: |-
+ The vCenter Datacenters in which the RHCOS
+ vm guests are located. This field will
+ be used by the Cloud Controller Manager.
+ Each datacenter listed here should be used within
+ a topology.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the TCP port that will be used to communicate to
+ the vCenter endpoint.
+ When omitted, this means the user has no opinion and
+ it is up to the platform to choose a sensible default,
+ which is subject to change over time.
+ format: int32
+ maximum: 32767
+ minimum: 1
+ type: integer
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ type: string
+ required:
+ - datacenters
+ - server
+ type: object
+ maxItems: 3
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x, self.exists(y,
+ y.server == x.server)) : true'
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) < size(oldSelf) ? self.all(x, oldSelf.exists(y,
+ y.server == x.server)) : true'
+ - message: vcenters must have unique server values
+ rule: self.all(x, self.exists_one(y, y.server == x.server))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ type: object
+ x-kubernetes-validations:
+ - message: vcenters is required once set and cannot be removed
+ rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
+ : true'
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ apiServerInternalURI:
+ description: |-
+ apiServerInternalURL is a valid URI with scheme 'https',
+ address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components
+ like kubelets, to contact the Kubernetes API server using the
+ infrastructure provider rather than Kubernetes networking.
+ type: string
+ apiServerURL:
+ description: |-
+ apiServerURL is a valid URI with scheme 'https', address and
+ optionally a port (defaulting to 443). apiServerURL can be used by components like the web console
+ to tell users where to find the Kubernetes API.
+ type: string
+ controlPlaneTopology:
+ default: HighlyAvailable
+ description: |-
+ controlPlaneTopology expresses the expectations for operands that normally run on control nodes.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ The 'External' mode indicates that the control plane is hosted externally to the cluster and that
+ its components are not visible within the cluster.
+ The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes
+ that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.
+ enum:
+ - HighlyAvailable
+ - HighlyAvailableArbiter
+ - SingleReplica
+ - DualReplica
+ - External
+ type: string
+ cpuPartitioning:
+ default: None
+ description: |-
+ cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster.
+ CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets.
+ Valid values are "None" and "AllNodes". When omitted, the default value is "None".
+ The default value of "None" indicates that no nodes will be setup with CPU partitioning.
+ The "AllNodes" value indicates that all nodes have been setup with CPU partitioning,
+ and can then be further configured via the PerformanceProfile API.
+ enum:
+ - None
+ - AllNodes
+ type: string
+ etcdDiscoveryDomain:
+ description: |-
+ etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering
+ etcd servers and clients.
+ For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery
+ deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.
+ type: string
+ infrastructureName:
+ description: |-
+ infrastructureName uniquely identifies a cluster with a human friendly name.
+ Once set it should not be changed. Must be of max length 27 and must have only
+ alphanumeric or hyphen characters.
+ type: string
+ infrastructureTopology:
+ default: HighlyAvailable
+ description: |-
+ infrastructureTopology expresses the expectations for infrastructure services that do not run on control
+ plane nodes, usually indicated by a node selector for a `role` value
+ other than `master`.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ NOTE: External topology mode is not applicable for this field.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ platform:
+ description: |-
+ platform is the underlying infrastructure provider for the cluster.
+
+ Deprecated: Use platformStatus.type instead.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ platformStatus:
+ description: |-
+ platformStatus holds status information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ properties:
+ region:
+ description: region specifies the region for Alibaba Cloud
+ resources created for the cluster.
+ pattern: ^[0-9A-Za-z-]+$
+ type: string
+ resourceGroupID:
+ description: resourceGroupID is the ID of the resource group
+ for the cluster.
+ pattern: ^(rg-[0-9A-Za-z]+)?$
+ type: string
+ resourceTags:
+ description: resourceTags is a list of additional tags to
+ apply to Alibaba Cloud resources created for the cluster.
+ items:
+ description: AlibabaCloudResourceTag is the set of tags
+ to add to apply to resources.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ value:
+ description: value is the value of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ required:
+ - region
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for AWS
+ network resources. This controls whether AWS resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ region:
+ description: region holds the default AWS region for new AWS
+ resources created by the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created for the cluster.
+ See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources.
+ AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags
+ available for the user.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key sets the key of the AWS resource tag key-value pair. Key is required when defining an AWS resource tag.
+ Key should consist of between 1 and 128 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ maxLength: 128
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag key. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ value:
+ description: |-
+ value sets the value of the AWS resource tag key-value pair. Value is required when defining an AWS resource tag.
+ Value should consist of between 1 and 256 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ Some AWS service do not support empty values. Since tags are added to resources in many services, the
+ length of the tag value must meet the requirements of all services.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag value. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ properties:
+ armEndpoint:
+ description: armEndpoint specifies a URL to use for resource
+ management in non-soverign clouds such as Azure Stack.
+ type: string
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ cloudName:
+ description: |-
+ cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
+ with the appropriate Azure API endpoints.
+ If empty, the value is equal to `AzurePublicCloud`.
+ enum:
+ - ""
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for Azure
+ network resources. This controls whether Azure resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ networkResourceGroupName:
+ description: |-
+ networkResourceGroupName is the Resource Group for network resources like the Virtual Network and Subnets used by the cluster.
+ If empty, the value is same as ResourceGroupName.
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ Azure resources created for the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to Azure resources created for the cluster.
+ See https://docs.microsoft.com/en-us/rest/api/resources/tags for information on tagging Azure resources.
+ Due to limitations on Automation, Content Delivery Network, DNS Azure resources, a maximum of 15 tags
+ may be applied. OpenShift reserves 5 tags for internal use, allowing 10 tags for user configuration.
+ items:
+ description: AzureResourceTag is a tag to apply to Azure
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 128 characters and cannot be empty. Key
+ must begin with a letter, end with a letter, number or underscore, and must contain only alphanumeric
+ characters and the following special characters `_ . -`.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[a-zA-Z]([0-9A-Za-z_.-]*[0-9A-Za-z_])?$
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 256 characters and cannot be empty. Value
+ must contain only alphanumeric characters and the following special characters `_ + , - . / : ; < = > ? @`.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on BareMetal platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ BareMetal deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ external:
+ description: external contains settings specific to the generic
+ External infrastructure provider.
+ properties:
+ cloudControllerManager:
+ description: |-
+ cloudControllerManager contains settings specific to the external Cloud Controller Manager (a.k.a. CCM or CPI).
+ When omitted, new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ properties:
+ state:
+ description: |-
+ state determines whether or not an external Cloud Controller Manager is expected to
+ be installed within the cluster.
+ https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager
+
+ Valid values are "External", "None" and omitted.
+ When set to "External", new nodes will be tainted as uninitialized when created,
+ preventing them from running workloads until they are initialized by the cloud controller manager.
+ When omitted or set to "None", new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ enum:
+ - ""
+ - External
+ - None
+ type: string
+ x-kubernetes-validations:
+ - message: state is immutable once set
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: state may not be added or removed once set
+ rule: (has(self.state) == has(oldSelf.state)) || (!has(oldSelf.state)
+ && self.state != "External")
+ type: object
+ x-kubernetes-validations:
+ - message: cloudControllerManager may not be added or removed
+ once set
+ rule: has(self.cloudControllerManager) == has(oldSelf.cloudControllerManager)
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ projectID:
+ description: resourceGroupName is the Project ID for new GCP
+ resources created for the cluster.
+ type: string
+ region:
+ description: region holds the region for new GCP resources
+ created for the cluster.
+ type: string
+ resourceLabels:
+ description: |-
+ resourceLabels is a list of additional labels to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/compute/docs/labeling-resources for information on labeling GCP resources.
+ GCP supports a maximum of 64 labels per resource. OpenShift reserves 32 labels for internal use,
+ allowing 32 labels for user configuration.
+ items:
+ description: GCPResourceLabel is a label to apply to GCP
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the label. A label key can have a maximum of 63 characters and cannot be empty.
+ Label key must begin with a lowercase letter, and must contain only lowercase letters, numeric characters,
+ and the following special characters `_-`. Label key must not have the reserved prefixes `kubernetes-io`
+ and `openshift-io`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z][0-9a-z_-]{0,62}$
+ type: string
+ x-kubernetes-validations:
+ - message: label keys must not start with either `openshift-io`
+ or `kubernetes-io`
+ rule: '!self.startsWith(''openshift-io'') && !self.startsWith(''kubernetes-io'')'
+ value:
+ description: |-
+ value is the value part of the label. A label value can have a maximum of 63 characters and cannot be empty.
+ Value must contain only lowercase letters, numeric characters, and the following special characters `_-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[0-9a-z_-]{1,63}$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceLabels are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/resource-manager/docs/tags/tags-overview for information on
+ tagging GCP resources. GCP supports a maximum of 50 tags per resource.
+ items:
+ description: GCPResourceTag is a tag to apply to GCP resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot be empty.
+ Tag key must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `._-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$
+ type: string
+ parentID:
+ description: |-
+ parentID is the ID of the hierarchical resource where the tags are defined,
+ e.g. at the Organization or the Project level. To find the Organization or Project ID refer to the following pages:
+ https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id,
+ https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects.
+ An OrganizationID must consist of decimal numbers, and cannot have leading zeroes.
+ A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters, numbers,
+ and hyphens, and must start with a letter, and cannot end with a hyphen.
+ maxLength: 32
+ minLength: 1
+ pattern: (^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 63 characters and cannot be empty.
+ Tag value must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `_-.@%=+:,*#&(){}[]` and spaces.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$
+ type: string
+ required:
+ - key
+ - parentID
+ - value
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceLabels may only be configured during installation
+ rule: '!has(oldSelf.resourceLabels) && !has(self.resourceLabels)
+ || has(oldSelf.resourceLabels) && has(self.resourceLabels)'
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ location:
+ description: location is where the cluster has been deployed
+ type: string
+ providerType:
+ description: providerType indicates the type of cluster that
+ was created
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ IBMCloud resources created for the cluster.
+ type: string
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Nutanix platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ cloudName:
+ description: |-
+ cloudName is the name of the desired OpenStack cloud in the
+ client configuration file (`clouds.yaml`).
+ type: string
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on OpenStack platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ OpenStack deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Ovirt platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ nodeDNSIP:
+ description: 'deprecated: as of 4.6, this field is no longer
+ set or honored. It will be removed in a future release.'
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ powervs:
+ description: powervs contains settings specific to the Power Systems
+ Virtual Servers infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ region:
+ description: region holds the default Power VS region for
+ new Power VS resources created by the cluster.
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the resource group name for new IBMCloud resources created for a cluster.
+ The resource group specified here will be used by cluster-image-registry-operator to set up a COS Instance in IBMCloud for the cluster registry.
+ More about resource groups can be found here: https://cloud.ibm.com/docs/account?topic=account-rgs.
+ When omitted, the image registry operator won't be able to configure storage,
+ which results in the image registry cluster operator not being in an available state.
+ maxLength: 40
+ pattern: ^[a-zA-Z0-9-_ ]+$
+ type: string
+ x-kubernetes-validations:
+ - message: resourceGroup is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ zone:
+ description: |-
+ zone holds the default zone for the new Power VS resources created by the cluster.
+ Note: Currently only single-zone OCP clusters are supported
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot unset resourceGroup once set
+ rule: '!has(oldSelf.resourceGroup) || has(self.resourceGroup)'
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "EquinixMetal", "PowerVS", "AlibabaCloud", "Nutanix" and "None".
+ Individual components may not support all platforms, and must handle
+ unrecognized platforms as None if they do not support that platform.
+
+ This value will be synced with to the `status.platform` and `status.platformStatus.type`.
+ Currently this value cannot be changed once set.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on VSphere platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ vSphere deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ type: object
+ type: object
+ required:
+ - spec
+ type: object
+ x-kubernetes-validations:
+ - message: spec.controlPlaneTopology must match status.controlPlaneTopology
+ or be set to HighlyAvailable when status.controlPlaneTopology is SingleReplica
+ rule: '!has(self.spec.controlPlaneTopology) || (has(oldSelf.spec.controlPlaneTopology)
+ && self.spec.controlPlaneTopology == oldSelf.spec.controlPlaneTopology)
+ || (has(self.status.controlPlaneTopology) && self.spec.controlPlaneTopology
+ == self.status.controlPlaneTopology) || (has(self.status.controlPlaneTopology)
+ && self.status.controlPlaneTopology == ''SingleReplica'' && self.spec.controlPlaneTopology
+ == ''HighlyAvailable'')'
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml
new file mode 100644
index 000000000..f3b307973
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,2798 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: DevPreviewNoUpgrade
+ name: infrastructures.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Infrastructure
+ listKind: InfrastructureList
+ plural: infrastructures
+ singular: infrastructure
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Infrastructure holds cluster-wide information about Infrastructure. The canonical name is `cluster`
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ cloudConfig:
+ description: |-
+ cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file.
+ This configuration file is used to configure the Kubernetes cloud provider integration
+ when using the built-in cloud provider integration or the external cloud controller manager.
+ The namespace for this config map is openshift-config.
+
+ cloudConfig should only be consumed by the kube_cloud_config controller.
+ The controller is responsible for using the user configuration in the spec
+ for various platforms and combining that with the user provided ConfigMap in this field
+ to create a stitched kube cloud config.
+ The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace
+ with the kube cloud config is stored in `cloud.conf` key.
+ All the clients are expected to use the generated ConfigMap only.
+ properties:
+ key:
+ description: key allows pointing to a specific key/value inside
+ of the configmap. This is useful for logical file references.
+ type: string
+ name:
+ type: string
+ type: object
+ controlPlaneTopology:
+ description: |-
+ controlPlaneTopology expresses the desired topology configuration for control nodes.
+
+ When status.controlPlaneTopology is 'SingleReplica' and spec.controlPlaneTopology is set to 'HighlyAvailable',
+ a transition will be triggered to reconfigure the cluster from SingleReplica to HighlyAvailable.
+
+ When left blank or status.controlPlaneTopology and spec.controlPlaneTopology are the same value,
+ no changes are required and no transitions will be triggered.
+
+ This value may be set to match status.controlPlaneTopology regardless of the current value.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ platformSpec:
+ description: |-
+ platformSpec holds desired information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ type: object
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ type: object
+ external:
+ description: |-
+ ExternalPlatformType represents generic infrastructure provider.
+ Platform-specific components should be supplemented separately.
+ properties:
+ platformName:
+ default: Unknown
+ description: |-
+ platformName holds the arbitrary string representing the infrastructure provider name, expected to be set at the installation time.
+ This field is solely for informational and reporting purposes and is not expected to be used for decision-making.
+ type: string
+ x-kubernetes-validations:
+ - message: platform name cannot be changed once set
+ rule: oldSelf == 'Unknown' || self == oldSelf
+ type: object
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ type: object
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ A maximum of 13 service endpoints overrides are supported.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must use https scheme
+ rule: url(self).getScheme() == "https"
+ - message: url path must match /v[0,9]+ or /api/v[0,9]+
+ rule: matches((url(self).getEscapedPath()), '^/(api/)?v[0-9]+/{0,1}$')
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ failureDomains:
+ description: |-
+ failureDomains configures failure domains information for the Nutanix platform.
+ When set, the failure domains defined here may be used to spread Machines across
+ prism element clusters to improve fault tolerance of the cluster.
+ items:
+ description: NutanixFailureDomain configures failure domain
+ information for the Nutanix platform.
+ properties:
+ cluster:
+ description: |-
+ cluster is to identify the cluster (the Prism Element under management of the Prism Central),
+ in which the Machine's VM will be created. The cluster identifier (uuid or name) can be obtained
+ from the Prism Central console or using the prism_central API.
+ properties:
+ name:
+ description: name is the resource name in the PC.
+ It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource in
+ the PC. It cannot be empty if the type is UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ name:
+ description: |-
+ name defines the unique name of a failure domain.
+ Name is required and must be at most 64 characters in length.
+ It must consist of only lower case alphanumeric characters and hyphens (-).
+ It must start and end with an alphanumeric character.
+ This value is arbitrary and is used to identify the failure domain within the platform.
+ maxLength: 64
+ minLength: 1
+ pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?'
+ type: string
+ subnets:
+ description: |-
+ subnets holds a list of identifiers (one or more) of the cluster's network subnets
+ If the feature gate NutanixMultiSubnets is enabled, up to 32 subnets may be configured.
+ for the Machine's VM to connect to. The subnet identifiers (uuid or name) can be
+ obtained from the Prism Central console or using the prism_central API.
+ items:
+ description: NutanixResourceIdentifier holds the identity
+ of a Nutanix PC resource (cluster, image, subnet,
+ etc.)
+ properties:
+ name:
+ description: name is the resource name in the
+ PC. It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource
+ in the PC. It cannot be empty if the type is
+ UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ maxItems: 32
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: each subnet must be unique
+ rule: self.all(x, self.exists_one(y, x == y))
+ required:
+ - cluster
+ - name
+ - subnets
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ prismCentral:
+ description: |-
+ prismCentral holds the endpoint address and port to access the Nutanix Prism Central.
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS name
+ or IP address) of the Nutanix Prism Central or Element
+ (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the Nutanix
+ Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ prismElements:
+ description: |-
+ prismElements holds one or more endpoint address and port data to access the Nutanix
+ Prism Elements (clusters) of the Nutanix Prism Central. Currently we only support one
+ Prism Element (cluster) for an OpenShift cluster, where all the Nutanix resources (VMs, subnets, volumes, etc.)
+ used in the OpenShift cluster are located. In the future, we may support Nutanix resources (VMs, etc.)
+ spread over multiple Prism Elements (clusters) of the Prism Central.
+ items:
+ description: NutanixPrismElementEndpoint holds the name
+ and endpoint data for a Prism Element (cluster)
+ properties:
+ endpoint:
+ description: |-
+ endpoint holds the endpoint address and port data of the Prism Element (cluster).
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS
+ name or IP address) of the Nutanix Prism Central
+ or Element (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the
+ Nutanix Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ name:
+ description: |-
+ name is the name of the Prism Element (cluster). This value will correspond with
+ the cluster field configured on other resources (eg Machines, PVCs, etc).
+ maxLength: 256
+ type: string
+ required:
+ - endpoint
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - prismCentral
+ - prismElements
+ type: object
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ type: object
+ powervs:
+ description: powervs contains settings specific to the IBM Power
+ Systems Virtual Servers infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "IBMCloud", "KubeVirt", "EquinixMetal",
+ "PowerVS", "AlibabaCloud", "Nutanix", "External", and "None". Individual
+ components may not support all platforms, and must handle unrecognized
+ platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ failureDomains:
+ description: |-
+ failureDomains contains the definition of region, zone and the vCenter topology.
+ If this is omitted failure domains (regions and zones) will not be used.
+ items:
+ description: VSpherePlatformFailureDomainSpec holds the
+ region and zone failure domain and the vCenter topology
+ of that failure domain.
+ properties:
+ name:
+ description: |-
+ name defines the arbitrary but unique name
+ of a failure domain.
+ maxLength: 256
+ minLength: 1
+ type: string
+ region:
+ description: |-
+ region defines the name of a region tag that will
+ be attached to a vCenter datacenter. The tag
+ category in vCenter must be named openshift-region.
+ maxLength: 80
+ minLength: 1
+ type: string
+ regionAffinity:
+ description: |-
+ regionAffinity holds the type of region, Datacenter or ComputeCluster.
+ When set to Datacenter, this means the region is a vCenter Datacenter as defined in topology.
+ When set to ComputeCluster, this means the region is a vCenter Cluster as defined in topology.
+ properties:
+ type:
+ description: |-
+ type determines the vSphere object type for a region within this failure domain.
+ Available types are Datacenter and ComputeCluster.
+ When set to Datacenter, this means the vCenter Datacenter defined is the region.
+ When set to ComputeCluster, this means the vCenter cluster defined is the region.
+ enum:
+ - ComputeCluster
+ - Datacenter
+ type: string
+ required:
+ - type
+ type: object
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ minLength: 1
+ type: string
+ topology:
+ description: topology describes a given failure domain
+ using vSphere constructs
+ properties:
+ computeCluster:
+ description: |-
+ computeCluster the absolute path of the vCenter cluster
+ in which virtual machine will be located.
+ The absolute path is of the form //host/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?
+ type: string
+ datacenter:
+ description: |-
+ datacenter is the name of vCenter datacenter in which virtual machines will be located.
+ The maximum length of the datacenter name is 80 characters.
+ maxLength: 80
+ type: string
+ datastore:
+ description: |-
+ datastore is the absolute path of the datastore in which the
+ virtual machine is located.
+ The absolute path is of the form //datastore/
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/datastore/.*?
+ type: string
+ folder:
+ description: |-
+ folder is the absolute path of the folder where
+ virtual machines are located. The absolute path
+ is of the form //vm/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/vm/.*?
+ type: string
+ networks:
+ description: |-
+ networks is the list of port group network names within this failure domain.
+ If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined.
+ 10 is the maximum number of virtual network devices which may be attached to a VM as defined by:
+ https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ Networks should be in the form of an absolute path:
+ //network/.
+ items:
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ resourcePool:
+ description: |-
+ resourcePool is the absolute path of the resource pool where virtual machines will be
+ created. The absolute path is of the form //host//Resources/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?/Resources.*
+ type: string
+ template:
+ description: |-
+ template is the full inventory path of the virtual machine or template
+ that will be cloned when creating new machines in this failure domain.
+ The maximum length of the path is 2048 characters.
+
+ When omitted, the template will be calculated by the control plane
+ machineset operator based on the region and zone defined in
+ VSpherePlatformFailureDomainSpec.
+ For example, for zone=zonea, region=region1, and infrastructure name=test,
+ the template path would be calculated as //vm/test-rhcos-region1-zonea.
+ maxLength: 2048
+ minLength: 1
+ pattern: ^/.*?/vm/.*?
+ type: string
+ required:
+ - computeCluster
+ - datacenter
+ - datastore
+ - networks
+ type: object
+ zone:
+ description: |-
+ zone defines the name of a zone tag that will
+ be attached to a vCenter cluster. The tag
+ category in vCenter must be named openshift-zone.
+ maxLength: 80
+ minLength: 1
+ type: string
+ zoneAffinity:
+ description: |-
+ zoneAffinity holds the type of the zone and the hostGroup which
+ vmGroup and the hostGroup names in vCenter corresponds to
+ a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup holds the vmGroup and the hostGroup names in vCenter
+ corresponds to a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup is the name of the vm-host group of type host within vCenter for this failure domain.
+ hostGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmGroup:
+ description: |-
+ vmGroup is the name of the vm-host group of type virtual machine within vCenter for this failure domain.
+ vmGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmHostRule:
+ description: |-
+ vmHostRule is the name of the affinity vm-host rule within vCenter for this failure domain.
+ vmHostRule is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ required:
+ - hostGroup
+ - vmGroup
+ - vmHostRule
+ type: object
+ type:
+ description: |-
+ type determines the vSphere object type for a zone within this failure domain.
+ Available types are ComputeCluster and HostGroup.
+ When set to ComputeCluster, this means the vCenter cluster defined is the zone.
+ When set to HostGroup, hostGroup must be configured with hostGroup, vmGroup and vmHostRule and
+ this means the zone is defined by the grouping of those fields.
+ enum:
+ - HostGroup
+ - ComputeCluster
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: hostGroup is required when type is HostGroup,
+ and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''HostGroup''
+ ? has(self.hostGroup) : !has(self.hostGroup)'
+ required:
+ - name
+ - region
+ - server
+ - topology
+ - zone
+ type: object
+ x-kubernetes-validations:
+ - message: when zoneAffinity type is HostGroup, regionAffinity
+ type must be ComputeCluster
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type
+ == ''ComputeCluster'' : true'
+ - message: when zoneAffinity type is ComputeCluster, regionAffinity
+ type must be Datacenter
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''ComputeCluster'' ? has(self.regionAffinity) &&
+ self.regionAffinity.type == ''Datacenter'' : true'
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeNetworking:
+ description: |-
+ nodeNetworking contains the definition of internal and external network constraints for
+ assigning the node's networking.
+ If this field is omitted, networking defaults to the legacy
+ address selection behavior which is to only support a single address and
+ return the first one found.
+ properties:
+ external:
+ description: external represents the network configuration
+ of the node that is externally routable.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ internal:
+ description: internal represents the network configuration
+ of the node that is routable only within the cluster.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ type: object
+ vcenters:
+ description: |-
+ vcenters holds the connection details for services to communicate with vCenter.
+ Up to 3 vCenters are supported.
+ Once the cluster has been installed, you are unable to change the current number of defined
+ vCenters except when 1.) the cluster has been upgraded from a version of OpenShift
+ where the vsphere platform spec was not present or 2.) in TechPreview you are able to add and
+ remove vCenters but may not remove all vCenters. You may make modifications to the existing
+ vCenters that are defined in the vcenters list in order to match with any added or modified
+ failure domains.
+ items:
+ description: |-
+ VSpherePlatformVCenterSpec stores the vCenter connection fields.
+ This is used by the vSphere CCM.
