diff --git a/api/hypershift/v1beta1/kubevirt.go b/api/hypershift/v1beta1/kubevirt.go
index cc83e14d45b..90fa6284f29 100644
--- a/api/hypershift/v1beta1/kubevirt.go
+++ b/api/hypershift/v1beta1/kubevirt.go
@@ -191,6 +191,13 @@ type KubevirtNodePoolPlatform struct {
// +optional
// +kubebuilder:validation:MaxItems=10
KubevirtHostDevices []KubevirtHostDevice `json:"hostDevices,omitempty"`
+
+ // networkData is inline cloud-init network data configuration for VMs in this NodePool.
+ // When specified, cloud-init volume changes from ConfigDrive to NoCloud.
+ // This allows for static network configuration of VMs.
+ // +kubebuilder:validation:MaxLength=2048
+ // +optional
+ NetworkData *string `json:"networkData,omitempty"`
}
// KubevirtNetwork specifies the configuration for a virtual machine
diff --git a/api/hypershift/v1beta1/zz_generated.deepcopy.go b/api/hypershift/v1beta1/zz_generated.deepcopy.go
index 7681b2a70ae..a4693d4844a 100644
--- a/api/hypershift/v1beta1/zz_generated.deepcopy.go
+++ b/api/hypershift/v1beta1/zz_generated.deepcopy.go
@@ -2503,6 +2503,11 @@ func (in *KubevirtNodePoolPlatform) DeepCopyInto(out *KubevirtNodePoolPlatform)
*out = make([]KubevirtHostDevice, len(*in))
copy(*out, *in)
}
+ if in.NetworkData != nil {
+ in, out := &in.NetworkData, &out.NetworkData
+ *out = new(string)
+ **out = **in
+ }
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubevirtNodePoolPlatform.
diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml
index 827dabc92c9..73385236cec 100644
--- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml
+++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/AAA_ungated.yaml
@@ -1102,6 +1102,13 @@ spec:
type: object
maxItems: 10
type: array
+ networkData:
+ description: |-
+ networkData is inline cloud-init network data configuration for VMs in this NodePool.
+ When specified, cloud-init volume changes from ConfigDrive to NoCloud.
+ This allows for static network configuration of VMs.
+ maxLength: 2048
+ type: string
networkInterfaceMultiqueue:
default: Enable
description: |-
diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml
index d81a25de166..3fa2427c71f 100644
--- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml
+++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/nodepools.hypershift.openshift.io/OpenStack.yaml
@@ -1102,6 +1102,13 @@ spec:
type: object
maxItems: 10
type: array
+ networkData:
+ description: |-
+ networkData is inline cloud-init network data configuration for VMs in this NodePool.
+ When specified, cloud-init volume changes from ConfigDrive to NoCloud.
+ This allows for static network configuration of VMs.
+ maxLength: 2048
+ type: string
networkInterfaceMultiqueue:
default: Enable
description: |-
diff --git a/client/applyconfiguration/hypershift/v1beta1/kubevirtnodepoolplatform.go b/client/applyconfiguration/hypershift/v1beta1/kubevirtnodepoolplatform.go
index c9648d9b988..64e6ecc1e09 100644
--- a/client/applyconfiguration/hypershift/v1beta1/kubevirtnodepoolplatform.go
+++ b/client/applyconfiguration/hypershift/v1beta1/kubevirtnodepoolplatform.go
@@ -31,6 +31,7 @@ type KubevirtNodePoolPlatformApplyConfiguration struct {
AttachDefaultNetwork *bool `json:"attachDefaultNetwork,omitempty"`
NodeSelector map[string]string `json:"nodeSelector,omitempty"`
KubevirtHostDevices []KubevirtHostDeviceApplyConfiguration `json:"hostDevices,omitempty"`
+ NetworkData *string `json:"networkData,omitempty"`
}
// KubevirtNodePoolPlatformApplyConfiguration constructs a declarative configuration of the KubevirtNodePoolPlatform type for use with
@@ -110,3 +111,11 @@ func (b *KubevirtNodePoolPlatformApplyConfiguration) WithKubevirtHostDevices(val
}
return b
}
+
+// WithNetworkData sets the NetworkData field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NetworkData field is set to the value of the last call.