+ properties:
+ datacenters:
+ description: |-
+ The vCenter Datacenters in which the RHCOS
+ vm guests are located. This field will
+ be used by the Cloud Controller Manager.
+ Each datacenter listed here should be used within
+ a topology.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the TCP port that will be used to communicate to
+ the vCenter endpoint.
+ When omitted, this means the user has no opinion and
+ it is up to the platform to choose a sensible default,
+ which is subject to change over time.
+ format: int32
+ maximum: 32767
+ minimum: 1
+ type: integer
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ type: string
+ required:
+ - datacenters
+ - server
+ type: object
+ maxItems: 3
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x, self.exists(y,
+ y.server == x.server)) : true'
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) < size(oldSelf) ? self.all(x, oldSelf.exists(y,
+ y.server == x.server)) : true'
+ - message: vcenters must have unique server values
+ rule: self.all(x, self.exists_one(y, y.server == x.server))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ type: object
+ x-kubernetes-validations:
+ - message: vcenters is required once set and cannot be removed
+ rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
+ : true'
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ apiServerInternalURI:
+ description: |-
+ apiServerInternalURL is a valid URI with scheme 'https',
+ address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components
+ like kubelets, to contact the Kubernetes API server using the
+ infrastructure provider rather than Kubernetes networking.
+ type: string
+ apiServerURL:
+ description: |-
+ apiServerURL is a valid URI with scheme 'https', address and
+ optionally a port (defaulting to 443). apiServerURL can be used by components like the web console
+ to tell users where to find the Kubernetes API.
+ type: string
+ controlPlaneTopology:
+ default: HighlyAvailable
+ description: |-
+ controlPlaneTopology expresses the expectations for operands that normally run on control nodes.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ The 'External' mode indicates that the control plane is hosted externally to the cluster and that
+ its components are not visible within the cluster.
+ The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes
+ that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.
+ enum:
+ - HighlyAvailable
+ - HighlyAvailableArbiter
+ - SingleReplica
+ - DualReplica
+ - External
+ type: string
+ cpuPartitioning:
+ default: None
+ description: |-
+ cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster.
+ CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets.
+ Valid values are "None" and "AllNodes". When omitted, the default value is "None".
+ The default value of "None" indicates that no nodes will be setup with CPU partitioning.
+ The "AllNodes" value indicates that all nodes have been setup with CPU partitioning,
+ and can then be further configured via the PerformanceProfile API.
+ enum:
+ - None
+ - AllNodes
+ type: string
+ etcdDiscoveryDomain:
+ description: |-
+ etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering
+ etcd servers and clients.
+ For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery
+ deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.
+ type: string
+ infrastructureName:
+ description: |-
+ infrastructureName uniquely identifies a cluster with a human friendly name.
+ Once set it should not be changed. Must be of max length 27 and must have only
+ alphanumeric or hyphen characters.
+ type: string
+ infrastructureTopology:
+ default: HighlyAvailable
+ description: |-
+ infrastructureTopology expresses the expectations for infrastructure services that do not run on control
+ plane nodes, usually indicated by a node selector for a `role` value
+ other than `master`.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ NOTE: External topology mode is not applicable for this field.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ platform:
+ description: |-
+ platform is the underlying infrastructure provider for the cluster.
+
+ Deprecated: Use platformStatus.type instead.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ platformStatus:
+ description: |-
+ platformStatus holds status information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ properties:
+ region:
+ description: region specifies the region for Alibaba Cloud
+ resources created for the cluster.
+ pattern: ^[0-9A-Za-z-]+$
+ type: string
+ resourceGroupID:
+ description: resourceGroupID is the ID of the resource group
+ for the cluster.
+ pattern: ^(rg-[0-9A-Za-z]+)?$
+ type: string
+ resourceTags:
+ description: resourceTags is a list of additional tags to
+ apply to Alibaba Cloud resources created for the cluster.
+ items:
+ description: AlibabaCloudResourceTag is the set of tags
+ to add to apply to resources.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ value:
+ description: value is the value of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ required:
+ - region
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for AWS
+ network resources. This controls whether AWS resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ region:
+ description: region holds the default AWS region for new AWS
+ resources created by the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created for the cluster.
+ See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources.
+ AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags
+ available for the user.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key sets the key of the AWS resource tag key-value pair. Key is required when defining an AWS resource tag.
+ Key should consist of between 1 and 128 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ maxLength: 128
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag key. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ value:
+ description: |-
+ value sets the value of the AWS resource tag key-value pair. Value is required when defining an AWS resource tag.
+ Value should consist of between 1 and 256 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ Some AWS service do not support empty values. Since tags are added to resources in many services, the
+ length of the tag value must meet the requirements of all services.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag value. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ properties:
+ armEndpoint:
+ description: armEndpoint specifies a URL to use for resource
+ management in non-soverign clouds such as Azure Stack.
+ type: string
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ cloudName:
+ description: |-
+ cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
+ with the appropriate Azure API endpoints.
+ If empty, the value is equal to `AzurePublicCloud`.
+ enum:
+ - ""
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for Azure
+ network resources. This controls whether Azure resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ networkResourceGroupName:
+ description: |-
+ networkResourceGroupName is the Resource Group for network resources like the Virtual Network and Subnets used by the cluster.
+ If empty, the value is same as ResourceGroupName.
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ Azure resources created for the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to Azure resources created for the cluster.
+ See https://docs.microsoft.com/en-us/rest/api/resources/tags for information on tagging Azure resources.
+ Due to limitations on Automation, Content Delivery Network, DNS Azure resources, a maximum of 15 tags
+ may be applied. OpenShift reserves 5 tags for internal use, allowing 10 tags for user configuration.
+ items:
+ description: AzureResourceTag is a tag to apply to Azure
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 128 characters and cannot be empty. Key
+ must begin with a letter, end with a letter, number or underscore, and must contain only alphanumeric
+ characters and the following special characters `_ . -`.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[a-zA-Z]([0-9A-Za-z_.-]*[0-9A-Za-z_])?$
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 256 characters and cannot be empty. Value
+ must contain only alphanumeric characters and the following special characters `_ + , - . / : ; < = > ? @`.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on BareMetal platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ BareMetal deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ external:
+ description: external contains settings specific to the generic
+ External infrastructure provider.
+ properties:
+ cloudControllerManager:
+ description: |-
+ cloudControllerManager contains settings specific to the external Cloud Controller Manager (a.k.a. CCM or CPI).
+ When omitted, new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ properties:
+ state:
+ description: |-
+ state determines whether or not an external Cloud Controller Manager is expected to
+ be installed within the cluster.
+ https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager
+
+ Valid values are "External", "None" and omitted.
+ When set to "External", new nodes will be tainted as uninitialized when created,
+ preventing them from running workloads until they are initialized by the cloud controller manager.
+ When omitted or set to "None", new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ enum:
+ - ""
+ - External
+ - None
+ type: string
+ x-kubernetes-validations:
+ - message: state is immutable once set
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: state may not be added or removed once set
+ rule: (has(self.state) == has(oldSelf.state)) || (!has(oldSelf.state)
+ && self.state != "External")
+ type: object
+ x-kubernetes-validations:
+ - message: cloudControllerManager may not be added or removed
+ once set
+ rule: has(self.cloudControllerManager) == has(oldSelf.cloudControllerManager)
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ projectID:
+ description: resourceGroupName is the Project ID for new GCP
+ resources created for the cluster.
+ type: string
+ region:
+ description: region holds the region for new GCP resources
+ created for the cluster.
+ type: string
+ resourceLabels:
+ description: |-
+ resourceLabels is a list of additional labels to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/compute/docs/labeling-resources for information on labeling GCP resources.
+ GCP supports a maximum of 64 labels per resource. OpenShift reserves 32 labels for internal use,
+ allowing 32 labels for user configuration.
+ items:
+ description: GCPResourceLabel is a label to apply to GCP
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the label. A label key can have a maximum of 63 characters and cannot be empty.
+ Label key must begin with a lowercase letter, and must contain only lowercase letters, numeric characters,
+ and the following special characters `_-`. Label key must not have the reserved prefixes `kubernetes-io`
+ and `openshift-io`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z][0-9a-z_-]{0,62}$
+ type: string
+ x-kubernetes-validations:
+ - message: label keys must not start with either `openshift-io`
+ or `kubernetes-io`
+ rule: '!self.startsWith(''openshift-io'') && !self.startsWith(''kubernetes-io'')'
+ value:
+ description: |-
+ value is the value part of the label. A label value can have a maximum of 63 characters and cannot be empty.
+ Value must contain only lowercase letters, numeric characters, and the following special characters `_-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[0-9a-z_-]{1,63}$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceLabels are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/resource-manager/docs/tags/tags-overview for information on
+ tagging GCP resources. GCP supports a maximum of 50 tags per resource.
+ items:
+ description: GCPResourceTag is a tag to apply to GCP resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot be empty.
+ Tag key must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `._-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$
+ type: string
+ parentID:
+ description: |-
+ parentID is the ID of the hierarchical resource where the tags are defined,
+ e.g. at the Organization or the Project level. To find the Organization or Project ID refer to the following pages:
+ https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id,
+ https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects.
+ An OrganizationID must consist of decimal numbers, and cannot have leading zeroes.
+ A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters, numbers,
+ and hyphens, and must start with a letter, and cannot end with a hyphen.
+ maxLength: 32
+ minLength: 1
+ pattern: (^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 63 characters and cannot be empty.
+ Tag value must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `_-.@%=+:,*#&(){}[]` and spaces.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$
+ type: string
+ required:
+ - key
+ - parentID
+ - value
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceLabels may only be configured during installation
+ rule: '!has(oldSelf.resourceLabels) && !has(self.resourceLabels)
+ || has(oldSelf.resourceLabels) && has(self.resourceLabels)'
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ location:
+ description: location is where the cluster has been deployed
+ type: string
+ providerType:
+ description: providerType indicates the type of cluster that
+ was created
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ IBMCloud resources created for the cluster.
+ type: string
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Nutanix platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ cloudName:
+ description: |-
+ cloudName is the name of the desired OpenStack cloud in the
+ client configuration file (`clouds.yaml`).
+ type: string
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on OpenStack platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ OpenStack deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Ovirt platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ nodeDNSIP:
+ description: 'deprecated: as of 4.6, this field is no longer
+ set or honored. It will be removed in a future release.'
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ powervs:
+ description: powervs contains settings specific to the Power Systems
+ Virtual Servers infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ region:
+ description: region holds the default Power VS region for
+ new Power VS resources created by the cluster.
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the resource group name for new IBMCloud resources created for a cluster.
+ The resource group specified here will be used by cluster-image-registry-operator to set up a COS Instance in IBMCloud for the cluster registry.
+ More about resource groups can be found here: https://cloud.ibm.com/docs/account?topic=account-rgs.
+ When omitted, the image registry operator won't be able to configure storage,
+ which results in the image registry cluster operator not being in an available state.
+ maxLength: 40
+ pattern: ^[a-zA-Z0-9-_ ]+$
+ type: string
+ x-kubernetes-validations:
+ - message: resourceGroup is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ zone:
+ description: |-
+ zone holds the default zone for the new Power VS resources created by the cluster.
+ Note: Currently only single-zone OCP clusters are supported
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot unset resourceGroup once set
+ rule: '!has(oldSelf.resourceGroup) || has(self.resourceGroup)'
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "EquinixMetal", "PowerVS", "AlibabaCloud", "Nutanix" and "None".
+ Individual components may not support all platforms, and must handle
+ unrecognized platforms as None if they do not support that platform.
+
+ This value will be synced with to the `status.platform` and `status.platformStatus.type`.
+ Currently this value cannot be changed once set.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on VSphere platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ vSphere deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ type: object
+ type: object
+ required:
+ - spec
+ type: object
+ x-kubernetes-validations:
+ - message: spec.controlPlaneTopology must match status.controlPlaneTopology
+ or be set to HighlyAvailable when status.controlPlaneTopology is SingleReplica
+ rule: '!has(self.spec.controlPlaneTopology) || (has(oldSelf.spec.controlPlaneTopology)
+ && self.spec.controlPlaneTopology == oldSelf.spec.controlPlaneTopology)
+ || (has(self.status.controlPlaneTopology) && self.spec.controlPlaneTopology
+ == self.status.controlPlaneTopology) || (has(self.status.controlPlaneTopology)
+ && self.status.controlPlaneTopology == ''SingleReplica'' && self.spec.controlPlaneTopology
+ == ''HighlyAvailable'')'
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-TechPreviewNoUpgrade.crd.yaml
new file mode 100644
index 000000000..998b9be39
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-TechPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,2774 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: TechPreviewNoUpgrade
+ name: infrastructures.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Infrastructure
+ listKind: InfrastructureList
+ plural: infrastructures
+ singular: infrastructure
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Infrastructure holds cluster-wide information about Infrastructure. The canonical name is `cluster`
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ cloudConfig:
+ description: |-
+ cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file.
+ This configuration file is used to configure the Kubernetes cloud provider integration
+ when using the built-in cloud provider integration or the external cloud controller manager.
+ The namespace for this config map is openshift-config.
+
+ cloudConfig should only be consumed by the kube_cloud_config controller.
+ The controller is responsible for using the user configuration in the spec
+ for various platforms and combining that with the user provided ConfigMap in this field
+ to create a stitched kube cloud config.
+ The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace
+ with the kube cloud config is stored in `cloud.conf` key.
+ All the clients are expected to use the generated ConfigMap only.
+ properties:
+ key:
+ description: key allows pointing to a specific key/value inside
+ of the configmap. This is useful for logical file references.
+ type: string
+ name:
+ type: string
+ type: object
+ platformSpec:
+ description: |-
+ platformSpec holds desired information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ type: object
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ type: object
+ external:
+ description: |-
+ ExternalPlatformType represents generic infrastructure provider.
+ Platform-specific components should be supplemented separately.
+ properties:
+ platformName:
+ default: Unknown
+ description: |-
+ platformName holds the arbitrary string representing the infrastructure provider name, expected to be set at the installation time.
+ This field is solely for informational and reporting purposes and is not expected to be used for decision-making.
+ type: string
+ x-kubernetes-validations:
+ - message: platform name cannot be changed once set
+ rule: oldSelf == 'Unknown' || self == oldSelf
+ type: object
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ type: object
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ A maximum of 13 service endpoints overrides are supported.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must use https scheme
+ rule: url(self).getScheme() == "https"
+ - message: url path must match /v[0,9]+ or /api/v[0,9]+
+ rule: matches((url(self).getEscapedPath()), '^/(api/)?v[0-9]+/{0,1}$')
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ failureDomains:
+ description: |-
+ failureDomains configures failure domains information for the Nutanix platform.
+ When set, the failure domains defined here may be used to spread Machines across
+ prism element clusters to improve fault tolerance of the cluster.
+ items:
+ description: NutanixFailureDomain configures failure domain
+ information for the Nutanix platform.
+ properties:
+ cluster:
+ description: |-
+ cluster is to identify the cluster (the Prism Element under management of the Prism Central),
+ in which the Machine's VM will be created. The cluster identifier (uuid or name) can be obtained
+ from the Prism Central console or using the prism_central API.
+ properties:
+ name:
+ description: name is the resource name in the PC.
+ It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource in
+ the PC. It cannot be empty if the type is UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ name:
+ description: |-
+ name defines the unique name of a failure domain.
+ Name is required and must be at most 64 characters in length.
+ It must consist of only lower case alphanumeric characters and hyphens (-).
+ It must start and end with an alphanumeric character.
+ This value is arbitrary and is used to identify the failure domain within the platform.
+ maxLength: 64
+ minLength: 1
+ pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?'
+ type: string
+ subnets:
+ description: |-
+ subnets holds a list of identifiers (one or more) of the cluster's network subnets
+ If the feature gate NutanixMultiSubnets is enabled, up to 32 subnets may be configured.
+ for the Machine's VM to connect to. The subnet identifiers (uuid or name) can be
+ obtained from the Prism Central console or using the prism_central API.
+ items:
+ description: NutanixResourceIdentifier holds the identity
+ of a Nutanix PC resource (cluster, image, subnet,
+ etc.)
+ properties:
+ name:
+ description: name is the resource name in the
+ PC. It cannot be empty if the type is Name.
+ type: string
+ type:
+ description: type is the identifier type to use
+ for this resource.
+ enum:
+ - UUID
+ - Name
+ type: string
+ uuid:
+ description: uuid is the UUID of the resource
+ in the PC. It cannot be empty if the type is
+ UUID.
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: uuid configuration is required when type
+ is UUID, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
+ : !has(self.uuid)'
+ - message: name configuration is required when type
+ is Name, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
+ : !has(self.name)'
+ maxItems: 32
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: each subnet must be unique
+ rule: self.all(x, self.exists_one(y, x == y))
+ required:
+ - cluster
+ - name
+ - subnets
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ prismCentral:
+ description: |-
+ prismCentral holds the endpoint address and port to access the Nutanix Prism Central.
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS name
+ or IP address) of the Nutanix Prism Central or Element
+ (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the Nutanix
+ Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ prismElements:
+ description: |-
+ prismElements holds one or more endpoint address and port data to access the Nutanix
+ Prism Elements (clusters) of the Nutanix Prism Central. Currently we only support one
+ Prism Element (cluster) for an OpenShift cluster, where all the Nutanix resources (VMs, subnets, volumes, etc.)
+ used in the OpenShift cluster are located. In the future, we may support Nutanix resources (VMs, etc.)
+ spread over multiple Prism Elements (clusters) of the Prism Central.
+ items:
+ description: NutanixPrismElementEndpoint holds the name
+ and endpoint data for a Prism Element (cluster)
+ properties:
+ endpoint:
+ description: |-
+ endpoint holds the endpoint address and port data of the Prism Element (cluster).
+ When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
+ Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
+ proxy spec.noProxy list.
+ properties:
+ address:
+ description: address is the endpoint address (DNS
+ name or IP address) of the Nutanix Prism Central
+ or Element (cluster)
+ maxLength: 256
+ type: string
+ port:
+ description: port is the port number to access the
+ Nutanix Prism Central or Element (cluster)
+ format: int32
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - address
+ - port
+ type: object
+ name:
+ description: |-
+ name is the name of the Prism Element (cluster). This value will correspond with
+ the cluster field configured on other resources (eg Machines, PVCs, etc).
+ maxLength: 256
+ type: string
+ required:
+ - endpoint
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - prismCentral
+ - prismElements
+ type: object
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ type: object
+ powervs:
+ description: powervs contains settings specific to the IBM Power
+ Systems Virtual Servers infrastructure provider.
+ properties:
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "IBMCloud", "KubeVirt", "EquinixMetal",
+ "PowerVS", "AlibabaCloud", "Nutanix", "External", and "None". Individual
+ components may not support all platforms, and must handle unrecognized
+ platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.apiServerInternalIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ failureDomains:
+ description: |-
+ failureDomains contains the definition of region, zone and the vCenter topology.
+ If this is omitted failure domains (regions and zones) will not be used.
+ items:
+ description: VSpherePlatformFailureDomainSpec holds the
+ region and zone failure domain and the vCenter topology
+ of that failure domain.
+ properties:
+ name:
+ description: |-
+ name defines the arbitrary but unique name
+ of a failure domain.
+ maxLength: 256
+ minLength: 1
+ type: string
+ region:
+ description: |-
+ region defines the name of a region tag that will
+ be attached to a vCenter datacenter. The tag
+ category in vCenter must be named openshift-region.
+ maxLength: 80
+ minLength: 1
+ type: string
+ regionAffinity:
+ description: |-
+ regionAffinity holds the type of region, Datacenter or ComputeCluster.
+ When set to Datacenter, this means the region is a vCenter Datacenter as defined in topology.
+ When set to ComputeCluster, this means the region is a vCenter Cluster as defined in topology.
+ properties:
+ type:
+ description: |-
+ type determines the vSphere object type for a region within this failure domain.
+ Available types are Datacenter and ComputeCluster.
+ When set to Datacenter, this means the vCenter Datacenter defined is the region.
+ When set to ComputeCluster, this means the vCenter cluster defined is the region.
+ enum:
+ - ComputeCluster
+ - Datacenter
+ type: string
+ required:
+ - type
+ type: object
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ minLength: 1
+ type: string
+ topology:
+ description: topology describes a given failure domain
+ using vSphere constructs
+ properties:
+ computeCluster:
+ description: |-
+ computeCluster the absolute path of the vCenter cluster
+ in which virtual machine will be located.
+ The absolute path is of the form //host/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?
+ type: string
+ datacenter:
+ description: |-
+ datacenter is the name of vCenter datacenter in which virtual machines will be located.
+ The maximum length of the datacenter name is 80 characters.
+ maxLength: 80
+ type: string
+ datastore:
+ description: |-
+ datastore is the absolute path of the datastore in which the
+ virtual machine is located.
+ The absolute path is of the form //datastore/
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/datastore/.*?
+ type: string
+ folder:
+ description: |-
+ folder is the absolute path of the folder where
+ virtual machines are located. The absolute path
+ is of the form //vm/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/vm/.*?
+ type: string
+ networks:
+ description: |-
+ networks is the list of port group network names within this failure domain.
+ If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined.
+ 10 is the maximum number of virtual network devices which may be attached to a VM as defined by:
+ https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ Networks should be in the form of an absolute path:
+ //network/.
+ items:
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ resourcePool:
+ description: |-
+ resourcePool is the absolute path of the resource pool where virtual machines will be
+ created. The absolute path is of the form //host//Resources/.
+ The maximum length of the path is 2048 characters.
+ maxLength: 2048
+ pattern: ^/.*?/host/.*?/Resources.*
+ type: string
+ template:
+ description: |-
+ template is the full inventory path of the virtual machine or template
+ that will be cloned when creating new machines in this failure domain.
+ The maximum length of the path is 2048 characters.
+
+ When omitted, the template will be calculated by the control plane
+ machineset operator based on the region and zone defined in
+ VSpherePlatformFailureDomainSpec.
+ For example, for zone=zonea, region=region1, and infrastructure name=test,
+ the template path would be calculated as //vm/test-rhcos-region1-zonea.
+ maxLength: 2048
+ minLength: 1
+ pattern: ^/.*?/vm/.*?
+ type: string
+ required:
+ - computeCluster
+ - datacenter
+ - datastore
+ - networks
+ type: object
+ zone:
+ description: |-
+ zone defines the name of a zone tag that will
+ be attached to a vCenter cluster. The tag
+ category in vCenter must be named openshift-zone.
+ maxLength: 80
+ minLength: 1
+ type: string
+ zoneAffinity:
+ description: |-
+ zoneAffinity holds the type of the zone and the hostGroup which
+ vmGroup and the hostGroup names in vCenter corresponds to
+ a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup holds the vmGroup and the hostGroup names in vCenter
+ corresponds to a vm-host group of type Virtual Machine and Host respectively. Is also
+ contains the vmHostRule which is an affinity vm-host rule in vCenter.
+ properties:
+ hostGroup:
+ description: |-
+ hostGroup is the name of the vm-host group of type host within vCenter for this failure domain.
+ hostGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmGroup:
+ description: |-
+ vmGroup is the name of the vm-host group of type virtual machine within vCenter for this failure domain.
+ vmGroup is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ vmHostRule:
+ description: |-
+ vmHostRule is the name of the affinity vm-host rule within vCenter for this failure domain.
+ vmHostRule is limited to 80 characters.
+ This field is required when the VSphereFailureDomain ZoneType is HostGroup
+ maxLength: 80
+ minLength: 1
+ type: string
+ required:
+ - hostGroup
+ - vmGroup
+ - vmHostRule
+ type: object
+ type:
+ description: |-
+ type determines the vSphere object type for a zone within this failure domain.
+ Available types are ComputeCluster and HostGroup.
+ When set to ComputeCluster, this means the vCenter cluster defined is the zone.
+ When set to HostGroup, hostGroup must be configured with hostGroup, vmGroup and vmHostRule and
+ this means the zone is defined by the grouping of those fields.
+ enum:
+ - HostGroup
+ - ComputeCluster
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: hostGroup is required when type is HostGroup,
+ and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''HostGroup''
+ ? has(self.hostGroup) : !has(self.hostGroup)'
+ required:
+ - name
+ - region
+ - server
+ - topology
+ - zone
+ type: object
+ x-kubernetes-validations:
+ - message: when zoneAffinity type is HostGroup, regionAffinity
+ type must be ComputeCluster
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type
+ == ''ComputeCluster'' : true'
+ - message: when zoneAffinity type is ComputeCluster, regionAffinity
+ type must be Datacenter
+ rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
+ == ''ComputeCluster'' ? has(self.regionAffinity) &&
+ self.regionAffinity.type == ''Datacenter'' : true'
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names.
+ In dual stack clusters this list contains two IP addresses, one from IPv4
+ family and one from IPv6.
+ In single stack clusters a single IP address is expected.
+ When omitted, values from the status.ingressIPs will be used.
+ Once set, the list cannot be completely removed (but its second entry can).
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
+ ? ip(self[0]).family() != ip(self[1]).family() : true'
+ machineNetworks:
+ description: |-
+ machineNetworks are IP networks used to connect all the OpenShift cluster
+ nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
+ for example "10.0.0.0/8" or "fd00::/8".
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeNetworking:
+ description: |-
+ nodeNetworking contains the definition of internal and external network constraints for
+ assigning the node's networking.
+ If this field is omitted, networking defaults to the legacy
+ address selection behavior which is to only support a single address and
+ return the first one found.
+ properties:
+ external:
+ description: external represents the network configuration
+ of the node that is externally routable.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ internal:
+ description: internal represents the network configuration
+ of the node that is routable only within the cluster.
+ properties:
+ excludeNetworkSubnetCidr:
+ description: |-
+ excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
+ the IP address from the VirtualMachine's VM for use in the status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network VirtualMachine's VM Network names that will be used to when searching
+ for status.addresses fields. Note that if internal.networkSubnetCIDR and
+ external.networkSubnetCIDR are not set, then the vNIC associated to this network must
+ only have a single IP address assigned to it.
+ The available networks (port groups) can be listed using
+ `govc ls 'network/*'`
+ type: string
+ networkSubnetCidr:
+ description: |-
+ networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
+ that will be used in respective status.addresses fields.
+ items:
+ format: cidr
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ type: object
+ vcenters:
+ description: |-
+ vcenters holds the connection details for services to communicate with vCenter.
+ Up to 3 vCenters are supported.
+ Once the cluster has been installed, you are unable to change the current number of defined
+ vCenters except when 1.) the cluster has been upgraded from a version of OpenShift
+ where the vsphere platform spec was not present or 2.) in TechPreview you are able to add and
+ remove vCenters but may not remove all vCenters. You may make modifications to the existing
+ vCenters that are defined in the vcenters list in order to match with any added or modified
+ failure domains.
+ items:
+ description: |-
+ VSpherePlatformVCenterSpec stores the vCenter connection fields.
+ This is used by the vSphere CCM.
+ properties:
+ datacenters:
+ description: |-
+ The vCenter Datacenters in which the RHCOS
+ vm guests are located. This field will
+ be used by the Cloud Controller Manager.
+ Each datacenter listed here should be used within
+ a topology.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the TCP port that will be used to communicate to
+ the vCenter endpoint.
+ When omitted, this means the user has no opinion and
+ it is up to the platform to choose a sensible default,
+ which is subject to change over time.
+ format: int32
+ maximum: 32767
+ minimum: 1
+ type: integer
+ server:
+ anyOf:
+ - format: ipv4
+ - format: ipv6
+ - format: hostname
+ description: server is the fully-qualified domain name
+ or the IP address of the vCenter server.
+ maxLength: 255
+ type: string
+ required:
+ - datacenters
+ - server
+ type: object
+ maxItems: 3
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x, self.exists(y,
+ y.server == x.server)) : true'
+ - message: Cannot add and remove vCenters at the same time
+ rule: 'size(self) < size(oldSelf) ? self.all(x, oldSelf.exists(y,
+ y.server == x.server)) : true'
+ - message: vcenters must have unique server values
+ rule: self.all(x, self.exists_one(y, y.server == x.server))
+ type: object
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs list is required once set
+ rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
+ - message: ingressIPs list is required once set
+ rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
+ type: object
+ x-kubernetes-validations:
+ - message: vcenters is required once set and cannot be removed
+ rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
+ : true'
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ apiServerInternalURI:
+ description: |-
+ apiServerInternalURL is a valid URI with scheme 'https',
+ address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components
+ like kubelets, to contact the Kubernetes API server using the
+ infrastructure provider rather than Kubernetes networking.
+ type: string
+ apiServerURL:
+ description: |-
+ apiServerURL is a valid URI with scheme 'https', address and
+ optionally a port (defaulting to 443). apiServerURL can be used by components like the web console
+ to tell users where to find the Kubernetes API.
+ type: string
+ controlPlaneTopology:
+ default: HighlyAvailable
+ description: |-
+ controlPlaneTopology expresses the expectations for operands that normally run on control nodes.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ The 'External' mode indicates that the control plane is hosted externally to the cluster and that
+ its components are not visible within the cluster.
+ The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes
+ that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.
+ enum:
+ - HighlyAvailable
+ - HighlyAvailableArbiter
+ - SingleReplica
+ - DualReplica
+ - External
+ type: string
+ cpuPartitioning:
+ default: None
+ description: |-
+ cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster.
+ CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets.
+ Valid values are "None" and "AllNodes". When omitted, the default value is "None".
+ The default value of "None" indicates that no nodes will be setup with CPU partitioning.
+ The "AllNodes" value indicates that all nodes have been setup with CPU partitioning,
+ and can then be further configured via the PerformanceProfile API.
+ enum:
+ - None
+ - AllNodes
+ type: string
+ etcdDiscoveryDomain:
+ description: |-
+ etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering
+ etcd servers and clients.
+ For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery
+ deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.
+ type: string
+ infrastructureName:
+ description: |-
+ infrastructureName uniquely identifies a cluster with a human friendly name.
+ Once set it should not be changed. Must be of max length 27 and must have only
+ alphanumeric or hyphen characters.
+ type: string
+ infrastructureTopology:
+ default: HighlyAvailable
+ description: |-
+ infrastructureTopology expresses the expectations for infrastructure services that do not run on control
+ plane nodes, usually indicated by a node selector for a `role` value
+ other than `master`.
+ The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
+ The 'SingleReplica' mode will be used in single-node deployments
+ and the operators should not configure the operand for highly-available operation
+ NOTE: External topology mode is not applicable for this field.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ platform:
+ description: |-
+ platform is the underlying infrastructure provider for the cluster.
+
+ Deprecated: Use platformStatus.type instead.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ platformStatus:
+ description: |-
+ platformStatus holds status information specific to the underlying
+ infrastructure provider.
+ properties:
+ alibabaCloud:
+ description: alibabaCloud contains settings specific to the Alibaba
+ Cloud infrastructure provider.
+ properties:
+ region:
+ description: region specifies the region for Alibaba Cloud
+ resources created for the cluster.
+ pattern: ^[0-9A-Za-z-]+$
+ type: string
+ resourceGroupID:
+ description: resourceGroupID is the ID of the resource group
+ for the cluster.
+ pattern: ^(rg-[0-9A-Za-z]+)?$
+ type: string
+ resourceTags:
+ description: resourceTags is a list of additional tags to
+ apply to Alibaba Cloud resources created for the cluster.
+ items:
+ description: AlibabaCloudResourceTag is the set of tags
+ to add to apply to resources.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ value:
+ description: value is the value of the tag.
+ maxLength: 128
+ minLength: 1
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ required:
+ - region
+ type: object
+ aws:
+ description: aws contains settings specific to the Amazon Web
+ Services infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for AWS
+ network resources. This controls whether AWS resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ region:
+ description: region holds the default AWS region for new AWS
+ resources created by the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created for the cluster.
+ See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources.
+ AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags
+ available for the user.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key sets the key of the AWS resource tag key-value pair. Key is required when defining an AWS resource tag.
+ Key should consist of between 1 and 128 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ maxLength: 128
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag key. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ value:
+ description: |-
+ value sets the value of the AWS resource tag key-value pair. Value is required when defining an AWS resource tag.
+ Value should consist of between 1 and 256 characters, and may
+ contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
+ Some AWS service do not support empty values. Since tags are added to resources in many services, the
+ length of the tag value must meet the requirements of all services.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: invalid AWS resource tag value. The string
+ can contain only the set of alphanumeric characters,
+ space (' '), '_', '.', '/', '=', '+', '-', ':',
+ '@'
+ rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints list contains custom endpoints which will override default
+ service endpoint of AWS Services.
+ There must be only one ServiceEndpoint for a service.
+ items:
+ description: |-
+ AWSServiceEndpoint store the configuration of a custom url to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
+ This must be provided and cannot be empty.
+ pattern: ^[a-z0-9-]+$
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ pattern: ^https://
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ azure:
+ description: azure contains settings specific to the Azure infrastructure
+ provider.
+ properties:
+ armEndpoint:
+ description: armEndpoint specifies a URL to use for resource
+ management in non-soverign clouds such as Azure Stack.
+ type: string
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ cloudName:
+ description: |-
+ cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
+ with the appropriate Azure API endpoints.
+ If empty, the value is equal to `AzurePublicCloud`.
+ enum:
+ - ""
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ ipFamily:
+ default: IPv4
+ description: |-
+ ipFamily specifies the IP protocol family that should be used for Azure
+ network resources. This controls whether Azure resources are created with
+ IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
+ protocol family.
+ enum:
+ - IPv4
+ - DualStackIPv6Primary
+ - DualStackIPv4Primary
+ type: string
+ x-kubernetes-validations:
+ - message: ipFamily is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ networkResourceGroupName:
+ description: |-
+ networkResourceGroupName is the Resource Group for network resources like the Virtual Network and Subnets used by the cluster.
+ If empty, the value is same as ResourceGroupName.
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ Azure resources created for the cluster.
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to Azure resources created for the cluster.
+ See https://docs.microsoft.com/en-us/rest/api/resources/tags for information on tagging Azure resources.
+ Due to limitations on Automation, Content Delivery Network, DNS Azure resources, a maximum of 15 tags
+ may be applied. OpenShift reserves 5 tags for internal use, allowing 10 tags for user configuration.
+ items:
+ description: AzureResourceTag is a tag to apply to Azure
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 128 characters and cannot be empty. Key
+ must begin with a letter, end with a letter, number or underscore, and must contain only alphanumeric
+ characters and the following special characters `_ . -`.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[a-zA-Z]([0-9A-Za-z_.-]*[0-9A-Za-z_])?$
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 256 characters and cannot be empty. Value
+ must contain only alphanumeric characters and the following special characters `_ + , - . / : ; < = > ? @`.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ baremetal:
+ description: baremetal contains settings specific to the BareMetal
+ platform.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on BareMetal platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ BareMetal deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ equinixMetal:
+ description: equinixMetal contains settings specific to the Equinix
+ Metal infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ external:
+ description: external contains settings specific to the generic
+ External infrastructure provider.
+ properties:
+ cloudControllerManager:
+ description: |-
+ cloudControllerManager contains settings specific to the external Cloud Controller Manager (a.k.a. CCM or CPI).
+ When omitted, new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ properties:
+ state:
+ description: |-
+ state determines whether or not an external Cloud Controller Manager is expected to
+ be installed within the cluster.
+ https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager
+
+ Valid values are "External", "None" and omitted.
+ When set to "External", new nodes will be tainted as uninitialized when created,
+ preventing them from running workloads until they are initialized by the cloud controller manager.
+ When omitted or set to "None", new nodes will be not tainted
+ and no extra initialization from the cloud controller manager is expected.
+ enum:
+ - ""
+ - External
+ - None
+ type: string
+ x-kubernetes-validations:
+ - message: state is immutable once set
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: state may not be added or removed once set
+ rule: (has(self.state) == has(oldSelf.state)) || (!has(oldSelf.state)
+ && self.state != "External")
+ type: object
+ x-kubernetes-validations:
+ - message: cloudControllerManager may not be added or removed
+ once set
+ rule: has(self.cloudControllerManager) == has(oldSelf.cloudControllerManager)
+ gcp:
+ description: gcp contains settings specific to the Google Cloud
+ Platform infrastructure provider.
+ properties:
+ cloudLoadBalancerConfig:
+ default:
+ dnsType: PlatformDefault
+ description: |-
+ cloudLoadBalancerConfig holds configuration related to DNS and cloud
+ load balancers. It allows configuration of in-cluster DNS as an alternative
+ to the platform default DNS implementation.
+ When using the ClusterHosted DNS type, Load Balancer IP addresses
+ must be provided for the API and internal API load balancers as well as the
+ ingress load balancer.
+ nullable: true
+ properties:
+ clusterHosted:
+ description: |-
+ clusterHosted holds the IP addresses of API, API-Int and Ingress Load
+ Balancers on Cloud Platforms. The DNS solution hosted within the cluster
+ use these IP addresses to provide resolution for API, API-Int and Ingress
+ services.
+ properties:
+ apiIntLoadBalancerIPs:
+ description: |-
+ apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the apiIntLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ apiLoadBalancerIPs:
+ description: |-
+ apiLoadBalancerIPs holds Load Balancer IPs for the API service.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Could be empty for private clusters.
+ Entries in the apiLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ ingressLoadBalancerIPs:
+ description: |-
+ ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
+ These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
+ Entries in the ingressLoadBalancerIPs must be unique.
+ A maximum of 16 IP addresses are permitted.
+ format: ip
+ items:
+ description: IP is an IP address (for example, "10.0.0.0"
+ or "fd00::").
+ maxLength: 39
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid IP address
+ rule: isIP(self)
+ maxItems: 16
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ dnsType:
+ default: PlatformDefault
+ description: |-
+ dnsType indicates the type of DNS solution in use within the cluster. Its default value of
+ `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
+ It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
+ the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
+ The cluster's use of the cloud's Load Balancers is unaffected by this setting.
+ The value is immutable after it has been set at install time.
+ Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
+ Enabling this functionality allows the user to start their own DNS solution outside the cluster after
+ installation is complete. The customer would be responsible for configuring this custom DNS solution,
+ and it can be run in addition to the in-cluster DNS solution.
+ enum:
+ - ClusterHosted
+ - PlatformDefault
+ type: string
+ x-kubernetes-validations:
+ - message: dnsType is immutable
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: clusterHosted is permitted only when dnsType is
+ ClusterHosted
+ rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
+ ? !has(self.clusterHosted) : true'
+ projectID:
+ description: resourceGroupName is the Project ID for new GCP
+ resources created for the cluster.
+ type: string
+ region:
+ description: region holds the region for new GCP resources
+ created for the cluster.
+ type: string
+ resourceLabels:
+ description: |-
+ resourceLabels is a list of additional labels to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/compute/docs/labeling-resources for information on labeling GCP resources.
+ GCP supports a maximum of 64 labels per resource. OpenShift reserves 32 labels for internal use,
+ allowing 32 labels for user configuration.
+ items:
+ description: GCPResourceLabel is a label to apply to GCP
+ resources created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the label. A label key can have a maximum of 63 characters and cannot be empty.
+ Label key must begin with a lowercase letter, and must contain only lowercase letters, numeric characters,
+ and the following special characters `_-`. Label key must not have the reserved prefixes `kubernetes-io`
+ and `openshift-io`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z][0-9a-z_-]{0,62}$
+ type: string
+ x-kubernetes-validations:
+ - message: label keys must not start with either `openshift-io`
+ or `kubernetes-io`
+ rule: '!self.startsWith(''openshift-io'') && !self.startsWith(''kubernetes-io'')'
+ value:
+ description: |-
+ value is the value part of the label. A label value can have a maximum of 63 characters and cannot be empty.
+ Value must contain only lowercase letters, numeric characters, and the following special characters `_-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[0-9a-z_-]{1,63}$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceLabels are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to GCP resources created for the cluster.
+ See https://cloud.google.com/resource-manager/docs/tags/tags-overview for information on
+ tagging GCP resources. GCP supports a maximum of 50 tags per resource.
+ items:
+ description: GCPResourceTag is a tag to apply to GCP resources
+ created for the cluster.
+ properties:
+ key:
+ description: |-
+ key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot be empty.
+ Tag key must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `._-`.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$
+ type: string
+ parentID:
+ description: |-
+ parentID is the ID of the hierarchical resource where the tags are defined,
+ e.g. at the Organization or the Project level. To find the Organization or Project ID refer to the following pages:
+ https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id,
+ https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects.
+ An OrganizationID must consist of decimal numbers, and cannot have leading zeroes.
+ A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters, numbers,
+ and hyphens, and must start with a letter, and cannot end with a hyphen.
+ maxLength: 32
+ minLength: 1
+ pattern: (^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)
+ type: string
+ value:
+ description: |-
+ value is the value part of the tag. A tag value can have a maximum of 63 characters and cannot be empty.
+ Tag value must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
+ alphanumeric characters, and the following special characters `_-.@%=+:,*#&(){}[]` and spaces.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$
+ type: string
+ required:
+ - key
+ - parentID
+ - value
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ x-kubernetes-validations:
+ - message: resourceTags are immutable and may only be configured
+ during installation
+ rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
+ type: object
+ x-kubernetes-validations:
+ - message: resourceLabels may only be configured during installation
+ rule: '!has(oldSelf.resourceLabels) && !has(self.resourceLabels)
+ || has(oldSelf.resourceLabels) && has(self.resourceLabels)'
+ - message: resourceTags may only be configured during installation
+ rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
+ || has(oldSelf.resourceTags) && has(self.resourceTags)'
+ ibmcloud:
+ description: ibmcloud contains settings specific to the IBMCloud
+ infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ location:
+ description: location is where the cluster has been deployed
+ type: string
+ providerType:
+ description: providerType indicates the type of cluster that
+ was created
+ type: string
+ resourceGroupName:
+ description: resourceGroupName is the Resource Group for new
+ IBMCloud resources created for the cluster.
+ type: string
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of an IBM service. These endpoints are used by components
+ within the cluster when trying to reach the IBM Cloud Services that have been
+ overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
+ endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
+ are updated to reflect the same custom endpoints.
+ items:
+ description: |-
+ IBMCloudServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of IBM Cloud Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the IBM Cloud service.
+ Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+ For example, the IBM Cloud Private IAM service could be configured with the
+ service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
+ Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
+ with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty. The path must follow the pattern
+ /v[0,9]+ or /api/v[0,9]+
+ maxLength: 300
+ type: string
+ x-kubernetes-validations:
+ - message: url must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 13
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ kubevirt:
+ description: kubevirt contains settings specific to the kubevirt
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+ type: string
+ type: object
+ nutanix:
+ description: nutanix contains settings specific to the Nutanix
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Nutanix platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ openstack:
+ description: openstack contains settings specific to the OpenStack
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ cloudName:
+ description: |-
+ cloudName is the name of the desired OpenStack cloud in the
+ client configuration file (`clouds.yaml`).
+ type: string
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on OpenStack platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ OpenStack deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ ovirt:
+ description: ovirt contains settings specific to the oVirt infrastructure
+ provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on Ovirt platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ nodeDNSIP:
+ description: 'deprecated: as of 4.6, this field is no longer
+ set or honored. It will be removed in a future release.'
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ powervs:
+ description: powervs contains settings specific to the Power Systems
+ Virtual Servers infrastructure provider.
+ properties:
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
+ the DNS zone for the cluster's base domain
+ type: string
+ dnsInstanceCRN:
+ description: |-
+ dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
+ for the cluster's base domain
+ type: string
+ region:
+ description: region holds the default Power VS region for
+ new Power VS resources created by the cluster.
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the resource group name for new IBMCloud resources created for a cluster.
+ The resource group specified here will be used by cluster-image-registry-operator to set up a COS Instance in IBMCloud for the cluster registry.
+ More about resource groups can be found here: https://cloud.ibm.com/docs/account?topic=account-rgs.
+ When omitted, the image registry operator won't be able to configure storage,
+ which results in the image registry cluster operator not being in an available state.
+ maxLength: 40
+ pattern: ^[a-zA-Z0-9-_ ]+$
+ type: string
+ x-kubernetes-validations:
+ - message: resourceGroup is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints is a list of custom endpoints which will override the default
+ service endpoints of a Power VS service.
+ items:
+ description: |-
+ PowervsServiceEndpoint stores the configuration of a custom url to
+ override existing defaults of PowerVS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the Power VS service.
+ Few of the services are
+ IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
+ ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
+ Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
+ enum:
+ - CIS
+ - COS
+ - COSConfig
+ - DNSServices
+ - GlobalCatalog
+ - GlobalSearch
+ - GlobalTagging
+ - HyperProtect
+ - IAM
+ - KeyProtect
+ - Power
+ - ResourceController
+ - ResourceManager
+ - VPC
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ format: uri
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ zone:
+ description: |-
+ zone holds the default zone for the new Power VS resources created by the cluster.
+ Note: Currently only single-zone OCP clusters are supported
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot unset resourceGroup once set
+ rule: '!has(oldSelf.resourceGroup) || has(self.resourceGroup)'
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster. This
+ value controls whether infrastructure automation such as service load
+ balancers, dynamic volume provisioning, machine creation and deletion, and
+ other integrations are enabled. If None, no infrastructure automation is
+ enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "EquinixMetal", "PowerVS", "AlibabaCloud", "Nutanix" and "None".
+ Individual components may not support all platforms, and must handle
+ unrecognized platforms as None if they do not support that platform.
+
+ This value will be synced with to the `status.platform` and `status.platformStatus.type`.
+ Currently this value cannot be changed once set.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ vsphere:
+ description: vsphere contains settings specific to the VSphere
+ infrastructure provider.
+ properties:
+ apiServerInternalIP:
+ description: |-
+ apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
+ by components inside the cluster, like kubelets using the infrastructure rather
+ than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
+ points to. It is the IP for a self-hosted load balancer in front of the API servers.
+
+ Deprecated: Use APIServerInternalIPs instead.
+ type: string
+ apiServerInternalIPs:
+ description: |-
+ apiServerInternalIPs are the IP addresses to contact the Kubernetes API
+ server that can be used by components inside the cluster, like kubelets
+ using the infrastructure rather than Kubernetes networking. These are the
+ IPs for a self-hosted load balancer in front of the API servers. In dual
+ stack clusters this list contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: apiServerInternalIPs must contain at most one IPv4
+ address and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ dnsRecordsType:
+ description: |-
+ dnsRecordsType determines whether records for api, api-int, and ingress
+ are provided by the internal DNS service or externally.
+ Allowed values are `Internal`, `External`, and omitted.
+ When set to `Internal`, records are provided by the internal infrastructure and
+ no additional user configuration is required for the cluster to function.
+ When set to `External`, records are not provided by the internal infrastructure
+ and must be configured by the user on a DNS server outside the cluster.
+ Cluster nodes must use this external server for their upstream DNS requests.
+ This value may only be set when loadBalancer.type is set to UserManaged.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `Internal`.
+ enum:
+ - Internal
+ - External
+ type: string
+ ingressIP:
+ description: |-
+ ingressIP is an external IP which routes to the default ingress controller.
+ The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
+
+ Deprecated: Use IngressIPs instead.
+ type: string
+ ingressIPs:
+ description: |-
+ ingressIPs are the external IPs which route to the default ingress
+ controller. The IPs are suitable targets of a wildcard DNS record used to
+ resolve default route host names. In dual stack clusters this list
+ contains two IPs otherwise only one.
+ format: ip
+ items:
+ type: string
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: ingressIPs must contain at most one IPv4 address
+ and at most one IPv6 address
+ rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
+ && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
+ : true)'
+ loadBalancer:
+ default:
+ type: OpenShiftManagedDefault
+ description: loadBalancer defines how the load balancer used
+ by the cluster is configured.
+ properties:
+ type:
+ default: OpenShiftManagedDefault
+ description: |-
+ type defines the type of load balancer used by the cluster on VSphere platform
+ which can be a user-managed or openshift-managed load balancer
+ that is to be used for the OpenShift API and Ingress endpoints.
+ When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
+ defined in the machine config operator will be deployed.
+ When set to UserManaged these static pods will not be deployed and it is expected that
+ the load balancer is configured out of band by the deployer.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default.
+ The default value is OpenShiftManagedDefault.
+ enum:
+ - OpenShiftManagedDefault
+ - UserManaged
+ type: string
+ x-kubernetes-validations:
+ - message: type is immutable once set
+ rule: oldSelf == '' || self == oldSelf
+ type: object
+ machineNetworks:
+ description: machineNetworks are IP networks used to connect
+ all the OpenShift cluster nodes.
+ items:
+ description: CIDR is an IP address range in CIDR notation
+ (for example, "10.0.0.0/8" or "fd00::/8").
+ maxLength: 43
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: value must be a valid CIDR network address
+ rule: isCIDR(self)
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - rule: self.all(x, self.exists_one(y, x == y))
+ nodeDNSIP:
+ description: |-
+ nodeDNSIP is the IP address for the internal DNS used by the
+ nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
+ provides name resolution for the nodes themselves. There is no DNS-as-a-service for
+ vSphere deployments. In order to minimize necessary changes to the
+ datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
+ to the nodes in the cluster.
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: dnsRecordsType may only be set to External when loadBalancer.type
+ is UserManaged
+ rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
+ || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
+ type: object
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml
deleted file mode 100644
index c45b7d6e8..000000000
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml
+++ /dev/null
@@ -1,2770 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.openshift.io: https://github.com/openshift/api/pull/470
- api.openshift.io/merged-by-featuregates: "true"
- include.release.openshift.io/ibm-cloud-managed: "true"
- include.release.openshift.io/self-managed-high-availability: "true"
- release.openshift.io/bootstrap-required: "true"
- release.openshift.io/feature-set: TechPreviewNoUpgrade
- name: infrastructures.config.openshift.io
-spec:
- group: config.openshift.io
- names:
- kind: Infrastructure
- listKind: InfrastructureList
- plural: infrastructures
- singular: infrastructure
- scope: Cluster
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Infrastructure holds cluster-wide information about Infrastructure. The canonical name is `cluster`
-
- Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: spec holds user settable values for configuration
- properties:
- cloudConfig:
- description: |-
- cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file.