+func (b *KubevirtNodePoolPlatformApplyConfiguration) WithNetworkData(value string) *KubevirtNodePoolPlatformApplyConfiguration {
+ b.NetworkData = &value
+ return b
+}
diff --git a/cmd/install/assets/cluster-api-provider-kubevirt/infrastructure.cluster.x-k8s.io_kubevirtmachines.yaml b/cmd/install/assets/cluster-api-provider-kubevirt/infrastructure.cluster.x-k8s.io_kubevirtmachines.yaml
index 2f1256d8d4b..689010dd158 100644
--- a/cmd/install/assets/cluster-api-provider-kubevirt/infrastructure.cluster.x-k8s.io_kubevirtmachines.yaml
+++ b/cmd/install/assets/cluster-api-provider-kubevirt/infrastructure.cluster.x-k8s.io_kubevirtmachines.yaml
@@ -94,6 +94,11 @@ spec:
type: string
type: object
x-kubernetes-map-type: atomic
+ networkData:
+ description: |-
+ NetworkData contains inline cloud-init network data configuration.
+ When specified, the cloud-init volume will use NoCloud instead of ConfigDrive.
+ type: string
providerID:
description: ProviderID TBD what to use for Kubevirt
type: string
diff --git a/cmd/install/assets/cluster-api-provider-kubevirt/infrastructure.cluster.x-k8s.io_kubevirtmachinetemplates.yaml b/cmd/install/assets/cluster-api-provider-kubevirt/infrastructure.cluster.x-k8s.io_kubevirtmachinetemplates.yaml
index 1fe9b1d9f00..a56e1846ab0 100644
--- a/cmd/install/assets/cluster-api-provider-kubevirt/infrastructure.cluster.x-k8s.io_kubevirtmachinetemplates.yaml
+++ b/cmd/install/assets/cluster-api-provider-kubevirt/infrastructure.cluster.x-k8s.io_kubevirtmachinetemplates.yaml
@@ -96,6 +96,11 @@ spec:
type: string
type: object
x-kubernetes-map-type: atomic
+ networkData:
+ description: |-
+ NetworkData contains inline cloud-init network data configuration.
+ When specified, the cloud-init volume will use NoCloud instead of ConfigDrive.
+ type: string
providerID:
description: ProviderID TBD what to use for Kubevirt
type: string
diff --git a/cmd/install/assets/hypershift-operator/awsendpointservices.crd.yaml b/cmd/install/assets/hypershift-operator/awsendpointservices.crd.yaml
new file mode 100644
index 00000000000..8e0e39ac93b
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/awsendpointservices.crd.yaml
@@ -0,0 +1,194 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ name: awsendpointservices.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ kind: AWSEndpointService
+ listKind: AWSEndpointServiceList
+ plural: awsendpointservices
+ singular: awsendpointservice
+ scope: Namespaced
+ versions:
+ - name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: AWSEndpointService specifies a request for an Endpoint Service
+ in AWS
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the specification for the AWSEndpointService.
+ properties:
+ networkLoadBalancerName:
+ description: |-
+ networkLoadBalancerName is the name of the NLB for which an Endpoint Service should be configured
+ NetworkLoadBalancerName is the name of the network load balancer.
+ maxLength: 255
+ type: string
+ resourceTags:
+ description: resourceTags is the list of tags to apply to the EndpointService
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources created
+ for the cluster.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ value:
+ description: |-
+ value is the value of the tag.
+
+ Some AWS service do not support empty values. Since tags are added to
+ resources in many services, the length of the tag value must meet the
+ requirements of all services.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ subnetIDs:
+ description: subnetIDs is the list of subnet IDs to which guest nodes
+ can attach
+ items:
+ maxLength: 63
+ type: string
+ maxItems: 10
+ type: array
+ required:
+ - networkLoadBalancerName
+ type: object
+ status:
+ description: status is the status of the AWSEndpointService.
+ properties:
+ conditions:
+ description: |-
+ conditions contains details for the current state of the Endpoint Service
+ request If there is an error processing the request e.g. the NLB doesn't
+ exist, then the Available condition will be false, reason AWSErrorReason,
+ and the error reported in the message.
+
+ Current condition types are: "Available"
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 10
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ dnsNames:
+ description: dnsNames are the names for the records created in the
+ hypershift private zone
+ items:
+ maxLength: 253
+ type: string
+ maxItems: 10
+ type: array
+ dnsZoneID:
+ description: dnsZoneID is ID for the hypershift private zone
+ maxLength: 255
+ type: string
+ endpointID:
+ description: endpointID is the ID of the Endpoint created in the guest
+ VPC
+ maxLength: 255
+ type: string
+ endpointServiceName:
+ description: |-
+ endpointServiceName is the name of the Endpoint Service created in the
+ management VPC
+ maxLength: 255
+ type: string
+ securityGroupID:
+ description: |-
+ securityGroupID is the ID for the VPC endpoint SecurityGroup
+ SecurityGroupID is the ID of the security group.