- This configuration file is used to configure the Kubernetes cloud provider integration
- when using the built-in cloud provider integration or the external cloud controller manager.
- The namespace for this config map is openshift-config.
-
- cloudConfig should only be consumed by the kube_cloud_config controller.
- The controller is responsible for using the user configuration in the spec
- for various platforms and combining that with the user provided ConfigMap in this field
- to create a stitched kube cloud config.
- The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace
- with the kube cloud config is stored in `cloud.conf` key.
- All the clients are expected to use the generated ConfigMap only.
- properties:
- key:
- description: key allows pointing to a specific key/value inside
- of the configmap. This is useful for logical file references.
- type: string
- name:
- type: string
- type: object
- platformSpec:
- description: |-
- platformSpec holds desired information specific to the underlying
- infrastructure provider.
- properties:
- alibabaCloud:
- description: alibabaCloud contains settings specific to the Alibaba
- Cloud infrastructure provider.
- type: object
- aws:
- description: aws contains settings specific to the Amazon Web
- Services infrastructure provider.
- properties:
- serviceEndpoints:
- description: |-
- serviceEndpoints list contains custom endpoints which will override default
- service endpoint of AWS Services.
- There must be only one ServiceEndpoint for a service.
- items:
- description: |-
- AWSServiceEndpoint store the configuration of a custom url to
- override existing defaults of AWS Services.
- properties:
- name:
- description: |-
- name is the name of the AWS service.
- The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
- This must be provided and cannot be empty.
- pattern: ^[a-z0-9-]+$
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- pattern: ^https://
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- azure:
- description: azure contains settings specific to the Azure infrastructure
- provider.
- type: object
- baremetal:
- description: baremetal contains settings specific to the BareMetal
- platform.
- properties:
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.apiServerInternalIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.ingressIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- machineNetworks:
- description: |-
- machineNetworks are IP networks used to connect all the OpenShift cluster
- nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
- for example "10.0.0.0/8" or "fd00::/8".
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- type: object
- x-kubernetes-validations:
- - message: apiServerInternalIPs list is required once set
- rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
- - message: ingressIPs list is required once set
- rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
- equinixMetal:
- description: equinixMetal contains settings specific to the Equinix
- Metal infrastructure provider.
- type: object
- external:
- description: |-
- ExternalPlatformType represents generic infrastructure provider.
- Platform-specific components should be supplemented separately.
- properties:
- platformName:
- default: Unknown
- description: |-
- platformName holds the arbitrary string representing the infrastructure provider name, expected to be set at the installation time.
- This field is solely for informational and reporting purposes and is not expected to be used for decision-making.
- type: string
- x-kubernetes-validations:
- - message: platform name cannot be changed once set
- rule: oldSelf == 'Unknown' || self == oldSelf
- type: object
- gcp:
- description: gcp contains settings specific to the Google Cloud
- Platform infrastructure provider.
- type: object
- ibmcloud:
- description: ibmcloud contains settings specific to the IBMCloud
- infrastructure provider.
- properties:
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of an IBM service. These endpoints are used by components
- within the cluster when trying to reach the IBM Cloud Services that have been
- overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
- endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
- are updated to reflect the same custom endpoints.
- A maximum of 13 service endpoints overrides are supported.
- items:
- description: |-
- IBMCloudServiceEndpoint stores the configuration of a custom url to
- override existing defaults of IBM Cloud Services.
- properties:
- name:
- description: |-
- name is the name of the IBM Cloud service.
- Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
- For example, the IBM Cloud Private IAM service could be configured with the
- service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
- Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
- with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty. The path must follow the pattern
- /v[0,9]+ or /api/v[0,9]+
- maxLength: 300
- type: string
- x-kubernetes-validations:
- - message: url must use https scheme
- rule: url(self).getScheme() == "https"
- - message: url path must match /v[0,9]+ or /api/v[0,9]+
- rule: matches((url(self).getEscapedPath()), '^/(api/)?v[0-9]+/{0,1}$')
- - message: url must be a valid absolute URL
- rule: isURL(self)
- required:
- - name
- - url
- type: object
- maxItems: 13
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- kubevirt:
- description: kubevirt contains settings specific to the kubevirt
- infrastructure provider.
- type: object
- nutanix:
- description: nutanix contains settings specific to the Nutanix
- infrastructure provider.
- properties:
- failureDomains:
- description: |-
- failureDomains configures failure domains information for the Nutanix platform.
- When set, the failure domains defined here may be used to spread Machines across
- prism element clusters to improve fault tolerance of the cluster.
- items:
- description: NutanixFailureDomain configures failure domain
- information for the Nutanix platform.
- properties:
- cluster:
- description: |-
- cluster is to identify the cluster (the Prism Element under management of the Prism Central),
- in which the Machine's VM will be created. The cluster identifier (uuid or name) can be obtained
- from the Prism Central console or using the prism_central API.
- properties:
- name:
- description: name is the resource name in the PC.
- It cannot be empty if the type is Name.
- type: string
- type:
- description: type is the identifier type to use
- for this resource.
- enum:
- - UUID
- - Name
- type: string
- uuid:
- description: uuid is the UUID of the resource in
- the PC. It cannot be empty if the type is UUID.
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: uuid configuration is required when type
- is UUID, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
- : !has(self.uuid)'
- - message: name configuration is required when type
- is Name, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
- : !has(self.name)'
- name:
- description: |-
- name defines the unique name of a failure domain.
- Name is required and must be at most 64 characters in length.
- It must consist of only lower case alphanumeric characters and hyphens (-).
- It must start and end with an alphanumeric character.
- This value is arbitrary and is used to identify the failure domain within the platform.
- maxLength: 64
- minLength: 1
- pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?'
- type: string
- subnets:
- description: |-
- subnets holds a list of identifiers (one or more) of the cluster's network subnets
- If the feature gate NutanixMultiSubnets is enabled, up to 32 subnets may be configured.
- for the Machine's VM to connect to. The subnet identifiers (uuid or name) can be
- obtained from the Prism Central console or using the prism_central API.
- items:
- description: NutanixResourceIdentifier holds the identity
- of a Nutanix PC resource (cluster, image, subnet,
- etc.)
- properties:
- name:
- description: name is the resource name in the
- PC. It cannot be empty if the type is Name.
- type: string
- type:
- description: type is the identifier type to use
- for this resource.
- enum:
- - UUID
- - Name
- type: string
- uuid:
- description: uuid is the UUID of the resource
- in the PC. It cannot be empty if the type is
- UUID.
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: uuid configuration is required when type
- is UUID, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid)
- : !has(self.uuid)'
- - message: name configuration is required when type
- is Name, and forbidden otherwise
- rule: 'has(self.type) && self.type == ''Name'' ? has(self.name)
- : !has(self.name)'
- maxItems: 32
- minItems: 1
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: each subnet must be unique
- rule: self.all(x, self.exists_one(y, x == y))
- required:
- - cluster
- - name
- - subnets
- type: object
- maxItems: 32
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- prismCentral:
- description: |-
- prismCentral holds the endpoint address and port to access the Nutanix Prism Central.
- When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
- Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
- proxy spec.noProxy list.
- properties:
- address:
- description: address is the endpoint address (DNS name
- or IP address) of the Nutanix Prism Central or Element
- (cluster)
- maxLength: 256
- type: string
- port:
- description: port is the port number to access the Nutanix
- Prism Central or Element (cluster)
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - address
- - port
- type: object
- prismElements:
- description: |-
- prismElements holds one or more endpoint address and port data to access the Nutanix
- Prism Elements (clusters) of the Nutanix Prism Central. Currently we only support one
- Prism Element (cluster) for an OpenShift cluster, where all the Nutanix resources (VMs, subnets, volumes, etc.)
- used in the OpenShift cluster are located. In the future, we may support Nutanix resources (VMs, etc.)
- spread over multiple Prism Elements (clusters) of the Prism Central.
- items:
- description: NutanixPrismElementEndpoint holds the name
- and endpoint data for a Prism Element (cluster)
- properties:
- endpoint:
- description: |-
- endpoint holds the endpoint address and port data of the Prism Element (cluster).
- When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy.
- Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the
- proxy spec.noProxy list.
- properties:
- address:
- description: address is the endpoint address (DNS
- name or IP address) of the Nutanix Prism Central
- or Element (cluster)
- maxLength: 256
- type: string
- port:
- description: port is the port number to access the
- Nutanix Prism Central or Element (cluster)
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - address
- - port
- type: object
- name:
- description: |-
- name is the name of the Prism Element (cluster). This value will correspond with
- the cluster field configured on other resources (eg Machines, PVCs, etc).
- maxLength: 256
- type: string
- required:
- - endpoint
- - name
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- required:
- - prismCentral
- - prismElements
- type: object
- openstack:
- description: openstack contains settings specific to the OpenStack
- infrastructure provider.
- properties:
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.apiServerInternalIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.ingressIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- machineNetworks:
- description: |-
- machineNetworks are IP networks used to connect all the OpenShift cluster
- nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
- for example "10.0.0.0/8" or "fd00::/8".
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- type: object
- x-kubernetes-validations:
- - message: apiServerInternalIPs list is required once set
- rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
- - message: ingressIPs list is required once set
- rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
- ovirt:
- description: ovirt contains settings specific to the oVirt infrastructure
- provider.
- type: object
- powervs:
- description: powervs contains settings specific to the IBM Power
- Systems Virtual Servers infrastructure provider.
- properties:
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of a Power VS service.
- items:
- description: |-
- PowervsServiceEndpoint stores the configuration of a custom url to
- override existing defaults of PowerVS Services.
- properties:
- name:
- description: |-
- name is the name of the Power VS service.
- Few of the services are
- IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
- ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
- Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - Power
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- format: uri
- pattern: ^https://
- type: string
- required:
- - name
- - url
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |-
- type is the underlying infrastructure provider for the cluster. This
- value controls whether infrastructure automation such as service load
- balancers, dynamic volume provisioning, machine creation and deletion, and
- other integrations are enabled. If None, no infrastructure automation is
- enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
- "OpenStack", "VSphere", "oVirt", "IBMCloud", "KubeVirt", "EquinixMetal",
- "PowerVS", "AlibabaCloud", "Nutanix", "External", and "None". Individual
- components may not support all platforms, and must handle unrecognized
- platforms as None if they do not support that platform.
- enum:
- - ""
- - AWS
- - Azure
- - BareMetal
- - GCP
- - Libvirt
- - OpenStack
- - None
- - VSphere
- - oVirt
- - IBMCloud
- - KubeVirt
- - EquinixMetal
- - PowerVS
- - AlibabaCloud
- - Nutanix
- - External
- type: string
- vsphere:
- description: vsphere contains settings specific to the VSphere
- infrastructure provider.
- properties:
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.apiServerInternalIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- failureDomains:
- description: |-
- failureDomains contains the definition of region, zone and the vCenter topology.
- If this is omitted failure domains (regions and zones) will not be used.
- items:
- description: VSpherePlatformFailureDomainSpec holds the
- region and zone failure domain and the vCenter topology
- of that failure domain.
- properties:
- name:
- description: |-
- name defines the arbitrary but unique name
- of a failure domain.
- maxLength: 256
- minLength: 1
- type: string
- region:
- description: |-
- region defines the name of a region tag that will
- be attached to a vCenter datacenter. The tag
- category in vCenter must be named openshift-region.
- maxLength: 80
- minLength: 1
- type: string
- regionAffinity:
- description: |-
- regionAffinity holds the type of region, Datacenter or ComputeCluster.
- When set to Datacenter, this means the region is a vCenter Datacenter as defined in topology.
- When set to ComputeCluster, this means the region is a vCenter Cluster as defined in topology.
- properties:
- type:
- description: |-
- type determines the vSphere object type for a region within this failure domain.
- Available types are Datacenter and ComputeCluster.
- When set to Datacenter, this means the vCenter Datacenter defined is the region.
- When set to ComputeCluster, this means the vCenter cluster defined is the region.
- enum:
- - ComputeCluster
- - Datacenter
- type: string
- required:
- - type
- type: object
- server:
- anyOf:
- - format: ipv4
- - format: ipv6
- - format: hostname
- description: server is the fully-qualified domain name
- or the IP address of the vCenter server.
- maxLength: 255
- minLength: 1
- type: string
- topology:
- description: topology describes a given failure domain
- using vSphere constructs
- properties:
- computeCluster:
- description: |-
- computeCluster the absolute path of the vCenter cluster
- in which virtual machine will be located.
- The absolute path is of the form //host/.
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/host/.*?
- type: string
- datacenter:
- description: |-
- datacenter is the name of vCenter datacenter in which virtual machines will be located.
- The maximum length of the datacenter name is 80 characters.
- maxLength: 80
- type: string
- datastore:
- description: |-
- datastore is the absolute path of the datastore in which the
- virtual machine is located.
- The absolute path is of the form //datastore/
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/datastore/.*?
- type: string
- folder:
- description: |-
- folder is the absolute path of the folder where
- virtual machines are located. The absolute path
- is of the form //vm/.
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/vm/.*?
- type: string
- networks:
- description: |-
- networks is the list of port group network names within this failure domain.
- If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined.
- 10 is the maximum number of virtual network devices which may be attached to a VM as defined by:
- https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0
- The available networks (port groups) can be listed using
- `govc ls 'network/*'`
- Networks should be in the form of an absolute path:
- //network/.
- items:
- type: string
- maxItems: 10
- minItems: 1
- type: array
- x-kubernetes-list-type: atomic
- resourcePool:
- description: |-
- resourcePool is the absolute path of the resource pool where virtual machines will be
- created. The absolute path is of the form //host//Resources/.
- The maximum length of the path is 2048 characters.
- maxLength: 2048
- pattern: ^/.*?/host/.*?/Resources.*
- type: string
- template:
- description: |-
- template is the full inventory path of the virtual machine or template
- that will be cloned when creating new machines in this failure domain.
- The maximum length of the path is 2048 characters.
-
- When omitted, the template will be calculated by the control plane
- machineset operator based on the region and zone defined in
- VSpherePlatformFailureDomainSpec.
- For example, for zone=zonea, region=region1, and infrastructure name=test,
- the template path would be calculated as //vm/test-rhcos-region1-zonea.
- maxLength: 2048
- minLength: 1
- pattern: ^/.*?/vm/.*?
- type: string
- required:
- - computeCluster
- - datacenter
- - datastore
- - networks
- type: object
- zone:
- description: |-
- zone defines the name of a zone tag that will
- be attached to a vCenter cluster. The tag
- category in vCenter must be named openshift-zone.
- maxLength: 80
- minLength: 1
- type: string
- zoneAffinity:
- description: |-
- zoneAffinity holds the type of the zone and the hostGroup which
- vmGroup and the hostGroup names in vCenter corresponds to
- a vm-host group of type Virtual Machine and Host respectively. Is also
- contains the vmHostRule which is an affinity vm-host rule in vCenter.
- properties:
- hostGroup:
- description: |-
- hostGroup holds the vmGroup and the hostGroup names in vCenter
- corresponds to a vm-host group of type Virtual Machine and Host respectively. Is also
- contains the vmHostRule which is an affinity vm-host rule in vCenter.
- properties:
- hostGroup:
- description: |-
- hostGroup is the name of the vm-host group of type host within vCenter for this failure domain.
- hostGroup is limited to 80 characters.
- This field is required when the VSphereFailureDomain ZoneType is HostGroup
- maxLength: 80
- minLength: 1
- type: string
- vmGroup:
- description: |-
- vmGroup is the name of the vm-host group of type virtual machine within vCenter for this failure domain.
- vmGroup is limited to 80 characters.
- This field is required when the VSphereFailureDomain ZoneType is HostGroup
- maxLength: 80
- minLength: 1
- type: string
- vmHostRule:
- description: |-
- vmHostRule is the name of the affinity vm-host rule within vCenter for this failure domain.
- vmHostRule is limited to 80 characters.
- This field is required when the VSphereFailureDomain ZoneType is HostGroup
- maxLength: 80
- minLength: 1
- type: string
- required:
- - hostGroup
- - vmGroup
- - vmHostRule
- type: object
- type:
- description: |-
- type determines the vSphere object type for a zone within this failure domain.
- Available types are ComputeCluster and HostGroup.
- When set to ComputeCluster, this means the vCenter cluster defined is the zone.
- When set to HostGroup, hostGroup must be configured with hostGroup, vmGroup and vmHostRule and
- this means the zone is defined by the grouping of those fields.
- enum:
- - HostGroup
- - ComputeCluster
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: hostGroup is required when type is HostGroup,
- and forbidden otherwise
- rule: 'has(self.type) && self.type == ''HostGroup''
- ? has(self.hostGroup) : !has(self.hostGroup)'
- required:
- - name
- - region
- - server
- - topology
- - zone
- type: object
- x-kubernetes-validations:
- - message: when zoneAffinity type is HostGroup, regionAffinity
- type must be ComputeCluster
- rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
- == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type
- == ''ComputeCluster'' : true'
- - message: when zoneAffinity type is ComputeCluster, regionAffinity
- type must be Datacenter
- rule: 'has(self.zoneAffinity) && self.zoneAffinity.type
- == ''ComputeCluster'' ? has(self.regionAffinity) &&
- self.regionAffinity.type == ''Datacenter'' : true'
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names.
- In dual stack clusters this list contains two IP addresses, one from IPv4
- family and one from IPv6.
- In single stack clusters a single IP address is expected.
- When omitted, values from the status.ingressIPs will be used.
- Once set, the list cannot be completely removed (but its second entry can).
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1])
- ? ip(self[0]).family() != ip(self[1]).family() : true'
- machineNetworks:
- description: |-
- machineNetworks are IP networks used to connect all the OpenShift cluster
- nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6,
- for example "10.0.0.0/8" or "fd00::/8".
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeNetworking:
- description: |-
- nodeNetworking contains the definition of internal and external network constraints for
- assigning the node's networking.
- If this field is omitted, networking defaults to the legacy
- address selection behavior which is to only support a single address and
- return the first one found.
- properties:
- external:
- description: external represents the network configuration
- of the node that is externally routable.
- properties:
- excludeNetworkSubnetCidr:
- description: |-
- excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
- the IP address from the VirtualMachine's VM for use in the status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: atomic
- network:
- description: |-
- network VirtualMachine's VM Network names that will be used to when searching
- for status.addresses fields. Note that if internal.networkSubnetCIDR and
- external.networkSubnetCIDR are not set, then the vNIC associated to this network must
- only have a single IP address assigned to it.
- The available networks (port groups) can be listed using
- `govc ls 'network/*'`
- type: string
- networkSubnetCidr:
- description: |-
- networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
- that will be used in respective status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: set
- type: object
- internal:
- description: internal represents the network configuration
- of the node that is routable only within the cluster.
- properties:
- excludeNetworkSubnetCidr:
- description: |-
- excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting
- the IP address from the VirtualMachine's VM for use in the status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: atomic
- network:
- description: |-
- network VirtualMachine's VM Network names that will be used to when searching
- for status.addresses fields. Note that if internal.networkSubnetCIDR and
- external.networkSubnetCIDR are not set, then the vNIC associated to this network must
- only have a single IP address assigned to it.
- The available networks (port groups) can be listed using
- `govc ls 'network/*'`
- type: string
- networkSubnetCidr:
- description: |-
- networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs
- that will be used in respective status.addresses fields.
- items:
- format: cidr
- type: string
- type: array
- x-kubernetes-list-type: set
- type: object
- type: object
- vcenters:
- description: |-
- vcenters holds the connection details for services to communicate with vCenter.
- Currently, only a single vCenter is supported, but in tech preview 3 vCenters are supported.
- Once the cluster has been installed, you are unable to change the current number of defined
- vCenters except in the case where the cluster has been upgraded from a version of OpenShift
- where the vsphere platform spec was not present. You may make modifications to the existing
- vCenters that are defined in the vcenters list in order to match with any added or modified
- failure domains.
- items:
- description: |-
- VSpherePlatformVCenterSpec stores the vCenter connection fields.
- This is used by the vSphere CCM.
- properties:
- datacenters:
- description: |-
- The vCenter Datacenters in which the RHCOS
- vm guests are located. This field will
- be used by the Cloud Controller Manager.
- Each datacenter listed here should be used within
- a topology.
- items:
- type: string
- minItems: 1
- type: array
- x-kubernetes-list-type: set
- port:
- description: |-
- port is the TCP port that will be used to communicate to
- the vCenter endpoint.
- When omitted, this means the user has no opinion and
- it is up to the platform to choose a sensible default,
- which is subject to change over time.
- format: int32
- maximum: 32767
- minimum: 1
- type: integer
- server:
- anyOf:
- - format: ipv4
- - format: ipv6
- - format: hostname
- description: server is the fully-qualified domain name
- or the IP address of the vCenter server.
- maxLength: 255
- type: string
- required:
- - datacenters
- - server
- type: object
- maxItems: 3
- minItems: 0
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: vcenters cannot be added or removed once set
- rule: 'size(self) != size(oldSelf) ? size(oldSelf) == 0
- && size(self) < 2 : true'
- type: object
- x-kubernetes-validations:
- - message: apiServerInternalIPs list is required once set
- rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)'
- - message: ingressIPs list is required once set
- rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
- - message: vcenters can have at most 1 item when configured post-install
- rule: '!has(oldSelf.vcenters) && has(self.vcenters) ? size(self.vcenters)
- < 2 : true'
- type: object
- x-kubernetes-validations:
- - message: vcenters can have at most 1 item when configured post-install
- rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? size(self.vsphere.vcenters)
- < 2 : true'
- type: object
- status:
- description: status holds observed values from the cluster. They may not
- be overridden.
- properties:
- apiServerInternalURI:
- description: |-
- apiServerInternalURL is a valid URI with scheme 'https',
- address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components
- like kubelets, to contact the Kubernetes API server using the
- infrastructure provider rather than Kubernetes networking.
- type: string
- apiServerURL:
- description: |-
- apiServerURL is a valid URI with scheme 'https', address and
- optionally a port (defaulting to 443). apiServerURL can be used by components like the web console
- to tell users where to find the Kubernetes API.
- type: string
- controlPlaneTopology:
- default: HighlyAvailable
- description: |-
- controlPlaneTopology expresses the expectations for operands that normally run on control nodes.
- The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
- The 'SingleReplica' mode will be used in single-node deployments
- and the operators should not configure the operand for highly-available operation
- The 'External' mode indicates that the control plane is hosted externally to the cluster and that
- its components are not visible within the cluster.
- enum:
- - HighlyAvailable
- - HighlyAvailableArbiter
- - SingleReplica
- - DualReplica
- - External
- type: string
- cpuPartitioning:
- default: None
- description: |-
- cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster.
- CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets.
- Valid values are "None" and "AllNodes". When omitted, the default value is "None".
- The default value of "None" indicates that no nodes will be setup with CPU partitioning.
- The "AllNodes" value indicates that all nodes have been setup with CPU partitioning,
- and can then be further configured via the PerformanceProfile API.
- enum:
- - None
- - AllNodes
- type: string
- etcdDiscoveryDomain:
- description: |-
- etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering
- etcd servers and clients.
- For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery
- deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.
- type: string
- infrastructureName:
- description: |-
- infrastructureName uniquely identifies a cluster with a human friendly name.
- Once set it should not be changed. Must be of max length 27 and must have only
- alphanumeric or hyphen characters.
- type: string
- infrastructureTopology:
- default: HighlyAvailable
- description: |-
- infrastructureTopology expresses the expectations for infrastructure services that do not run on control
- plane nodes, usually indicated by a node selector for a `role` value
- other than `master`.
- The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster.
- The 'SingleReplica' mode will be used in single-node deployments
- and the operators should not configure the operand for highly-available operation
- NOTE: External topology mode is not applicable for this field.
- enum:
- - HighlyAvailable
- - SingleReplica
- type: string
- platform:
- description: |-
- platform is the underlying infrastructure provider for the cluster.
-
- Deprecated: Use platformStatus.type instead.
- enum:
- - ""
- - AWS
- - Azure
- - BareMetal
- - GCP
- - Libvirt
- - OpenStack
- - None
- - VSphere
- - oVirt
- - IBMCloud
- - KubeVirt
- - EquinixMetal
- - PowerVS
- - AlibabaCloud
- - Nutanix
- - External
- type: string
- platformStatus:
- description: |-
- platformStatus holds status information specific to the underlying
- infrastructure provider.
- properties:
- alibabaCloud:
- description: alibabaCloud contains settings specific to the Alibaba
- Cloud infrastructure provider.
- properties:
- region:
- description: region specifies the region for Alibaba Cloud
- resources created for the cluster.
- pattern: ^[0-9A-Za-z-]+$
- type: string
- resourceGroupID:
- description: resourceGroupID is the ID of the resource group
- for the cluster.
- pattern: ^(rg-[0-9A-Za-z]+)?$
- type: string
- resourceTags:
- description: resourceTags is a list of additional tags to
- apply to Alibaba Cloud resources created for the cluster.
- items:
- description: AlibabaCloudResourceTag is the set of tags
- to add to apply to resources.
- properties:
- key:
- description: key is the key of the tag.
- maxLength: 128
- minLength: 1
- type: string
- value:
- description: value is the value of the tag.
- maxLength: 128
- minLength: 1
- type: string
- required:
- - key
- - value
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- required:
- - region
- type: object
- aws:
- description: aws contains settings specific to the Amazon Web
- Services infrastructure provider.
- properties:
- cloudLoadBalancerConfig:
- default:
- dnsType: PlatformDefault
- description: |-
- cloudLoadBalancerConfig holds configuration related to DNS and cloud
- load balancers. It allows configuration of in-cluster DNS as an alternative
- to the platform default DNS implementation.
- When using the ClusterHosted DNS type, Load Balancer IP addresses
- must be provided for the API and internal API load balancers as well as the
- ingress load balancer.
- nullable: true
- properties:
- clusterHosted:
- description: |-
- clusterHosted holds the IP addresses of API, API-Int and Ingress Load
- Balancers on Cloud Platforms. The DNS solution hosted within the cluster
- use these IP addresses to provide resolution for API, API-Int and Ingress
- services.
- properties:
- apiIntLoadBalancerIPs:
- description: |-
- apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the apiIntLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- apiLoadBalancerIPs:
- description: |-
- apiLoadBalancerIPs holds Load Balancer IPs for the API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Could be empty for private clusters.
- Entries in the apiLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- ingressLoadBalancerIPs:
- description: |-
- ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the ingressLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- type: object
- dnsType:
- default: PlatformDefault
- description: |-
- dnsType indicates the type of DNS solution in use within the cluster. Its default value of
- `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
- It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
- the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
- The cluster's use of the cloud's Load Balancers is unaffected by this setting.
- The value is immutable after it has been set at install time.
- Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
- Enabling this functionality allows the user to start their own DNS solution outside the cluster after
- installation is complete. The customer would be responsible for configuring this custom DNS solution,
- and it can be run in addition to the in-cluster DNS solution.
- enum:
- - ClusterHosted
- - PlatformDefault
- type: string
- x-kubernetes-validations:
- - message: dnsType is immutable
- rule: oldSelf == '' || self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: clusterHosted is permitted only when dnsType is
- ClusterHosted
- rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
- ? !has(self.clusterHosted) : true'
- ipFamily:
- default: IPv4
- description: |-
- ipFamily specifies the IP protocol family that should be used for AWS
- network resources. This controls whether AWS resources are created with
- IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
- protocol family.
- enum:
- - IPv4
- - DualStackIPv6Primary
- - DualStackIPv4Primary
- type: string
- x-kubernetes-validations:
- - message: ipFamily is immutable once set
- rule: oldSelf == '' || self == oldSelf
- region:
- description: region holds the default AWS region for new AWS
- resources created by the cluster.
- type: string
- resourceTags:
- description: |-
- resourceTags is a list of additional tags to apply to AWS resources created for the cluster.
- See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources.
- AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags
- available for the user.
- items:
- description: AWSResourceTag is a tag to apply to AWS resources
- created for the cluster.
- properties:
- key:
- description: |-
- key sets the key of the AWS resource tag key-value pair. Key is required when defining an AWS resource tag.
- Key should consist of between 1 and 128 characters, and may
- contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
- maxLength: 128
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: invalid AWS resource tag key. The string
- can contain only the set of alphanumeric characters,
- space (' '), '_', '.', '/', '=', '+', '-', ':',
- '@'
- rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
- value:
- description: |-
- value sets the value of the AWS resource tag key-value pair. Value is required when defining an AWS resource tag.
- Value should consist of between 1 and 256 characters, and may
- contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'.
- Some AWS service do not support empty values. Since tags are added to resources in many services, the
- length of the tag value must meet the requirements of all services.
- maxLength: 256
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: invalid AWS resource tag value. The string
- can contain only the set of alphanumeric characters,
- space (' '), '_', '.', '/', '=', '+', '-', ':',
- '@'
- rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$')
- required:
- - key
- - value
- type: object
- maxItems: 25
- type: array
- x-kubernetes-list-type: atomic
- serviceEndpoints:
- description: |-
- serviceEndpoints list contains custom endpoints which will override default
- service endpoint of AWS Services.
- There must be only one ServiceEndpoint for a service.
- items:
- description: |-
- AWSServiceEndpoint store the configuration of a custom url to
- override existing defaults of AWS Services.
- properties:
- name:
- description: |-
- name is the name of the AWS service.
- The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html
- This must be provided and cannot be empty.
- pattern: ^[a-z0-9-]+$
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- pattern: ^https://
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- azure:
- description: azure contains settings specific to the Azure infrastructure
- provider.
- properties:
- armEndpoint:
- description: armEndpoint specifies a URL to use for resource
- management in non-soverign clouds such as Azure Stack.
- type: string
- cloudLoadBalancerConfig:
- default:
- dnsType: PlatformDefault
- description: |-
- cloudLoadBalancerConfig holds configuration related to DNS and cloud
- load balancers. It allows configuration of in-cluster DNS as an alternative
- to the platform default DNS implementation.
- When using the ClusterHosted DNS type, Load Balancer IP addresses
- must be provided for the API and internal API load balancers as well as the
- ingress load balancer.
- properties:
- clusterHosted:
- description: |-
- clusterHosted holds the IP addresses of API, API-Int and Ingress Load
- Balancers on Cloud Platforms. The DNS solution hosted within the cluster
- use these IP addresses to provide resolution for API, API-Int and Ingress
- services.
- properties:
- apiIntLoadBalancerIPs:
- description: |-
- apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the apiIntLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- apiLoadBalancerIPs:
- description: |-
- apiLoadBalancerIPs holds Load Balancer IPs for the API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Could be empty for private clusters.
- Entries in the apiLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- ingressLoadBalancerIPs:
- description: |-
- ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the ingressLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- type: object
- dnsType:
- default: PlatformDefault
- description: |-
- dnsType indicates the type of DNS solution in use within the cluster. Its default value of
- `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
- It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
- the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
- The cluster's use of the cloud's Load Balancers is unaffected by this setting.
- The value is immutable after it has been set at install time.
- Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
- Enabling this functionality allows the user to start their own DNS solution outside the cluster after
- installation is complete. The customer would be responsible for configuring this custom DNS solution,
- and it can be run in addition to the in-cluster DNS solution.
- enum:
- - ClusterHosted
- - PlatformDefault
- type: string
- x-kubernetes-validations:
- - message: dnsType is immutable
- rule: oldSelf == '' || self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: clusterHosted is permitted only when dnsType is
- ClusterHosted
- rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
- ? !has(self.clusterHosted) : true'
- cloudName:
- description: |-
- cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
- with the appropriate Azure API endpoints.
- If empty, the value is equal to `AzurePublicCloud`.
- enum:
- - ""
- - AzurePublicCloud
- - AzureUSGovernmentCloud
- - AzureChinaCloud
- - AzureGermanCloud
- - AzureStackCloud
- type: string
- ipFamily:
- default: IPv4
- description: |-
- ipFamily specifies the IP protocol family that should be used for Azure
- network resources. This controls whether Azure resources are created with
- IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary
- protocol family.
- enum:
- - IPv4
- - DualStackIPv6Primary
- - DualStackIPv4Primary
- type: string
- x-kubernetes-validations:
- - message: ipFamily is immutable once set
- rule: oldSelf == '' || self == oldSelf
- networkResourceGroupName:
- description: |-
- networkResourceGroupName is the Resource Group for network resources like the Virtual Network and Subnets used by the cluster.
- If empty, the value is same as ResourceGroupName.
- type: string
- resourceGroupName:
- description: resourceGroupName is the Resource Group for new
- Azure resources created for the cluster.
- type: string
- resourceTags:
- description: |-
- resourceTags is a list of additional tags to apply to Azure resources created for the cluster.
- See https://docs.microsoft.com/en-us/rest/api/resources/tags for information on tagging Azure resources.
- Due to limitations on Automation, Content Delivery Network, DNS Azure resources, a maximum of 15 tags
- may be applied. OpenShift reserves 5 tags for internal use, allowing 10 tags for user configuration.
- items:
- description: AzureResourceTag is a tag to apply to Azure
- resources created for the cluster.
- properties:
- key:
- description: |-
- key is the key part of the tag. A tag key can have a maximum of 128 characters and cannot be empty. Key
- must begin with a letter, end with a letter, number or underscore, and must contain only alphanumeric
- characters and the following special characters `_ . -`.
- maxLength: 128
- minLength: 1
- pattern: ^[a-zA-Z]([0-9A-Za-z_.-]*[0-9A-Za-z_])?$
- type: string
- value:
- description: |-
- value is the value part of the tag. A tag value can have a maximum of 256 characters and cannot be empty. Value
- must contain only alphanumeric characters and the following special characters `_ + , - . / : ; < = > ? @`.
- maxLength: 256
- minLength: 1
- pattern: ^[0-9A-Za-z_.=+-@]+$
- type: string
- required:
- - key
- - value
- type: object
- maxItems: 10
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: resourceTags are immutable and may only be configured
- during installation
- rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
- type: object
- x-kubernetes-validations:
- - message: resourceTags may only be configured during installation
- rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
- || has(oldSelf.resourceTags) && has(self.resourceTags)'
- baremetal:
- description: baremetal contains settings specific to the BareMetal
- platform.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on BareMetal platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- machineNetworks:
- description: machineNetworks are IP networks used to connect
- all the OpenShift cluster nodes.
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeDNSIP:
- description: |-
- nodeDNSIP is the IP address for the internal DNS used by the
- nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
- provides name resolution for the nodes themselves. There is no DNS-as-a-service for
- BareMetal deployments. In order to minimize necessary changes to the
- datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
- to the nodes in the cluster.
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- equinixMetal:
- description: equinixMetal contains settings specific to the Equinix
- Metal infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
- type: string
- type: object
- external:
- description: external contains settings specific to the generic
- External infrastructure provider.
- properties:
- cloudControllerManager:
- description: |-
- cloudControllerManager contains settings specific to the external Cloud Controller Manager (a.k.a. CCM or CPI).
- When omitted, new nodes will be not tainted
- and no extra initialization from the cloud controller manager is expected.
- properties:
- state:
- description: |-
- state determines whether or not an external Cloud Controller Manager is expected to
- be installed within the cluster.
- https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager
-
- Valid values are "External", "None" and omitted.
- When set to "External", new nodes will be tainted as uninitialized when created,
- preventing them from running workloads until they are initialized by the cloud controller manager.
- When omitted or set to "None", new nodes will be not tainted
- and no extra initialization from the cloud controller manager is expected.
- enum:
- - ""
- - External
- - None
- type: string
- x-kubernetes-validations:
- - message: state is immutable once set
- rule: self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: state may not be added or removed once set
- rule: (has(self.state) == has(oldSelf.state)) || (!has(oldSelf.state)
- && self.state != "External")
- type: object
- x-kubernetes-validations:
- - message: cloudControllerManager may not be added or removed
- once set
- rule: has(self.cloudControllerManager) == has(oldSelf.cloudControllerManager)
- gcp:
- description: gcp contains settings specific to the Google Cloud
- Platform infrastructure provider.
- properties:
- cloudLoadBalancerConfig:
- default:
- dnsType: PlatformDefault
- description: |-
- cloudLoadBalancerConfig holds configuration related to DNS and cloud
- load balancers. It allows configuration of in-cluster DNS as an alternative
- to the platform default DNS implementation.
- When using the ClusterHosted DNS type, Load Balancer IP addresses
- must be provided for the API and internal API load balancers as well as the
- ingress load balancer.
- nullable: true
- properties:
- clusterHosted:
- description: |-
- clusterHosted holds the IP addresses of API, API-Int and Ingress Load
- Balancers on Cloud Platforms. The DNS solution hosted within the cluster
- use these IP addresses to provide resolution for API, API-Int and Ingress
- services.
- properties:
- apiIntLoadBalancerIPs:
- description: |-
- apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the apiIntLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- apiLoadBalancerIPs:
- description: |-
- apiLoadBalancerIPs holds Load Balancer IPs for the API service.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Could be empty for private clusters.
- Entries in the apiLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- ingressLoadBalancerIPs:
- description: |-
- ingressLoadBalancerIPs holds IPs for Ingress Load Balancers.
- These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses.
- Entries in the ingressLoadBalancerIPs must be unique.
- A maximum of 16 IP addresses are permitted.
- format: ip
- items:
- description: IP is an IP address (for example, "10.0.0.0"
- or "fd00::").
- maxLength: 39
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid IP address
- rule: isIP(self)
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- type: object
- dnsType:
- default: PlatformDefault
- description: |-
- dnsType indicates the type of DNS solution in use within the cluster. Its default value of
- `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform.
- It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode,
- the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed.
- The cluster's use of the cloud's Load Balancers is unaffected by this setting.
- The value is immutable after it has been set at install time.
- Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS.
- Enabling this functionality allows the user to start their own DNS solution outside the cluster after
- installation is complete. The customer would be responsible for configuring this custom DNS solution,
- and it can be run in addition to the in-cluster DNS solution.
- enum:
- - ClusterHosted
- - PlatformDefault
- type: string
- x-kubernetes-validations:
- - message: dnsType is immutable
- rule: oldSelf == '' || self == oldSelf
- type: object
- x-kubernetes-validations:
- - message: clusterHosted is permitted only when dnsType is
- ClusterHosted
- rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted''
- ? !has(self.clusterHosted) : true'
- projectID:
- description: resourceGroupName is the Project ID for new GCP
- resources created for the cluster.
- type: string
- region:
- description: region holds the region for new GCP resources
- created for the cluster.
- type: string
- resourceLabels:
- description: |-
- resourceLabels is a list of additional labels to apply to GCP resources created for the cluster.
- See https://cloud.google.com/compute/docs/labeling-resources for information on labeling GCP resources.
- GCP supports a maximum of 64 labels per resource. OpenShift reserves 32 labels for internal use,
- allowing 32 labels for user configuration.
- items:
- description: GCPResourceLabel is a label to apply to GCP
- resources created for the cluster.
- properties:
- key:
- description: |-
- key is the key part of the label. A label key can have a maximum of 63 characters and cannot be empty.
- Label key must begin with a lowercase letter, and must contain only lowercase letters, numeric characters,
- and the following special characters `_-`. Label key must not have the reserved prefixes `kubernetes-io`
- and `openshift-io`.
- maxLength: 63
- minLength: 1
- pattern: ^[a-z][0-9a-z_-]{0,62}$
- type: string
- x-kubernetes-validations:
- - message: label keys must not start with either `openshift-io`
- or `kubernetes-io`
- rule: '!self.startsWith(''openshift-io'') && !self.startsWith(''kubernetes-io'')'
- value:
- description: |-
- value is the value part of the label. A label value can have a maximum of 63 characters and cannot be empty.
- Value must contain only lowercase letters, numeric characters, and the following special characters `_-`.
- maxLength: 63
- minLength: 1
- pattern: ^[0-9a-z_-]{1,63}$
- type: string
- required:
- - key
- - value
- type: object
- maxItems: 32
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- x-kubernetes-validations:
- - message: resourceLabels are immutable and may only be configured
- during installation
- rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
- resourceTags:
- description: |-
- resourceTags is a list of additional tags to apply to GCP resources created for the cluster.
- See https://cloud.google.com/resource-manager/docs/tags/tags-overview for information on
- tagging GCP resources. GCP supports a maximum of 50 tags per resource.
- items:
- description: GCPResourceTag is a tag to apply to GCP resources
- created for the cluster.
- properties:
- key:
- description: |-
- key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot be empty.
- Tag key must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
- alphanumeric characters, and the following special characters `._-`.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$
- type: string
- parentID:
- description: |-
- parentID is the ID of the hierarchical resource where the tags are defined,
- e.g. at the Organization or the Project level. To find the Organization or Project ID refer to the following pages:
- https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id,
- https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects.
- An OrganizationID must consist of decimal numbers, and cannot have leading zeroes.
- A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters, numbers,
- and hyphens, and must start with a letter, and cannot end with a hyphen.
- maxLength: 32
- minLength: 1
- pattern: (^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)
- type: string
- value:
- description: |-
- value is the value part of the tag. A tag value can have a maximum of 63 characters and cannot be empty.
- Tag value must begin and end with an alphanumeric character, and must contain only uppercase, lowercase
- alphanumeric characters, and the following special characters `_-.@%=+:,*#&(){}[]` and spaces.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$
- type: string
- required:
- - key
- - parentID
- - value
- type: object
- maxItems: 50
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- x-kubernetes-validations:
- - message: resourceTags are immutable and may only be configured
- during installation
- rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self)
- type: object
- x-kubernetes-validations:
- - message: resourceLabels may only be configured during installation
- rule: '!has(oldSelf.resourceLabels) && !has(self.resourceLabels)
- || has(oldSelf.resourceLabels) && has(self.resourceLabels)'
- - message: resourceTags may only be configured during installation
- rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags)
- || has(oldSelf.resourceTags) && has(self.resourceTags)'
- ibmcloud:
- description: ibmcloud contains settings specific to the IBMCloud
- infrastructure provider.
- properties:
- cisInstanceCRN:
- description: |-
- cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
- the DNS zone for the cluster's base domain
- type: string
- dnsInstanceCRN:
- description: |-
- dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
- for the cluster's base domain
- type: string
- location:
- description: location is where the cluster has been deployed
- type: string
- providerType:
- description: providerType indicates the type of cluster that
- was created
- type: string
- resourceGroupName:
- description: resourceGroupName is the Resource Group for new
- IBMCloud resources created for the cluster.
- type: string
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of an IBM service. These endpoints are used by components
- within the cluster when trying to reach the IBM Cloud Services that have been
- overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each
- endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus
- are updated to reflect the same custom endpoints.
- items:
- description: |-
- IBMCloudServiceEndpoint stores the configuration of a custom url to
- override existing defaults of IBM Cloud Services.
- properties:
- name:
- description: |-
- name is the name of the IBM Cloud service.
- Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
- For example, the IBM Cloud Private IAM service could be configured with the
- service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
- Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
- with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty. The path must follow the pattern
- /v[0,9]+ or /api/v[0,9]+
- maxLength: 300
- type: string
- x-kubernetes-validations:
- - message: url must be a valid absolute URL
- rule: isURL(self)
- required:
- - name
- - url
- type: object
- maxItems: 13
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- kubevirt:
- description: kubevirt contains settings specific to the kubevirt
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
- type: string
- type: object
- nutanix:
- description: nutanix contains settings specific to the Nutanix
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on Nutanix platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- openstack:
- description: openstack contains settings specific to the OpenStack
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- cloudName:
- description: |-
- cloudName is the name of the desired OpenStack cloud in the
- client configuration file (`clouds.yaml`).
- type: string
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on OpenStack platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- machineNetworks:
- description: machineNetworks are IP networks used to connect
- all the OpenShift cluster nodes.
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeDNSIP:
- description: |-
- nodeDNSIP is the IP address for the internal DNS used by the
- nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
- provides name resolution for the nodes themselves. There is no DNS-as-a-service for
- OpenStack deployments. In order to minimize necessary changes to the
- datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
- to the nodes in the cluster.
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- ovirt:
- description: ovirt contains settings specific to the oVirt infrastructure
- provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: set
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on Ovirt platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- nodeDNSIP:
- description: 'deprecated: as of 4.6, this field is no longer
- set or honored. It will be removed in a future release.'
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- powervs:
- description: powervs contains settings specific to the Power Systems
- Virtual Servers infrastructure provider.
- properties:
- cisInstanceCRN:
- description: |-
- cisInstanceCRN is the CRN of the Cloud Internet Services instance managing
- the DNS zone for the cluster's base domain
- type: string
- dnsInstanceCRN:
- description: |-
- dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone
- for the cluster's base domain
- type: string
- region:
- description: region holds the default Power VS region for
- new Power VS resources created by the cluster.
- type: string
- resourceGroup:
- description: |-
- resourceGroup is the resource group name for new IBMCloud resources created for a cluster.
- The resource group specified here will be used by cluster-image-registry-operator to set up a COS Instance in IBMCloud for the cluster registry.
- More about resource groups can be found here: https://cloud.ibm.com/docs/account?topic=account-rgs.
- When omitted, the image registry operator won't be able to configure storage,
- which results in the image registry cluster operator not being in an available state.
- maxLength: 40
- pattern: ^[a-zA-Z0-9-_ ]+$
- type: string
- x-kubernetes-validations:
- - message: resourceGroup is immutable once set
- rule: oldSelf == '' || self == oldSelf
- serviceEndpoints:
- description: |-
- serviceEndpoints is a list of custom endpoints which will override the default
- service endpoints of a Power VS service.
- items:
- description: |-
- PowervsServiceEndpoint stores the configuration of a custom url to
- override existing defaults of PowerVS Services.
- properties:
- name:
- description: |-
- name is the name of the Power VS service.
- Few of the services are
- IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api
- ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller
- Power Cloud - https://cloud.ibm.com/apidocs/power-cloud
- enum:
- - CIS
- - COS
- - COSConfig
- - DNSServices
- - GlobalCatalog
- - GlobalSearch
- - GlobalTagging
- - HyperProtect
- - IAM
- - KeyProtect
- - Power
- - ResourceController
- - ResourceManager
- - VPC
- type: string
- url:
- description: |-
- url is fully qualified URI with scheme https, that overrides the default generated
- endpoint for a client.
- This must be provided and cannot be empty.
- format: uri
- pattern: ^https://
- type: string
- required:
- - name
- - url
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- zone:
- description: |-
- zone holds the default zone for the new Power VS resources created by the cluster.
- Note: Currently only single-zone OCP clusters are supported
- type: string
- type: object
- x-kubernetes-validations:
- - message: cannot unset resourceGroup once set
- rule: '!has(oldSelf.resourceGroup) || has(self.resourceGroup)'
- type:
- description: |-
- type is the underlying infrastructure provider for the cluster. This
- value controls whether infrastructure automation such as service load
- balancers, dynamic volume provisioning, machine creation and deletion, and
- other integrations are enabled. If None, no infrastructure automation is
- enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
- "OpenStack", "VSphere", "oVirt", "EquinixMetal", "PowerVS", "AlibabaCloud", "Nutanix" and "None".
- Individual components may not support all platforms, and must handle
- unrecognized platforms as None if they do not support that platform.
-
- This value will be synced with to the `status.platform` and `status.platformStatus.type`.
- Currently this value cannot be changed once set.
- enum:
- - ""
- - AWS
- - Azure
- - BareMetal
- - GCP
- - Libvirt
- - OpenStack
- - None
- - VSphere
- - oVirt
- - IBMCloud
- - KubeVirt
- - EquinixMetal
- - PowerVS
- - AlibabaCloud
- - Nutanix
- - External
- type: string
- vsphere:
- description: vsphere contains settings specific to the VSphere
- infrastructure provider.
- properties:
- apiServerInternalIP:
- description: |-
- apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used
- by components inside the cluster, like kubelets using the infrastructure rather
- than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI
- points to. It is the IP for a self-hosted load balancer in front of the API servers.
-
- Deprecated: Use APIServerInternalIPs instead.
- type: string
- apiServerInternalIPs:
- description: |-
- apiServerInternalIPs are the IP addresses to contact the Kubernetes API
- server that can be used by components inside the cluster, like kubelets
- using the infrastructure rather than Kubernetes networking. These are the
- IPs for a self-hosted load balancer in front of the API servers. In dual
- stack clusters this list contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: apiServerInternalIPs must contain at most one IPv4
- address and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- dnsRecordsType:
- description: |-
- dnsRecordsType determines whether records for api, api-int, and ingress
- are provided by the internal DNS service or externally.
- Allowed values are `Internal`, `External`, and omitted.
- When set to `Internal`, records are provided by the internal infrastructure and
- no additional user configuration is required for the cluster to function.
- When set to `External`, records are not provided by the internal infrastructure
- and must be configured by the user on a DNS server outside the cluster.
- Cluster nodes must use this external server for their upstream DNS requests.
- This value may only be set when loadBalancer.type is set to UserManaged.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- The current default is `Internal`.
- enum:
- - Internal
- - External
- type: string
- ingressIP:
- description: |-
- ingressIP is an external IP which routes to the default ingress controller.
- The IP is a suitable target of a wildcard DNS record used to resolve default route host names.
-
- Deprecated: Use IngressIPs instead.
- type: string
- ingressIPs:
- description: |-
- ingressIPs are the external IPs which route to the default ingress
- controller. The IPs are suitable targets of a wildcard DNS record used to
- resolve default route host names. In dual stack clusters this list
- contains two IPs otherwise only one.