+ maxLength: 255
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/certificatesigningrequestapprovals.crd.yaml b/cmd/install/assets/hypershift-operator/certificatesigningrequestapprovals.crd.yaml
new file mode 100644
index 00000000000..12d9e60c3ad
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/certificatesigningrequestapprovals.crd.yaml
@@ -0,0 +1,53 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ name: certificatesigningrequestapprovals.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ kind: CertificateSigningRequestApproval
+ listKind: CertificateSigningRequestApprovalList
+ plural: certificatesigningrequestapprovals
+ shortNames:
+ - csra
+ - csras
+ singular: certificatesigningrequestapproval
+ scope: Namespaced
+ versions:
+ - name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: CertificateSigningRequestApproval defines the desired state of
+ CertificateSigningRequestApproval
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the specification of the desired behavior of the
+ CertificateSigningRequestApproval.
+ type: object
+ status:
+ description: status is the most recently observed status of the CertificateSigningRequestApproval.
+ type: object
+ type: object
+ served: true
+ storage: true
diff --git a/cmd/install/assets/hypershift-operator/controlplanecomponents.crd.yaml b/cmd/install/assets/hypershift-operator/controlplanecomponents.crd.yaml
new file mode 100644
index 00000000000..f164c80c10d
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/controlplanecomponents.crd.yaml
@@ -0,0 +1,171 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ name: controlplanecomponents.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ kind: ControlPlaneComponent
+ listKind: ControlPlaneComponentList
+ plural: controlplanecomponents
+ shortNames:
+ - cpc
+ - cpcs
+ singular: controlplanecomponent
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: Version
+ jsonPath: .status.version
+ name: Version
+ type: string
+ - description: Available
+ jsonPath: .status.conditions[?(@.type=="Available")].status
+ name: Available
+ type: string
+ - description: Progressing
+ jsonPath: .status.conditions[?(@.type=="Progressing")].status
+ name: Progressing
+ type: string
+ - description: Message
+ jsonPath: .status.conditions[?(@.type=="Available")].message
+ name: Message
+ type: string
+ - description: ProgressingMessage
+ jsonPath: .status.conditions[?(@.type=="Progressing")].message
+ name: ProgressingMessage
+ priority: 1
+ type: string
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: ControlPlaneComponent specifies the state of a ControlPlane Component
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the specification for the ControlPlaneComponent.
+ type: object
+ status:
+ description: status is the status of the ControlPlaneComponent.
+ properties:
+ conditions:
+ description: |-
+ conditions contains details for the current state of the ControlPlane Component.
+ If there is an error, then the Available condition will be false.
+
+ Current condition types are: "Available"
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 10
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ resources:
+ description: resources is a list of the resources reconciled by this
+ component.
+ items:
+ description: ComponentResource defines a resource reconciled by
+ a ControlPlaneComponent.
+ properties:
+ group:
+ description: group is the API group for this resource type.
+ maxLength: 255
+ type: string
+ kind:
+ description: kind is the name of the resource schema.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of this resource.
+ maxLength: 255
+ type: string
+ required:
+ - group
+ - kind
+ - name
+ type: object
+ maxItems: 100
+ type: array
+ version:
+ description: version reports the current version of this component.
+ maxLength: 255
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/doc.go b/cmd/install/assets/hypershift-operator/doc.go
new file mode 100644
index 00000000000..a4a42ea8803
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/doc.go
@@ -0,0 +1 @@
+package hypershift_v1beta1_crdmanifests
diff --git a/cmd/install/assets/hypershift-operator/gcpprivateserviceconnects-CustomNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/gcpprivateserviceconnects-CustomNoUpgrade.crd.yaml
new file mode 100644
index 00000000000..74ba1c98b1f
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/gcpprivateserviceconnects-CustomNoUpgrade.crd.yaml
@@ -0,0 +1,192 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: CustomNoUpgrade
+ name: gcpprivateserviceconnects.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ kind: GCPPrivateServiceConnect
+ listKind: GCPPrivateServiceConnectList
+ plural: gcpprivateserviceconnects
+ shortNames:
+ - gcppsc
+ singular: gcpprivateserviceconnect
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: Name of the Service Attachment
+ jsonPath: .status.serviceAttachmentName
+ name: Service Attachment
+ type: string
+ - description: IP address of the PSC endpoint
+ jsonPath: .status.endpointIP
+ name: Endpoint IP
+ type: string
+ - description: Overall PSC availability status
+ jsonPath: .status.conditions[?(@.type=="GCPPrivateServiceConnectAvailable")].status
+ name: Available
+ type: string
+ - jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ GCPPrivateServiceConnect represents GCP Private Service Connect infrastructure.
+ This resource is feature-gated behind the GCPPlatform feature gate.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the specification for the GCPPrivateServiceConnect.
+ properties:
+ consumerAcceptList:
+ description: |-
+ consumerAcceptList specifies which customer projects can connect
+ Accepts both project IDs (e.g. "my-project-123") and project numbers (e.g. "123456789012")
+