- format: ip
- items:
- type: string
- maxItems: 2
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - message: ingressIPs must contain at most one IPv4 address
- and at most one IPv6 address
- rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0])
- && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family()
- : true)'
- loadBalancer:
- default:
- type: OpenShiftManagedDefault
- description: loadBalancer defines how the load balancer used
- by the cluster is configured.
- properties:
- type:
- default: OpenShiftManagedDefault
- description: |-
- type defines the type of load balancer used by the cluster on VSphere platform
- which can be a user-managed or openshift-managed load balancer
- that is to be used for the OpenShift API and Ingress endpoints.
- When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing
- defined in the machine config operator will be deployed.
- When set to UserManaged these static pods will not be deployed and it is expected that
- the load balancer is configured out of band by the deployer.
- When omitted, this means no opinion and the platform is left to choose a reasonable default.
- The default value is OpenShiftManagedDefault.
- enum:
- - OpenShiftManagedDefault
- - UserManaged
- type: string
- x-kubernetes-validations:
- - message: type is immutable once set
- rule: oldSelf == '' || self == oldSelf
- type: object
- machineNetworks:
- description: machineNetworks are IP networks used to connect
- all the OpenShift cluster nodes.
- items:
- description: CIDR is an IP address range in CIDR notation
- (for example, "10.0.0.0/8" or "fd00::/8").
- maxLength: 43
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: value must be a valid CIDR network address
- rule: isCIDR(self)
- maxItems: 32
- type: array
- x-kubernetes-list-type: atomic
- x-kubernetes-validations:
- - rule: self.all(x, self.exists_one(y, x == y))
- nodeDNSIP:
- description: |-
- nodeDNSIP is the IP address for the internal DNS used by the
- nodes. Unlike the one managed by the DNS operator, `NodeDNSIP`
- provides name resolution for the nodes themselves. There is no DNS-as-a-service for
- vSphere deployments. In order to minimize necessary changes to the
- datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames
- to the nodes in the cluster.
- type: string
- type: object
- x-kubernetes-validations:
- - message: dnsRecordsType may only be set to External when loadBalancer.type
- is UserManaged
- rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal''
- || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')'
- type: object
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml
new file mode 100644
index 000000000..92f291315
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml
@@ -0,0 +1,593 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: CustomNoUpgrade
+ name: ingresses.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Ingress
+ listKind: IngressList
+ plural: ingresses
+ singular: ingress
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Ingress holds cluster-wide information about ingress, including the default ingress domain
+ used for routes. The canonical name is `cluster`.
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ appsDomain:
+ description: |-
+ appsDomain is an optional domain to use instead of the one specified
+ in the domain field when a Route is created without specifying an explicit
+ host. If appsDomain is nonempty, this value is used to generate default
+ host values for Route. Unlike domain, appsDomain may be modified after
+ installation.
+ This assumes a new ingresscontroller has been setup with a wildcard
+ certificate.
+ type: string
+ componentRoutes:
+ description: |-
+ componentRoutes is an optional list of routes that are managed by OpenShift components
+ that a cluster-admin is able to configure the hostname and serving certificate for.
+ The namespace and name of each route in this list should match an existing entry in the
+ status.componentRoutes list.
+
+ To determine the set of configurable Routes, look at namespace and name of entries in the
+ .status.componentRoutes list, where participating operators write the status of
+ configurable routes.
+ A maximum of 250 component routes may be configured.
+ items:
+ description: ComponentRouteSpec allows for configuration of a route's
+ hostname and serving certificate.
+ properties:
+ hostname:
+ description: hostname is the hostname that should be used by
+ the route.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ labels:
+ additionalProperties:
+ description: |-
+ LabelValue is the value part of a Kubernetes label.
+ A label value must be either empty or 1-63 characters, consisting of
+ alphanumeric characters, '-', '_', or '.', starting and ending with
+ an alphanumeric character.
+ maxLength: 63
+ type: string
+ x-kubernetes-validations:
+ - message: label values must be valid Kubernetes label values
+ (at most 63 characters, alphanumeric, '-', '_', or '.',
+ must start and end with alphanumeric)
+ rule: '!format.labelValue().validate(self).hasValue()'
+ description: |-
+ labels defines additional labels to be applied to the route created
+ for the component. These labels are used by the IngressController to
+ determine which routes it should manage. Changing labels may cause the
+ route to be reassigned to a different IngressController.
+ When omitted, no additional labels are applied to the component route.
+ When specified, labels must contain at least one entry, up to a maximum of 8.
+ Label keys must be valid qualified names, consisting of a name segment and
+ an optional prefix separated by a slash (/). The name segment must be at most
+ 63 characters in length and must consist only of alphanumeric characters,
+ dashes (-), underscores (_), and dots (.), and must start and end with
+ alphanumeric characters. The prefix, if specified, must be a DNS subdomain:
+ at most 253 characters in length, consisting of dot-separated segments where
+ each segment starts and ends with an alphanumeric character.
+ Label values must be either empty or 1-63 characters, consisting of
+ alphanumeric characters, dashes (-), underscores (_), or dots (.),
+ starting and ending with an alphanumeric character.
+ Keys with the "kubernetes.io/", "k8s.io/", and "openshift.io/" prefixes are reserved and may not be used.
+ maxProperties: 8
+ minProperties: 1
+ type: object
+ x-kubernetes-map-type: granular
+ x-kubernetes-validations:
+ - message: label keys must be valid qualified names, consisting
+ of an optional DNS subdomain prefix of up to 253 characters
+ followed by a slash and a name segment of 1-63 characters,
+ that consists only of alphanumeric characters, dashes, underscores,
+ and dots, and must start and end with an alphanumeric character
+ rule: self.all(key, !format.qualifiedName().validate(key).hasValue())
+ - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed
+ label keys are reserved and may not be used
+ rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/')
+ && !key.startsWith('openshift.io/'))
+ name:
+ description: |-
+ name is the logical name of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ servingCertKeyPairSecret:
+ description: |-
+ servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
+ The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
+ If the custom hostname uses the default routing suffix of the cluster,
+ the Secret specification for a serving certificate will not be needed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - hostname
+ - name
+ - namespace
+ type: object
+ maxItems: 250
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ domain:
+ description: |-
+ domain is used to generate a default host name for a route when the
+ route's host name is empty. The generated host name will follow this
+ pattern: "..".
+
+ It is also used as the default wildcard domain suffix for ingress. The
+ default ingresscontroller domain will follow this pattern: "*.".
+
+ Once set, changing domain is not currently supported.
+ type: string
+ x-kubernetes-validations:
+ - message: domain is immutable once set
+ rule: self == oldSelf
+ loadBalancer:
+ description: |-
+ loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
+ provider of the current cluster and are required for Ingress Controller to work on OpenShift.
+ properties:
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for the ingress load balancers.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains settings specific to the Amazon
+ Web Services infrastructure provider.
+ properties:
+ type:
+ description: |-
+ type allows user to set a load balancer type.
+ When this field is set the default ingresscontroller will get created using the specified LBType.
+ If this field is not set then the default ingress controller of LBType Classic will be created.
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - NLB
+ - Classic
+ type: string
+ required:
+ - type
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
+ "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
+ and must handle unrecognized platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ type: object
+ type: object
+ requiredHSTSPolicies:
+ description: |-
+ requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
+ matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
+ Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
+ annotation, and affect route admission.
+
+ A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
+ "haproxy.router.openshift.io/hsts_header"
+ E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
+
+ - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
+ is rejected.
+ - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
+ determines the route's admission status.
+ - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then it may use any HSTS Policy annotation.
+
+ The HSTS policy configuration may be changed after routes have already been created. An update to a previously
+ admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
+ However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
+
+ Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
+ items:
+ properties:
+ domainPatterns:
+ description: |-
+ domainPatterns is a list of domains for which the desired HSTS annotations are required.
+ If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
+ the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
+
+ The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
+ foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ includeSubDomainsPolicy:
+ description: |-
+ includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
+ domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
+ - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ enum:
+ - RequireIncludeSubDomains
+ - RequireNoIncludeSubDomains
+ - NoOpinion
+ type: string
+ maxAge:
+ description: |-
+ maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
+ If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
+ If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
+ maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
+ policy will eventually expire on that client.
+ properties:
+ largestMaxAge:
+ description: |-
+ The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ This value can be left unspecified, in which case no upper limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ smallestMaxAge:
+ description: |-
+ The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
+ tool for administrators to quickly correct mistakes.
+ This value can be left unspecified, in which case no lower limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ type: object
+ namespaceSelector:
+ description: |-
+ namespaceSelector specifies a label selector such that the policy applies only to those routes that
+ are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
+ Defaults to the empty LabelSelector, which matches everything.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector
+ requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector
+ applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ preloadPolicy:
+ description: |-
+ preloadPolicy directs the client to include hosts in its host preload list so that
+ it never needs to do an initial load to get the HSTS header (note that this is not defined
+ in RFC 6797 and is therefore client implementation-dependent).
+ enum:
+ - RequirePreload
+ - RequireNoPreload
+ - NoOpinion
+ type: string
+ required:
+ - domainPatterns
+ type: object
+ type: array
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ componentRoutes:
+ description: |-
+ componentRoutes is where participating operators place the current route status for routes whose
+ hostnames and serving certificates can be customized by the cluster-admin.
+ items:
+ description: ComponentRouteStatus contains information allowing
+ configuration of a route's hostname and serving certificate.
+ properties:
+ conditions:
+ description: |-
+ conditions are used to communicate the state of the componentRoutes entry.
+
+ Supported conditions include Available, Degraded and Progressing.
+
+ If available is true, the content served by the route can be accessed by users. This includes cases
+ where a default may continue to serve content while the customized route specified by the cluster-admin
+ is being configured.
+
+ If Degraded is true, that means something has gone wrong trying to handle the componentRoutes entry.
+ The currentHostnames field may or may not be in effect.
+
+ If Progressing is true, that means the component is taking some action related to the componentRoutes entry.
+ items:
+ description: Condition contains details for one aspect of
+ the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False,
+ Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ consumingUsers:
+ description: consumingUsers is a slice of ServiceAccounts that
+ need to have read permission on the servingCertKeyPairSecret
+ secret.
+ items:
+ description: ConsumingUser is an alias for string which we
+ add validation to. Currently only service accounts are supported.
+ maxLength: 512
+ minLength: 1
+ pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ maxItems: 5
+ type: array
+ currentHostnames:
+ description: |-
+ currentHostnames is the list of current names used by the route. Typically, this list should consist of a single
+ hostname, but if multiple hostnames are supported by the route the operator may write multiple entries to this list.
+ items:
+ description: Hostname is a host name as defined by RFC-1123.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ minItems: 1
+ type: array
+ defaultHostname:
+ description: defaultHostname is the hostname of this route prior
+ to customization.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize. It does not have to be the actual name of a route resource
+ but it cannot be renamed.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of spec.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize. It must be a real namespace. Using an actual namespace
+ ensures that no two components will conflict and the same component can be installed multiple times.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of spec.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ relatedObjects:
+ description: relatedObjects is a list of resources which are
+ useful when debugging or inspecting how spec.componentRoutes
+ is applied.
+ items:
+ description: ObjectReference contains enough information to
+ let you inspect or modify the referred object.
+ properties:
+ group:
+ description: group of the referent.
+ type: string
+ name:
+ description: name of the referent.
+ type: string
+ namespace:
+ description: namespace of the referent.
+ type: string
+ resource:
+ description: resource of the referent.
+ type: string
+ required:
+ - group
+ - name
+ - resource
+ type: object
+ minItems: 1
+ type: array
+ required:
+ - defaultHostname
+ - name
+ - namespace
+ - relatedObjects
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ defaultPlacement:
+ description: |-
+ defaultPlacement is set at installation time to control which
+ nodes will host the ingress router pods by default. The options are
+ control-plane nodes or worker nodes.
+
+ This field works by dictating how the Cluster Ingress Operator will
+ consider unset replicas and nodePlacement fields in IngressController
+ resources when creating the corresponding Deployments.
+
+ See the documentation for the IngressController replicas and nodePlacement
+ fields for more information.
+
+ When omitted, the default value is Workers
+ enum:
+ - ControlPlane
+ - Workers
+ - ""
+ type: string
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-Default.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-Default.crd.yaml
new file mode 100644
index 000000000..70c87e6e4
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-Default.crd.yaml
@@ -0,0 +1,546 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: Default
+ name: ingresses.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Ingress
+ listKind: IngressList
+ plural: ingresses
+ singular: ingress
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Ingress holds cluster-wide information about ingress, including the default ingress domain
+ used for routes. The canonical name is `cluster`.
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ appsDomain:
+ description: |-
+ appsDomain is an optional domain to use instead of the one specified
+ in the domain field when a Route is created without specifying an explicit
+ host. If appsDomain is nonempty, this value is used to generate default
+ host values for Route. Unlike domain, appsDomain may be modified after
+ installation.
+ This assumes a new ingresscontroller has been setup with a wildcard
+ certificate.
+ type: string
+ componentRoutes:
+ description: |-
+ componentRoutes is an optional list of routes that are managed by OpenShift components
+ that a cluster-admin is able to configure the hostname and serving certificate for.
+ The namespace and name of each route in this list should match an existing entry in the
+ status.componentRoutes list.
+
+ To determine the set of configurable Routes, look at namespace and name of entries in the
+ .status.componentRoutes list, where participating operators write the status of
+ configurable routes.
+ A maximum of 250 component routes may be configured.
+ items:
+ description: ComponentRouteSpec allows for configuration of a route's
+ hostname and serving certificate.
+ properties:
+ hostname:
+ description: hostname is the hostname that should be used by
+ the route.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ servingCertKeyPairSecret:
+ description: |-
+ servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
+ The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
+ If the custom hostname uses the default routing suffix of the cluster,
+ the Secret specification for a serving certificate will not be needed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - hostname
+ - name
+ - namespace
+ type: object
+ maxItems: 250
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ domain:
+ description: |-
+ domain is used to generate a default host name for a route when the
+ route's host name is empty. The generated host name will follow this
+ pattern: "..".
+
+ It is also used as the default wildcard domain suffix for ingress. The
+ default ingresscontroller domain will follow this pattern: "*.".
+
+ Once set, changing domain is not currently supported.
+ type: string
+ x-kubernetes-validations:
+ - message: domain is immutable once set
+ rule: self == oldSelf
+ loadBalancer:
+ description: |-
+ loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
+ provider of the current cluster and are required for Ingress Controller to work on OpenShift.
+ properties:
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for the ingress load balancers.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains settings specific to the Amazon
+ Web Services infrastructure provider.
+ properties:
+ type:
+ description: |-
+ type allows user to set a load balancer type.
+ When this field is set the default ingresscontroller will get created using the specified LBType.
+ If this field is not set then the default ingress controller of LBType Classic will be created.
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - NLB
+ - Classic
+ type: string
+ required:
+ - type
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
+ "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
+ and must handle unrecognized platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ type: object
+ type: object
+ requiredHSTSPolicies:
+ description: |-
+ requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
+ matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
+ Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
+ annotation, and affect route admission.
+
+ A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
+ "haproxy.router.openshift.io/hsts_header"
+ E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
+
+ - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
+ is rejected.
+ - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
+ determines the route's admission status.
+ - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then it may use any HSTS Policy annotation.
+
+ The HSTS policy configuration may be changed after routes have already been created. An update to a previously
+ admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
+ However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
+
+ Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
+ items:
+ properties:
+ domainPatterns:
+ description: |-
+ domainPatterns is a list of domains for which the desired HSTS annotations are required.
+ If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
+ the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
+
+ The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
+ foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ includeSubDomainsPolicy:
+ description: |-
+ includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
+ domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
+ - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ enum:
+ - RequireIncludeSubDomains
+ - RequireNoIncludeSubDomains
+ - NoOpinion
+ type: string
+ maxAge:
+ description: |-
+ maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
+ If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
+ If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
+ maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
+ policy will eventually expire on that client.
+ properties:
+ largestMaxAge:
+ description: |-
+ The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ This value can be left unspecified, in which case no upper limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ smallestMaxAge:
+ description: |-
+ The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
+ tool for administrators to quickly correct mistakes.
+ This value can be left unspecified, in which case no lower limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ type: object
+ namespaceSelector:
+ description: |-
+ namespaceSelector specifies a label selector such that the policy applies only to those routes that
+ are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
+ Defaults to the empty LabelSelector, which matches everything.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector
+ requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector
+ applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ preloadPolicy:
+ description: |-
+ preloadPolicy directs the client to include hosts in its host preload list so that
+ it never needs to do an initial load to get the HSTS header (note that this is not defined
+ in RFC 6797 and is therefore client implementation-dependent).
+ enum:
+ - RequirePreload
+ - RequireNoPreload
+ - NoOpinion
+ type: string
+ required:
+ - domainPatterns
+ type: object
+ type: array
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ componentRoutes:
+ description: |-
+ componentRoutes is where participating operators place the current route status for routes whose
+ hostnames and serving certificates can be customized by the cluster-admin.
+ items:
+ description: ComponentRouteStatus contains information allowing
+ configuration of a route's hostname and serving certificate.
+ properties:
+ conditions:
+ description: |-
+ conditions are used to communicate the state of the componentRoutes entry.
+
+ Supported conditions include Available, Degraded and Progressing.
+
+ If available is true, the content served by the route can be accessed by users. This includes cases
+ where a default may continue to serve content while the customized route specified by the cluster-admin
+ is being configured.
+
+ If Degraded is true, that means something has gone wrong trying to handle the componentRoutes entry.
+ The currentHostnames field may or may not be in effect.
+
+ If Progressing is true, that means the component is taking some action related to the componentRoutes entry.
+ items:
+ description: Condition contains details for one aspect of
+ the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False,
+ Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ consumingUsers:
+ description: consumingUsers is a slice of ServiceAccounts that
+ need to have read permission on the servingCertKeyPairSecret
+ secret.
+ items:
+ description: ConsumingUser is an alias for string which we
+ add validation to. Currently only service accounts are supported.
+ maxLength: 512
+ minLength: 1
+ pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ maxItems: 5
+ type: array
+ currentHostnames:
+ description: |-
+ currentHostnames is the list of current names used by the route. Typically, this list should consist of a single
+ hostname, but if multiple hostnames are supported by the route the operator may write multiple entries to this list.
+ items:
+ description: Hostname is a host name as defined by RFC-1123.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ minItems: 1
+ type: array
+ defaultHostname:
+ description: defaultHostname is the hostname of this route prior
+ to customization.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize. It does not have to be the actual name of a route resource
+ but it cannot be renamed.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of spec.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize. It must be a real namespace. Using an actual namespace
+ ensures that no two components will conflict and the same component can be installed multiple times.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of spec.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ relatedObjects:
+ description: relatedObjects is a list of resources which are
+ useful when debugging or inspecting how spec.componentRoutes
+ is applied.
+ items:
+ description: ObjectReference contains enough information to
+ let you inspect or modify the referred object.
+ properties:
+ group:
+ description: group of the referent.
+ type: string
+ name:
+ description: name of the referent.
+ type: string
+ namespace:
+ description: namespace of the referent.
+ type: string
+ resource:
+ description: resource of the referent.
+ type: string
+ required:
+ - group
+ - name
+ - resource
+ type: object
+ minItems: 1
+ type: array
+ required:
+ - defaultHostname
+ - name
+ - namespace
+ - relatedObjects
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ defaultPlacement:
+ description: |-
+ defaultPlacement is set at installation time to control which
+ nodes will host the ingress router pods by default. The options are
+ control-plane nodes or worker nodes.
+
+ This field works by dictating how the Cluster Ingress Operator will
+ consider unset replicas and nodePlacement fields in IngressController
+ resources when creating the corresponding Deployments.
+
+ See the documentation for the IngressController replicas and nodePlacement
+ fields for more information.
+
+ When omitted, the default value is Workers
+ enum:
+ - ControlPlane
+ - Workers
+ - ""
+ type: string
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml
new file mode 100644
index 000000000..42e4209c6
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,593 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: DevPreviewNoUpgrade
+ name: ingresses.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Ingress
+ listKind: IngressList
+ plural: ingresses
+ singular: ingress
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Ingress holds cluster-wide information about ingress, including the default ingress domain
+ used for routes. The canonical name is `cluster`.
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ appsDomain:
+ description: |-
+ appsDomain is an optional domain to use instead of the one specified
+ in the domain field when a Route is created without specifying an explicit
+ host. If appsDomain is nonempty, this value is used to generate default
+ host values for Route. Unlike domain, appsDomain may be modified after
+ installation.
+ This assumes a new ingresscontroller has been setup with a wildcard
+ certificate.
+ type: string
+ componentRoutes:
+ description: |-
+ componentRoutes is an optional list of routes that are managed by OpenShift components
+ that a cluster-admin is able to configure the hostname and serving certificate for.
+ The namespace and name of each route in this list should match an existing entry in the
+ status.componentRoutes list.
+
+ To determine the set of configurable Routes, look at namespace and name of entries in the
+ .status.componentRoutes list, where participating operators write the status of
+ configurable routes.
+ A maximum of 250 component routes may be configured.
+ items:
+ description: ComponentRouteSpec allows for configuration of a route's
+ hostname and serving certificate.
+ properties:
+ hostname:
+ description: hostname is the hostname that should be used by
+ the route.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ labels:
+ additionalProperties:
+ description: |-
+ LabelValue is the value part of a Kubernetes label.
+ A label value must be either empty or 1-63 characters, consisting of
+ alphanumeric characters, '-', '_', or '.', starting and ending with
+ an alphanumeric character.
+ maxLength: 63
+ type: string
+ x-kubernetes-validations:
+ - message: label values must be valid Kubernetes label values
+ (at most 63 characters, alphanumeric, '-', '_', or '.',
+ must start and end with alphanumeric)
+ rule: '!format.labelValue().validate(self).hasValue()'
+ description: |-
+ labels defines additional labels to be applied to the route created
+ for the component. These labels are used by the IngressController to
+ determine which routes it should manage. Changing labels may cause the
+ route to be reassigned to a different IngressController.
+ When omitted, no additional labels are applied to the component route.
+ When specified, labels must contain at least one entry, up to a maximum of 8.
+ Label keys must be valid qualified names, consisting of a name segment and
+ an optional prefix separated by a slash (/). The name segment must be at most
+ 63 characters in length and must consist only of alphanumeric characters,
+ dashes (-), underscores (_), and dots (.), and must start and end with
+ alphanumeric characters. The prefix, if specified, must be a DNS subdomain:
+ at most 253 characters in length, consisting of dot-separated segments where
+ each segment starts and ends with an alphanumeric character.
+ Label values must be either empty or 1-63 characters, consisting of
+ alphanumeric characters, dashes (-), underscores (_), or dots (.),
+ starting and ending with an alphanumeric character.
+ Keys with the "kubernetes.io/", "k8s.io/", and "openshift.io/" prefixes are reserved and may not be used.
+ maxProperties: 8
+ minProperties: 1
+ type: object
+ x-kubernetes-map-type: granular
+ x-kubernetes-validations:
+ - message: label keys must be valid qualified names, consisting
+ of an optional DNS subdomain prefix of up to 253 characters
+ followed by a slash and a name segment of 1-63 characters,
+ that consists only of alphanumeric characters, dashes, underscores,
+ and dots, and must start and end with an alphanumeric character
+ rule: self.all(key, !format.qualifiedName().validate(key).hasValue())
+ - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed
+ label keys are reserved and may not be used
+ rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/')
+ && !key.startsWith('openshift.io/'))
+ name:
+ description: |-
+ name is the logical name of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ servingCertKeyPairSecret:
+ description: |-
+ servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
+ The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
+ If the custom hostname uses the default routing suffix of the cluster,
+ the Secret specification for a serving certificate will not be needed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - hostname
+ - name
+ - namespace
+ type: object
+ maxItems: 250
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ domain:
+ description: |-
+ domain is used to generate a default host name for a route when the
+ route's host name is empty. The generated host name will follow this
+ pattern: "..".
+
+ It is also used as the default wildcard domain suffix for ingress. The
+ default ingresscontroller domain will follow this pattern: "*.".
+
+ Once set, changing domain is not currently supported.
+ type: string
+ x-kubernetes-validations:
+ - message: domain is immutable once set
+ rule: self == oldSelf
+ loadBalancer:
+ description: |-
+ loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
+ provider of the current cluster and are required for Ingress Controller to work on OpenShift.
+ properties:
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for the ingress load balancers.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains settings specific to the Amazon
+ Web Services infrastructure provider.
+ properties:
+ type:
+ description: |-
+ type allows user to set a load balancer type.
+ When this field is set the default ingresscontroller will get created using the specified LBType.
+ If this field is not set then the default ingress controller of LBType Classic will be created.
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - NLB
+ - Classic
+ type: string
+ required:
+ - type
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
+ "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
+ and must handle unrecognized platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ type: object
+ type: object
+ requiredHSTSPolicies:
+ description: |-
+ requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
+ matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
+ Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
+ annotation, and affect route admission.
+
+ A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
+ "haproxy.router.openshift.io/hsts_header"
+ E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
+
+ - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
+ is rejected.
+ - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
+ determines the route's admission status.
+ - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then it may use any HSTS Policy annotation.
+
+ The HSTS policy configuration may be changed after routes have already been created. An update to a previously
+ admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
+ However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
+
+ Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
+ items:
+ properties:
+ domainPatterns:
+ description: |-
+ domainPatterns is a list of domains for which the desired HSTS annotations are required.
+ If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
+ the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
+
+ The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
+ foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ includeSubDomainsPolicy:
+ description: |-
+ includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
+ domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
+ - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ enum:
+ - RequireIncludeSubDomains
+ - RequireNoIncludeSubDomains
+ - NoOpinion
+ type: string
+ maxAge:
+ description: |-
+ maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
+ If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
+ If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
+ maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
+ policy will eventually expire on that client.
+ properties:
+ largestMaxAge:
+ description: |-
+ The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ This value can be left unspecified, in which case no upper limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ smallestMaxAge:
+ description: |-
+ The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
+ tool for administrators to quickly correct mistakes.
+ This value can be left unspecified, in which case no lower limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ type: object
+ namespaceSelector:
+ description: |-
+ namespaceSelector specifies a label selector such that the policy applies only to those routes that
+ are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
+ Defaults to the empty LabelSelector, which matches everything.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector
+ requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector
+ applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ preloadPolicy:
+ description: |-
+ preloadPolicy directs the client to include hosts in its host preload list so that
+ it never needs to do an initial load to get the HSTS header (note that this is not defined
+ in RFC 6797 and is therefore client implementation-dependent).
+ enum:
+ - RequirePreload
+ - RequireNoPreload
+ - NoOpinion
+ type: string
+ required:
+ - domainPatterns
+ type: object
+ type: array
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ componentRoutes:
+ description: |-
+ componentRoutes is where participating operators place the current route status for routes whose
+ hostnames and serving certificates can be customized by the cluster-admin.
+ items:
+ description: ComponentRouteStatus contains information allowing
+ configuration of a route's hostname and serving certificate.
+ properties:
+ conditions:
+ description: |-
+ conditions are used to communicate the state of the componentRoutes entry.
+
+ Supported conditions include Available, Degraded and Progressing.
+
+ If available is true, the content served by the route can be accessed by users. This includes cases
+ where a default may continue to serve content while the customized route specified by the cluster-admin
+ is being configured.
+
+ If Degraded is true, that means something has gone wrong trying to handle the componentRoutes entry.
+ The currentHostnames field may or may not be in effect.
+
+ If Progressing is true, that means the component is taking some action related to the componentRoutes entry.
+ items:
+ description: Condition contains details for one aspect of
+ the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False,
+ Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ consumingUsers:
+ description: consumingUsers is a slice of ServiceAccounts that
+ need to have read permission on the servingCertKeyPairSecret
+ secret.
+ items:
+ description: ConsumingUser is an alias for string which we
+ add validation to. Currently only service accounts are supported.
+ maxLength: 512
+ minLength: 1
+ pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ maxItems: 5
+ type: array
+ currentHostnames:
+ description: |-
+ currentHostnames is the list of current names used by the route. Typically, this list should consist of a single
+ hostname, but if multiple hostnames are supported by the route the operator may write multiple entries to this list.
+ items:
+ description: Hostname is a host name as defined by RFC-1123.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ minItems: 1
+ type: array
+ defaultHostname:
+ description: defaultHostname is the hostname of this route prior
+ to customization.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize. It does not have to be the actual name of a route resource
+ but it cannot be renamed.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of spec.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize. It must be a real namespace. Using an actual namespace
+ ensures that no two components will conflict and the same component can be installed multiple times.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of spec.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ relatedObjects:
+ description: relatedObjects is a list of resources which are
+ useful when debugging or inspecting how spec.componentRoutes
+ is applied.
+ items:
+ description: ObjectReference contains enough information to
+ let you inspect or modify the referred object.
+ properties:
+ group:
+ description: group of the referent.
+ type: string
+ name:
+ description: name of the referent.
+ type: string
+ namespace:
+ description: namespace of the referent.
+ type: string
+ resource:
+ description: resource of the referent.
+ type: string
+ required:
+ - group
+ - name
+ - resource
+ type: object
+ minItems: 1
+ type: array
+ required:
+ - defaultHostname
+ - name
+ - namespace
+ - relatedObjects
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ defaultPlacement:
+ description: |-
+ defaultPlacement is set at installation time to control which
+ nodes will host the ingress router pods by default. The options are
+ control-plane nodes or worker nodes.
+
+ This field works by dictating how the Cluster Ingress Operator will
+ consider unset replicas and nodePlacement fields in IngressController
+ resources when creating the corresponding Deployments.
+
+ See the documentation for the IngressController replicas and nodePlacement
+ fields for more information.
+
+ When omitted, the default value is Workers
+ enum:
+ - ControlPlane
+ - Workers
+ - ""
+ type: string
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-OKD.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-OKD.crd.yaml
new file mode 100644
index 000000000..2c5b410ef
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-OKD.crd.yaml
@@ -0,0 +1,546 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: OKD
+ name: ingresses.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Ingress
+ listKind: IngressList
+ plural: ingresses
+ singular: ingress
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Ingress holds cluster-wide information about ingress, including the default ingress domain
+ used for routes. The canonical name is `cluster`.
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ appsDomain:
+ description: |-
+ appsDomain is an optional domain to use instead of the one specified
+ in the domain field when a Route is created without specifying an explicit
+ host. If appsDomain is nonempty, this value is used to generate default
+ host values for Route. Unlike domain, appsDomain may be modified after
+ installation.
+ This assumes a new ingresscontroller has been setup with a wildcard
+ certificate.
+ type: string
+ componentRoutes:
+ description: |-
+ componentRoutes is an optional list of routes that are managed by OpenShift components
+ that a cluster-admin is able to configure the hostname and serving certificate for.
+ The namespace and name of each route in this list should match an existing entry in the
+ status.componentRoutes list.
+
+ To determine the set of configurable Routes, look at namespace and name of entries in the
+ .status.componentRoutes list, where participating operators write the status of
+ configurable routes.
+ A maximum of 250 component routes may be configured.
+ items:
+ description: ComponentRouteSpec allows for configuration of a route's
+ hostname and serving certificate.
+ properties:
+ hostname:
+ description: hostname is the hostname that should be used by
+ the route.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ servingCertKeyPairSecret:
+ description: |-
+ servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
+ The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
+ If the custom hostname uses the default routing suffix of the cluster,
+ the Secret specification for a serving certificate will not be needed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - hostname
+ - name
+ - namespace
+ type: object
+ maxItems: 250
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ domain:
+ description: |-
+ domain is used to generate a default host name for a route when the
+ route's host name is empty. The generated host name will follow this
+ pattern: "..".
+
+ It is also used as the default wildcard domain suffix for ingress. The
+ default ingresscontroller domain will follow this pattern: "*.".
+
+ Once set, changing domain is not currently supported.
+ type: string
+ x-kubernetes-validations:
+ - message: domain is immutable once set
+ rule: self == oldSelf
+ loadBalancer:
+ description: |-
+ loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
+ provider of the current cluster and are required for Ingress Controller to work on OpenShift.
+ properties:
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for the ingress load balancers.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains settings specific to the Amazon
+ Web Services infrastructure provider.
+ properties:
+ type:
+ description: |-
+ type allows user to set a load balancer type.
+ When this field is set the default ingresscontroller will get created using the specified LBType.
+ If this field is not set then the default ingress controller of LBType Classic will be created.
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - NLB
+ - Classic
+ type: string
+ required:
+ - type
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
+ "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
+ and must handle unrecognized platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ type: object
+ type: object
+ requiredHSTSPolicies:
+ description: |-
+ requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
+ matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
+ Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
+ annotation, and affect route admission.
+
+ A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
+ "haproxy.router.openshift.io/hsts_header"
+ E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
+
+ - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
+ is rejected.
+ - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
+ determines the route's admission status.
+ - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then it may use any HSTS Policy annotation.
+
+ The HSTS policy configuration may be changed after routes have already been created. An update to a previously
+ admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
+ However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
+
+ Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
+ items:
+ properties:
+ domainPatterns:
+ description: |-
+ domainPatterns is a list of domains for which the desired HSTS annotations are required.
+ If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
+ the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
+
+ The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
+ foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ includeSubDomainsPolicy:
+ description: |-
+ includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
+ domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
+ - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ enum:
+ - RequireIncludeSubDomains
+ - RequireNoIncludeSubDomains
+ - NoOpinion
+ type: string
+ maxAge:
+ description: |-
+ maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
+ If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
+ If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
+ maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
+ policy will eventually expire on that client.
+ properties:
+ largestMaxAge:
+ description: |-
+ The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ This value can be left unspecified, in which case no upper limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ smallestMaxAge:
+ description: |-
+ The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
+ tool for administrators to quickly correct mistakes.
+ This value can be left unspecified, in which case no lower limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ type: object
+ namespaceSelector:
+ description: |-
+ namespaceSelector specifies a label selector such that the policy applies only to those routes that
+ are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
+ Defaults to the empty LabelSelector, which matches everything.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector
+ requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector
+ applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ preloadPolicy:
+ description: |-
+ preloadPolicy directs the client to include hosts in its host preload list so that
+ it never needs to do an initial load to get the HSTS header (note that this is not defined
+ in RFC 6797 and is therefore client implementation-dependent).
+ enum:
+ - RequirePreload
+ - RequireNoPreload
+ - NoOpinion
+ type: string
+ required:
+ - domainPatterns
+ type: object
+ type: array
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ componentRoutes:
+ description: |-
+ componentRoutes is where participating operators place the current route status for routes whose
+ hostnames and serving certificates can be customized by the cluster-admin.
+ items:
+ description: ComponentRouteStatus contains information allowing
+ configuration of a route's hostname and serving certificate.
+ properties:
+ conditions:
+ description: |-
+ conditions are used to communicate the state of the componentRoutes entry.
+
+ Supported conditions include Available, Degraded and Progressing.
+
+ If available is true, the content served by the route can be accessed by users. This includes cases
+ where a default may continue to serve content while the customized route specified by the cluster-admin
+ is being configured.
+
+ If Degraded is true, that means something has gone wrong trying to handle the componentRoutes entry.
+ The currentHostnames field may or may not be in effect.
+
+ If Progressing is true, that means the component is taking some action related to the componentRoutes entry.
+ items:
+ description: Condition contains details for one aspect of
+ the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False,
+ Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ consumingUsers:
+ description: consumingUsers is a slice of ServiceAccounts that
+ need to have read permission on the servingCertKeyPairSecret
+ secret.
+ items:
+ description: ConsumingUser is an alias for string which we
+ add validation to. Currently only service accounts are supported.
+ maxLength: 512
+ minLength: 1
+ pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ maxItems: 5
+ type: array
+ currentHostnames:
+ description: |-
+ currentHostnames is the list of current names used by the route. Typically, this list should consist of a single
+ hostname, but if multiple hostnames are supported by the route the operator may write multiple entries to this list.
+ items:
+ description: Hostname is a host name as defined by RFC-1123.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ minItems: 1
+ type: array
+ defaultHostname:
+ description: defaultHostname is the hostname of this route prior
+ to customization.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize. It does not have to be the actual name of a route resource
+ but it cannot be renamed.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of spec.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize. It must be a real namespace. Using an actual namespace
+ ensures that no two components will conflict and the same component can be installed multiple times.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of spec.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ relatedObjects:
+ description: relatedObjects is a list of resources which are
+ useful when debugging or inspecting how spec.componentRoutes
+ is applied.
+ items:
+ description: ObjectReference contains enough information to
+ let you inspect or modify the referred object.
+ properties:
+ group:
+ description: group of the referent.
+ type: string
+ name:
+ description: name of the referent.
+ type: string
+ namespace:
+ description: namespace of the referent.
+ type: string
+ resource:
+ description: resource of the referent.
+ type: string
+ required:
+ - group
+ - name
+ - resource
+ type: object
+ minItems: 1
+ type: array
+ required:
+ - defaultHostname
+ - name
+ - namespace
+ - relatedObjects
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ defaultPlacement:
+ description: |-
+ defaultPlacement is set at installation time to control which
+ nodes will host the ingress router pods by default. The options are
+ control-plane nodes or worker nodes.
+
+ This field works by dictating how the Cluster Ingress Operator will
+ consider unset replicas and nodePlacement fields in IngressController
+ resources when creating the corresponding Deployments.
+
+ See the documentation for the IngressController replicas and nodePlacement
+ fields for more information.
+
+ When omitted, the default value is Workers
+ enum:
+ - ControlPlane
+ - Workers
+ - ""
+ type: string
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml
new file mode 100644
index 000000000..d7fc151b1
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,593 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: TechPreviewNoUpgrade
+ name: ingresses.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Ingress
+ listKind: IngressList
+ plural: ingresses
+ singular: ingress
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Ingress holds cluster-wide information about ingress, including the default ingress domain
+ used for routes. The canonical name is `cluster`.
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec holds user settable values for configuration
+ properties:
+ appsDomain:
+ description: |-
+ appsDomain is an optional domain to use instead of the one specified
+ in the domain field when a Route is created without specifying an explicit
+ host. If appsDomain is nonempty, this value is used to generate default
+ host values for Route. Unlike domain, appsDomain may be modified after
+ installation.
+ This assumes a new ingresscontroller has been setup with a wildcard
+ certificate.
+ type: string
+ componentRoutes:
+ description: |-
+ componentRoutes is an optional list of routes that are managed by OpenShift components
+ that a cluster-admin is able to configure the hostname and serving certificate for.
+ The namespace and name of each route in this list should match an existing entry in the
+ status.componentRoutes list.
+
+ To determine the set of configurable Routes, look at namespace and name of entries in the
+ .status.componentRoutes list, where participating operators write the status of
+ configurable routes.
+ A maximum of 250 component routes may be configured.
+ items:
+ description: ComponentRouteSpec allows for configuration of a route's
+ hostname and serving certificate.
+ properties:
+ hostname:
+ description: hostname is the hostname that should be used by
+ the route.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ labels:
+ additionalProperties:
+ description: |-
+ LabelValue is the value part of a Kubernetes label.
+ A label value must be either empty or 1-63 characters, consisting of
+ alphanumeric characters, '-', '_', or '.', starting and ending with
+ an alphanumeric character.
+ maxLength: 63
+ type: string
+ x-kubernetes-validations:
+ - message: label values must be valid Kubernetes label values
+ (at most 63 characters, alphanumeric, '-', '_', or '.',
+ must start and end with alphanumeric)
+ rule: '!format.labelValue().validate(self).hasValue()'
+ description: |-
+ labels defines additional labels to be applied to the route created
+ for the component. These labels are used by the IngressController to
+ determine which routes it should manage. Changing labels may cause the
+ route to be reassigned to a different IngressController.
+ When omitted, no additional labels are applied to the component route.
+ When specified, labels must contain at least one entry, up to a maximum of 8.
+ Label keys must be valid qualified names, consisting of a name segment and
+ an optional prefix separated by a slash (/). The name segment must be at most
+ 63 characters in length and must consist only of alphanumeric characters,
+ dashes (-), underscores (_), and dots (.), and must start and end with
+ alphanumeric characters. The prefix, if specified, must be a DNS subdomain:
+ at most 253 characters in length, consisting of dot-separated segments where
+ each segment starts and ends with an alphanumeric character.
+ Label values must be either empty or 1-63 characters, consisting of
+ alphanumeric characters, dashes (-), underscores (_), or dots (.),
+ starting and ending with an alphanumeric character.
+ Keys with the "kubernetes.io/", "k8s.io/", and "openshift.io/" prefixes are reserved and may not be used.
+ maxProperties: 8
+ minProperties: 1
+ type: object
+ x-kubernetes-map-type: granular
+ x-kubernetes-validations:
+ - message: label keys must be valid qualified names, consisting
+ of an optional DNS subdomain prefix of up to 253 characters
+ followed by a slash and a name segment of 1-63 characters,
+ that consists only of alphanumeric characters, dashes, underscores,
+ and dots, and must start and end with an alphanumeric character
+ rule: self.all(key, !format.qualifiedName().validate(key).hasValue())
+ - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed
+ label keys are reserved and may not be used
+ rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/')
+ && !key.startsWith('openshift.io/'))
+ name:
+ description: |-
+ name is the logical name of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ servingCertKeyPairSecret:
+ description: |-
+ servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
+ The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
+ If the custom hostname uses the default routing suffix of the cluster,
+ the Secret specification for a serving certificate will not be needed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - hostname
+ - name
+ - namespace
+ type: object
+ maxItems: 250
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ domain:
+ description: |-
+ domain is used to generate a default host name for a route when the
+ route's host name is empty. The generated host name will follow this
+ pattern: "..".
+
+ It is also used as the default wildcard domain suffix for ingress. The
+ default ingresscontroller domain will follow this pattern: "*.".
+
+ Once set, changing domain is not currently supported.
+ type: string
+ x-kubernetes-validations:
+ - message: domain is immutable once set
+ rule: self == oldSelf
+ loadBalancer:
+ description: |-
+ loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
+ provider of the current cluster and are required for Ingress Controller to work on OpenShift.
+ properties:
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for the ingress load balancers.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains settings specific to the Amazon
+ Web Services infrastructure provider.
+ properties:
+ type:
+ description: |-
+ type allows user to set a load balancer type.
+ When this field is set the default ingresscontroller will get created using the specified LBType.
+ If this field is not set then the default ingress controller of LBType Classic will be created.
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - NLB
+ - Classic
+ type: string
+ required:
+ - type
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
+ "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
+ and must handle unrecognized platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ type: object
+ type: object
+ requiredHSTSPolicies:
+ description: |-
+ requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
+ matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
+ Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
+ annotation, and affect route admission.
+
+ A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
+ "haproxy.router.openshift.io/hsts_header"
+ E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
+
+ - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
+ is rejected.
+ - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
+ determines the route's admission status.
+ - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then it may use any HSTS Policy annotation.
+
+ The HSTS policy configuration may be changed after routes have already been created. An update to a previously
+ admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
+ However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
+
+ Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
+ items:
+ properties:
+ domainPatterns:
+ description: |-
+ domainPatterns is a list of domains for which the desired HSTS annotations are required.
+ If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
+ the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
+
+ The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
+ foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ includeSubDomainsPolicy:
+ description: |-
+ includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
+ domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
+ - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ enum:
+ - RequireIncludeSubDomains
+ - RequireNoIncludeSubDomains
+ - NoOpinion
+ type: string
+ maxAge:
+ description: |-
+ maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
+ If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
+ If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
+ maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
+ policy will eventually expire on that client.
+ properties:
+ largestMaxAge:
+ description: |-
+ The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ This value can be left unspecified, in which case no upper limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ smallestMaxAge:
+ description: |-
+ The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
+ tool for administrators to quickly correct mistakes.
+ This value can be left unspecified, in which case no lower limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ type: object
+ namespaceSelector:
+ description: |-
+ namespaceSelector specifies a label selector such that the policy applies only to those routes that
+ are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
+ Defaults to the empty LabelSelector, which matches everything.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector
+ requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector
+ applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ preloadPolicy:
+ description: |-
+ preloadPolicy directs the client to include hosts in its host preload list so that
+ it never needs to do an initial load to get the HSTS header (note that this is not defined
+ in RFC 6797 and is therefore client implementation-dependent).
+ enum:
+ - RequirePreload
+ - RequireNoPreload
+ - NoOpinion
+ type: string
+ required:
+ - domainPatterns
+ type: object
+ type: array
+ type: object
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ componentRoutes:
+ description: |-
+ componentRoutes is where participating operators place the current route status for routes whose
+ hostnames and serving certificates can be customized by the cluster-admin.
+ items:
+ description: ComponentRouteStatus contains information allowing
+ configuration of a route's hostname and serving certificate.
+ properties:
+ conditions:
+ description: |-
+ conditions are used to communicate the state of the componentRoutes entry.
+
+ Supported conditions include Available, Degraded and Progressing.
+
+ If available is true, the content served by the route can be accessed by users. This includes cases
+ where a default may continue to serve content while the customized route specified by the cluster-admin
+ is being configured.
+
+ If Degraded is true, that means something has gone wrong trying to handle the componentRoutes entry.
+ The currentHostnames field may or may not be in effect.
+
+ If Progressing is true, that means the component is taking some action related to the componentRoutes entry.
+ items:
+ description: Condition contains details for one aspect of
+ the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False,
+ Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ consumingUsers:
+ description: consumingUsers is a slice of ServiceAccounts that
+ need to have read permission on the servingCertKeyPairSecret
+ secret.
+ items:
+ description: ConsumingUser is an alias for string which we
+ add validation to. Currently only service accounts are supported.
+ maxLength: 512
+ minLength: 1
+ pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ maxItems: 5
+ type: array
+ currentHostnames:
+ description: |-
+ currentHostnames is the list of current names used by the route. Typically, this list should consist of a single
+ hostname, but if multiple hostnames are supported by the route the operator may write multiple entries to this list.
+ items:
+ description: Hostname is a host name as defined by RFC-1123.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ minItems: 1
+ type: array
+ defaultHostname:
+ description: defaultHostname is the hostname of this route prior
+ to customization.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize. It does not have to be the actual name of a route resource
+ but it cannot be renamed.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of spec.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize. It must be a real namespace. Using an actual namespace
+ ensures that no two components will conflict and the same component can be installed multiple times.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of spec.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ relatedObjects:
+ description: relatedObjects is a list of resources which are
+ useful when debugging or inspecting how spec.componentRoutes
+ is applied.
+ items:
+ description: ObjectReference contains enough information to
+ let you inspect or modify the referred object.
+ properties:
+ group:
+ description: group of the referent.
+ type: string
+ name:
+ description: name of the referent.
+ type: string
+ namespace:
+ description: namespace of the referent.
+ type: string
+ resource:
+ description: resource of the referent.
+ type: string
+ required:
+ - group
+ - name
+ - resource
+ type: object
+ minItems: 1
+ type: array
+ required:
+ - defaultHostname
+ - name
+ - namespace
+ - relatedObjects
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ defaultPlacement:
+ description: |-
+ defaultPlacement is set at installation time to control which
+ nodes will host the ingress router pods by default. The options are
+ control-plane nodes or worker nodes.
+
+ This field works by dictating how the Cluster Ingress Operator will
+ consider unset replicas and nodePlacement fields in IngressController
+ resources when creating the corresponding Deployments.
+
+ See the documentation for the IngressController replicas and nodePlacement
+ fields for more information.
+
+ When omitted, the default value is Workers
+ enum:
+ - ControlPlane
+ - Workers
+ - ""
+ type: string
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses.crd.yaml
deleted file mode 100644
index 603d58d6d..000000000
--- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses.crd.yaml
+++ /dev/null
@@ -1,543 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.openshift.io: https://github.com/openshift/api/pull/470
- api.openshift.io/merged-by-featuregates: "true"
- include.release.openshift.io/ibm-cloud-managed: "true"
- include.release.openshift.io/self-managed-high-availability: "true"
- release.openshift.io/bootstrap-required: "true"
- name: ingresses.config.openshift.io
-spec:
- group: config.openshift.io
- names:
- kind: Ingress
- listKind: IngressList
- plural: ingresses
- singular: ingress
- scope: Cluster
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Ingress holds cluster-wide information about ingress, including the default ingress domain
- used for routes. The canonical name is `cluster`.
-
- Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: spec holds user settable values for configuration
- properties:
- appsDomain:
- description: |-
- appsDomain is an optional domain to use instead of the one specified
- in the domain field when a Route is created without specifying an explicit
- host. If appsDomain is nonempty, this value is used to generate default
- host values for Route. Unlike domain, appsDomain may be modified after
- installation.
- This assumes a new ingresscontroller has been setup with a wildcard
- certificate.
- type: string
- componentRoutes:
- description: |-
- componentRoutes is an optional list of routes that are managed by OpenShift components
- that a cluster-admin is able to configure the hostname and serving certificate for.
- The namespace and name of each route in this list should match an existing entry in the
- status.componentRoutes list.
-
- To determine the set of configurable Routes, look at namespace and name of entries in the
- .status.componentRoutes list, where participating operators write the status of
- configurable routes.
- items:
- description: ComponentRouteSpec allows for configuration of a route's
- hostname and serving certificate.
- properties:
- hostname:
- description: hostname is the hostname that should be used by
- the route.
- pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
- type: string
- name:
- description: |-
- name is the logical name of the route to customize.
-
- The namespace and name of this componentRoute must match a corresponding
- entry in the list of status.componentRoutes if the route is to be customized.
- maxLength: 256
- minLength: 1
- type: string
- namespace:
- description: |-
- namespace is the namespace of the route to customize.
-
- The namespace and name of this componentRoute must match a corresponding
- entry in the list of status.componentRoutes if the route is to be customized.
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- servingCertKeyPairSecret:
- description: |-
- servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
- The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
- If the custom hostname uses the default routing suffix of the cluster,
- the Secret specification for a serving certificate will not be needed.
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- required:
- - hostname
- - name
- - namespace
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - namespace
- - name
- x-kubernetes-list-type: map
- domain:
- description: |-
- domain is used to generate a default host name for a route when the
- route's host name is empty. The generated host name will follow this
- pattern: "..".
-
- It is also used as the default wildcard domain suffix for ingress. The
- default ingresscontroller domain will follow this pattern: "*.".
-
- Once set, changing domain is not currently supported.
- type: string
- x-kubernetes-validations:
- - message: domain is immutable once set
- rule: self == oldSelf
- loadBalancer:
- description: |-
- loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
- provider of the current cluster and are required for Ingress Controller to work on OpenShift.
- properties:
- platform:
- description: |-
- platform holds configuration specific to the underlying
- infrastructure provider for the ingress load balancers.
- When omitted, this means the user has no opinion and the platform is left
- to choose reasonable defaults. These defaults are subject to change over time.
- properties:
- aws:
- description: aws contains settings specific to the Amazon
- Web Services infrastructure provider.
- properties:
- type:
- description: |-
- type allows user to set a load balancer type.
- When this field is set the default ingresscontroller will get created using the specified LBType.
- If this field is not set then the default ingress controller of LBType Classic will be created.
- Valid values are:
-
- * "Classic": A Classic Load Balancer that makes routing decisions at either
- the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
- the following for additional details:
-
- https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
-
- * "NLB": A Network Load Balancer that makes routing decisions at the
- transport layer (TCP/SSL). See the following for additional details:
-
- https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
- enum:
- - NLB
- - Classic
- type: string
- required:
- - type
- type: object
- type:
- description: |-
- type is the underlying infrastructure provider for the cluster.
- Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
- "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
- "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
- and must handle unrecognized platforms as None if they do not support that platform.
- enum:
- - ""
- - AWS
- - Azure
- - BareMetal
- - GCP
- - Libvirt
- - OpenStack
- - None
- - VSphere
- - oVirt
- - IBMCloud
- - KubeVirt
- - EquinixMetal
- - PowerVS
- - AlibabaCloud
- - Nutanix
- - External
- type: string
- type: object
- type: object
- requiredHSTSPolicies:
- description: |-
- requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
- matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
- Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
- annotation, and affect route admission.
-
- A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
- "haproxy.router.openshift.io/hsts_header"
- E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
-
- - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
- then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
- is rejected.
- - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
- determines the route's admission status.
- - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
- then it may use any HSTS Policy annotation.
-
- The HSTS policy configuration may be changed after routes have already been created. An update to a previously
- admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
- However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
-
- Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
- items:
- properties:
- domainPatterns:
- description: |-
- domainPatterns is a list of domains for which the desired HSTS annotations are required.
- If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
- the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
-
- The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
- foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
- items:
- type: string
- minItems: 1
- type: array
- includeSubDomainsPolicy:
- description: |-
- includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
- domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
- - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
- - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
- - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
- - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
- enum:
- - RequireIncludeSubDomains
- - RequireNoIncludeSubDomains
- - NoOpinion
- type: string
- maxAge:
- description: |-
- maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
- If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
- If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
- maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
- policy will eventually expire on that client.
- properties:
- largestMaxAge:
- description: |-
- The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
- This value can be left unspecified, in which case no upper limit is enforced.
- format: int32
- maximum: 2147483647
- minimum: 0
- type: integer
- smallestMaxAge:
- description: |-
- The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
- Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
- tool for administrators to quickly correct mistakes.
- This value can be left unspecified, in which case no lower limit is enforced.
- format: int32
- maximum: 2147483647
- minimum: 0
- type: integer
- type: object
- namespaceSelector:
- description: |-
- namespaceSelector specifies a label selector such that the policy applies only to those routes that
- are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
- Defaults to the empty LabelSelector, which matches everything.
- properties:
- matchExpressions:
- description: matchExpressions is a list of label selector
- requirements. The requirements are ANDed.
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- properties:
- key:
- description: key is the label key that the selector
- applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- items:
- type: string
- type: array
- x-kubernetes-list-type: atomic
- required:
- - key
- - operator
- type: object
- type: array
- x-kubernetes-list-type: atomic
- matchLabels:
- additionalProperties:
- type: string
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- type: object
- x-kubernetes-map-type: atomic
- preloadPolicy:
- description: |-
- preloadPolicy directs the client to include hosts in its host preload list so that
- it never needs to do an initial load to get the HSTS header (note that this is not defined
- in RFC 6797 and is therefore client implementation-dependent).
- enum:
- - RequirePreload
- - RequireNoPreload
- - NoOpinion
- type: string
- required:
- - domainPatterns
- type: object
- type: array
- type: object
- status:
- description: status holds observed values from the cluster. They may not
- be overridden.
- properties:
- componentRoutes:
- description: |-
- componentRoutes is where participating operators place the current route status for routes whose
- hostnames and serving certificates can be customized by the cluster-admin.
- items:
- description: ComponentRouteStatus contains information allowing
- configuration of a route's hostname and serving certificate.
- properties:
- conditions:
- description: |-
- conditions are used to communicate the state of the componentRoutes entry.
-
- Supported conditions include Available, Degraded and Progressing.
-
- If available is true, the content served by the route can be accessed by users. This includes cases
- where a default may continue to serve content while the customized route specified by the cluster-admin
- is being configured.
-
- If Degraded is true, that means something has gone wrong trying to handle the componentRoutes entry.
- The currentHostnames field may or may not be in effect.
-
- If Progressing is true, that means the component is taking some action related to the componentRoutes entry.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- consumingUsers:
- description: consumingUsers is a slice of ServiceAccounts that
- need to have read permission on the servingCertKeyPairSecret
- secret.
- items:
- description: ConsumingUser is an alias for string which we
- add validation to. Currently only service accounts are supported.
- maxLength: 512
- minLength: 1
- pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 5
- type: array
- currentHostnames:
- description: |-
- currentHostnames is the list of current names used by the route. Typically, this list should consist of a single
- hostname, but if multiple hostnames are supported by the route the operator may write multiple entries to this list.
- items:
- description: Hostname is a host name as defined by RFC-1123.
- pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
- type: string
- minItems: 1
- type: array
- defaultHostname:
- description: defaultHostname is the hostname of this route prior
- to customization.
- pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
- type: string
- name:
- description: |-
- name is the logical name of the route to customize. It does not have to be the actual name of a route resource
- but it cannot be renamed.
-
- The namespace and name of this componentRoute must match a corresponding
- entry in the list of spec.componentRoutes if the route is to be customized.
- maxLength: 256
- minLength: 1
- type: string
- namespace:
- description: |-
- namespace is the namespace of the route to customize. It must be a real namespace. Using an actual namespace
- ensures that no two components will conflict and the same component can be installed multiple times.
-
- The namespace and name of this componentRoute must match a corresponding
- entry in the list of spec.componentRoutes if the route is to be customized.
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- relatedObjects:
- description: relatedObjects is a list of resources which are
- useful when debugging or inspecting how spec.componentRoutes
- is applied.
- items:
- description: ObjectReference contains enough information to
- let you inspect or modify the referred object.
- properties:
- group:
- description: group of the referent.
- type: string
- name:
- description: name of the referent.
- type: string
- namespace:
- description: namespace of the referent.
- type: string
- resource:
- description: resource of the referent.
- type: string
- required:
- - group
- - name
- - resource
- type: object
- minItems: 1
- type: array
- required:
- - defaultHostname
- - name
- - namespace
- - relatedObjects
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - namespace
- - name
- x-kubernetes-list-type: map
- defaultPlacement:
- description: |-
- defaultPlacement is set at installation time to control which
- nodes will host the ingress router pods by default. The options are
- control-plane nodes or worker nodes.
-
- This field works by dictating how the Cluster Ingress Operator will
- consider unset replicas and nodePlacement fields in IngressController
- resources when creating the corresponding Deployments.
-
- See the documentation for the IngressController replicas and nodePlacement
- fields for more information.
-
- When omitted, the default value is Workers
- enum:
- - ControlPlane
- - Workers
- - ""
- type: string
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_networks-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_networks-CustomNoUpgrade.crd.yaml
new file mode 100644
index 000000000..0dcaabb04
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_networks-CustomNoUpgrade.crd.yaml
@@ -0,0 +1,470 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: CustomNoUpgrade
+ name: networks.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Network
+ listKind: NetworkList
+ plural: networks
+ singular: network
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Network holds cluster-wide information about Network. The canonical name is `cluster`. It is used to configure the desired network configuration, such as: IP address pools for services/pod IPs, network plugin, etc.
+ Please view network.spec for an explanation on what applies when configuring this resource.
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: |-
+ spec holds user settable values for configuration.
+ As a general rule, this SHOULD NOT be read directly. Instead, you should
+ consume the NetworkStatus, as it indicates the currently deployed configuration.
+ Currently, most spec fields are immutable after installation. Please view the individual ones for further details on each.
+ properties:
+ clusterNetwork:
+ description: |-
+ IP address pool to use for pod IPs.
+ This field is immutable after installation.
+ items:
+ description: |-
+ ClusterNetworkEntry is a contiguous block of IP addresses from which pod IPs
+ are allocated.
+ properties:
+ cidr:
+ description: The complete block for pod IPs.
+ type: string
+ hostPrefix:
+ description: |-
+ The size (prefix) of block to allocate to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalIP:
+ description: |-
+ externalIP defines configuration for controllers that
+ affect Service.ExternalIP. If nil, then ExternalIP is
+ not allowed to be set.
+ properties:
+ autoAssignCIDRs:
+ description: |-
+ autoAssignCIDRs is a list of CIDRs from which to automatically assign
+ Service.ExternalIP. These are assigned when the service is of type
+ LoadBalancer. In general, this is only useful for bare-metal clusters.
+ In Openshift 3.x, this was misleadingly called "IngressIPs".
+ Automatically assigned External IPs are not affected by any
+ ExternalIPPolicy rules.
+ Currently, only one entry may be provided.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ policy:
+ description: |-
+ policy is a set of restrictions applied to the ExternalIP field.
+ If nil or empty, then ExternalIP is not allowed to be set.
+ properties:
+ allowedCIDRs:
+ description: allowedCIDRs is the list of allowed CIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ rejectedCIDRs:
+ description: |-
+ rejectedCIDRs is the list of disallowed CIDRs. These take precedence
+ over allowedCIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkDiagnostics:
+ description: |-
+ networkDiagnostics defines network diagnostics configuration.
+
+ Takes precedence over spec.disableNetworkDiagnostics in network.operator.openshift.io.
+ If networkDiagnostics is not specified or is empty,
+ and the spec.disableNetworkDiagnostics flag in network.operator.openshift.io is set to true,
+ the network diagnostics feature will be disabled.
+ properties:
+ mode:
+ description: |-
+ mode controls the network diagnostics mode
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is All.
+ enum:
+ - ""
+ - All
+ - Disabled
+ type: string
+ sourcePlacement:
+ description: |-
+ sourcePlacement controls the scheduling of network diagnostics source deployment
+
+ See NetworkDiagnosticsSourcePlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is an empty list.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ targetPlacement:
+ description: |-
+ targetPlacement controls the scheduling of network diagnostics target daemonset
+
+ See NetworkDiagnosticsTargetPlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `- operator: "Exists"` which means that all taints are tolerated.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkObservability:
+ description: |-
+ networkObservability is an optional field that configures network observability installation
+ during cluster deployment (day-0).
+ When omitted, unless this is a SNO cluster, network observability will be installed if not already present, after that, no action taken.
+ properties:
+ installationPolicy:
+ description: |-
+ installationPolicy controls whether network observability is installed during cluster deployment.
+ Valid values are "InstallAndEnable" and "NoAction".
+ When set to "InstallAndEnable", ensure that network observability will be installed and enabled on the cluster. If already installed, no action taken, but if it gets uninstalled, it will install it again.
+ When set to "NoAction", nothing will be done regarding Network observability.
+ During the installation of NetworkObservability, the platform checks for any existing manual installations.
+ If a successful installation using the OLMv0 or OLMv1 API is detected, it will be used.
+ If the platform cannot determine how the current version was installed, or if the existing installation is incomplete, the installation process will stop.
+ enum:
+ - InstallAndEnable
+ - NoAction
+ type: string
+ required:
+ - installationPolicy
+ type: object
+ networkType:
+ description: |-
+ networkType is the plugin that is to be deployed (e.g. OVNKubernetes).
+ This should match a value that the cluster-network-operator understands,
+ or else no networking will be installed.
+ Currently supported values are:
+ - OVNKubernetes
+ This field is immutable after installation.
+ type: string
+ serviceNetwork:
+ description: |-
+ IP address pool for services.
+ Currently, we only support a single entry here.
+ This field is immutable after installation.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceNodePortRange:
+ description: |-
+ The port range allowed for Services of type NodePort.
+ If not specified, the default of 30000-32767 will be used.
+ Such Services without a NodePort specified will have one
+ automatically allocated from this range.
+ This parameter can be updated after the cluster is
+ installed.
+ pattern: ^([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])-([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot set networkDiagnostics.sourcePlacement and networkDiagnostics.targetPlacement
+ when networkDiagnostics.mode is Disabled
+ rule: '!has(self.networkDiagnostics) || !has(self.networkDiagnostics.mode)
+ || self.networkDiagnostics.mode!=''Disabled'' || !has(self.networkDiagnostics.sourcePlacement)
+ && !has(self.networkDiagnostics.targetPlacement)'
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ clusterNetwork:
+ description: IP address pool to use for pod IPs.
+ items:
+ description: |-
+ ClusterNetworkEntry is a contiguous block of IP addresses from which pod IPs
+ are allocated.
+ properties:
+ cidr:
+ description: The complete block for pod IPs.
+ type: string
+ hostPrefix:
+ description: |-
+ The size (prefix) of block to allocate to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ clusterNetworkMTU:
+ description: clusterNetworkMTU is the MTU for inter-pod networking.
+ type: integer
+ conditions:
+ description: |-
+ conditions represents the observations of a network.config current state.
+ Known .status.conditions.type are: "NetworkDiagnosticsAvailable"
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ migration:
+ description: migration contains the cluster network migration configuration.
+ properties:
+ mtu:
+ description: mtu is the MTU configuration that is being deployed.
+ properties:
+ machine:
+ description: machine contains MTU migration configuration
+ for the machine's uplink.
+ properties:
+ from:
+ description: from is the MTU to migrate from.
+ format: int32
+ minimum: 0
+ type: integer
+ to:
+ description: to is the MTU to migrate to.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ network:
+ description: network contains MTU migration configuration
+ for the default network.
+ properties:
+ from:
+ description: from is the MTU to migrate from.
+ format: int32
+ minimum: 0
+ type: integer
+ to:
+ description: to is the MTU to migrate to.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: object
+ networkType:
+ description: |-
+ networkType is the target plugin that is being deployed.
+ DEPRECATED: network type migration is no longer supported,
+ so this should always be unset.
+ type: string
+ type: object
+ networkType:
+ description: networkType is the plugin that is deployed (e.g. OVNKubernetes).
+ type: string
+ serviceNetwork:
+ description: |-
+ IP address pool for services.
+ Currently, we only support a single entry here.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_networks-Default.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_networks-Default.crd.yaml
new file mode 100644
index 000000000..df36e5ec7
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_networks-Default.crd.yaml
@@ -0,0 +1,448 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: Default
+ name: networks.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Network
+ listKind: NetworkList
+ plural: networks
+ singular: network
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Network holds cluster-wide information about Network. The canonical name is `cluster`. It is used to configure the desired network configuration, such as: IP address pools for services/pod IPs, network plugin, etc.
+ Please view network.spec for an explanation on what applies when configuring this resource.
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: |-
+ spec holds user settable values for configuration.
+ As a general rule, this SHOULD NOT be read directly. Instead, you should
+ consume the NetworkStatus, as it indicates the currently deployed configuration.
+ Currently, most spec fields are immutable after installation. Please view the individual ones for further details on each.
+ properties:
+ clusterNetwork:
+ description: |-
+ IP address pool to use for pod IPs.
+ This field is immutable after installation.
+ items:
+ description: |-
+ ClusterNetworkEntry is a contiguous block of IP addresses from which pod IPs
+ are allocated.
+ properties:
+ cidr:
+ description: The complete block for pod IPs.
+ type: string
+ hostPrefix:
+ description: |-
+ The size (prefix) of block to allocate to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalIP:
+ description: |-
+ externalIP defines configuration for controllers that
+ affect Service.ExternalIP. If nil, then ExternalIP is
+ not allowed to be set.
+ properties:
+ autoAssignCIDRs:
+ description: |-
+ autoAssignCIDRs is a list of CIDRs from which to automatically assign
+ Service.ExternalIP. These are assigned when the service is of type
+ LoadBalancer. In general, this is only useful for bare-metal clusters.
+ In Openshift 3.x, this was misleadingly called "IngressIPs".
+ Automatically assigned External IPs are not affected by any
+ ExternalIPPolicy rules.
+ Currently, only one entry may be provided.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ policy:
+ description: |-
+ policy is a set of restrictions applied to the ExternalIP field.
+ If nil or empty, then ExternalIP is not allowed to be set.
+ properties:
+ allowedCIDRs:
+ description: allowedCIDRs is the list of allowed CIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ rejectedCIDRs:
+ description: |-
+ rejectedCIDRs is the list of disallowed CIDRs. These take precedence
+ over allowedCIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkDiagnostics:
+ description: |-
+ networkDiagnostics defines network diagnostics configuration.
+
+ Takes precedence over spec.disableNetworkDiagnostics in network.operator.openshift.io.
+ If networkDiagnostics is not specified or is empty,
+ and the spec.disableNetworkDiagnostics flag in network.operator.openshift.io is set to true,
+ the network diagnostics feature will be disabled.
+ properties:
+ mode:
+ description: |-
+ mode controls the network diagnostics mode
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is All.
+ enum:
+ - ""
+ - All
+ - Disabled
+ type: string
+ sourcePlacement:
+ description: |-
+ sourcePlacement controls the scheduling of network diagnostics source deployment
+
+ See NetworkDiagnosticsSourcePlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is an empty list.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ targetPlacement:
+ description: |-
+ targetPlacement controls the scheduling of network diagnostics target daemonset
+
+ See NetworkDiagnosticsTargetPlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `- operator: "Exists"` which means that all taints are tolerated.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkType:
+ description: |-
+ networkType is the plugin that is to be deployed (e.g. OVNKubernetes).
+ This should match a value that the cluster-network-operator understands,
+ or else no networking will be installed.
+ Currently supported values are:
+ - OVNKubernetes
+ This field is immutable after installation.
+ type: string
+ serviceNetwork:
+ description: |-
+ IP address pool for services.
+ Currently, we only support a single entry here.
+ This field is immutable after installation.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceNodePortRange:
+ description: |-
+ The port range allowed for Services of type NodePort.
+ If not specified, the default of 30000-32767 will be used.
+ Such Services without a NodePort specified will have one
+ automatically allocated from this range.
+ This parameter can be updated after the cluster is
+ installed.
+ pattern: ^([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])-([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot set networkDiagnostics.sourcePlacement and networkDiagnostics.targetPlacement
+ when networkDiagnostics.mode is Disabled
+ rule: '!has(self.networkDiagnostics) || !has(self.networkDiagnostics.mode)
+ || self.networkDiagnostics.mode!=''Disabled'' || !has(self.networkDiagnostics.sourcePlacement)
+ && !has(self.networkDiagnostics.targetPlacement)'
+ status:
+ description: status holds observed values from the cluster. They may not
+ be overridden.
+ properties:
+ clusterNetwork:
+ description: IP address pool to use for pod IPs.
+ items:
+ description: |-
+ ClusterNetworkEntry is a contiguous block of IP addresses from which pod IPs
+ are allocated.
+ properties:
+ cidr:
+ description: The complete block for pod IPs.
+ type: string
+ hostPrefix:
+ description: |-
+ The size (prefix) of block to allocate to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ clusterNetworkMTU:
+ description: clusterNetworkMTU is the MTU for inter-pod networking.
+ type: integer
+ conditions:
+ description: |-
+ conditions represents the observations of a network.config current state.
+ Known .status.conditions.type are: "NetworkDiagnosticsAvailable"
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ migration:
+ description: migration contains the cluster network migration configuration.
+ properties:
+ mtu:
+ description: mtu is the MTU configuration that is being deployed.
+ properties:
+ machine:
+ description: machine contains MTU migration configuration
+ for the machine's uplink.
+ properties:
+ from:
+ description: from is the MTU to migrate from.
+ format: int32
+ minimum: 0
+ type: integer
+ to:
+ description: to is the MTU to migrate to.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ network:
+ description: network contains MTU migration configuration
+ for the default network.
+ properties:
+ from:
+ description: from is the MTU to migrate from.
+ format: int32
+ minimum: 0
+ type: integer
+ to:
+ description: to is the MTU to migrate to.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: object
+ networkType:
+ description: |-
+ networkType is the target plugin that is being deployed.
+ DEPRECATED: network type migration is no longer supported,
+ so this should always be unset.
+ type: string
+ type: object
+ networkType:
+ description: networkType is the plugin that is deployed (e.g. OVNKubernetes).
+ type: string
+ serviceNetwork:
+ description: |-
+ IP address pool for services.
+ Currently, we only support a single entry here.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_networks-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_networks-DevPreviewNoUpgrade.crd.yaml
new file mode 100644
index 000000000..8fa80a904
--- /dev/null
+++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_networks-DevPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,470 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api-approved.openshift.io: https://github.com/openshift/api/pull/470
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/bootstrap-required: "true"
+ release.openshift.io/feature-set: DevPreviewNoUpgrade
+ name: networks.config.openshift.io
+spec:
+ group: config.openshift.io
+ names:
+ kind: Network
+ listKind: NetworkList
+ plural: networks
+ singular: network
+ scope: Cluster
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Network holds cluster-wide information about Network. The canonical name is `cluster`. It is used to configure the desired network configuration, such as: IP address pools for services/pod IPs, network plugin, etc.
+ Please view network.spec for an explanation on what applies when configuring this resource.
+
+ Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: |-
+ spec holds user settable values for configuration.
+ As a general rule, this SHOULD NOT be read directly. Instead, you should
+ consume the NetworkStatus, as it indicates the currently deployed configuration.
+ Currently, most spec fields are immutable after installation. Please view the individual ones for further details on each.
+ properties:
+ clusterNetwork:
+ description: |-
+ IP address pool to use for pod IPs.
+ This field is immutable after installation.
+ items:
+ description: |-
+ ClusterNetworkEntry is a contiguous block of IP addresses from which pod IPs
+ are allocated.
+ properties:
+ cidr:
+ description: The complete block for pod IPs.
+ type: string
+ hostPrefix:
+ description: |-
+ The size (prefix) of block to allocate to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalIP:
+ description: |-
+ externalIP defines configuration for controllers that
+ affect Service.ExternalIP. If nil, then ExternalIP is
+ not allowed to be set.
+ properties:
+ autoAssignCIDRs:
+ description: |-
+ autoAssignCIDRs is a list of CIDRs from which to automatically assign
+ Service.ExternalIP. These are assigned when the service is of type
+ LoadBalancer. In general, this is only useful for bare-metal clusters.
+ In Openshift 3.x, this was misleadingly called "IngressIPs".
+ Automatically assigned External IPs are not affected by any
+ ExternalIPPolicy rules.
+ Currently, only one entry may be provided.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ policy:
+ description: |-
+ policy is a set of restrictions applied to the ExternalIP field.
+ If nil or empty, then ExternalIP is not allowed to be set.
+ properties:
+ allowedCIDRs:
+ description: allowedCIDRs is the list of allowed CIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ rejectedCIDRs:
+ description: |-
+ rejectedCIDRs is the list of disallowed CIDRs. These take precedence
+ over allowedCIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkDiagnostics:
+ description: |-
+ networkDiagnostics defines network diagnostics configuration.
+
+ Takes precedence over spec.disableNetworkDiagnostics in network.operator.openshift.io.
+ If networkDiagnostics is not specified or is empty,
+ and the spec.disableNetworkDiagnostics flag in network.operator.openshift.io is set to true,
+ the network diagnostics feature will be disabled.
+ properties:
+ mode:
+ description: |-
+ mode controls the network diagnostics mode
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is All.
+ enum:
+ - ""
+ - All
+ - Disabled
+ type: string
+ sourcePlacement:
+ description: |-
+ sourcePlacement controls the scheduling of network diagnostics source deployment
+
+ See NetworkDiagnosticsSourcePlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is an empty list.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ targetPlacement:
+ description: |-
+ targetPlacement controls the scheduling of network diagnostics target daemonset
+
+ See NetworkDiagnosticsTargetPlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `- operator: "Exists"` which means that all taints are tolerated.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator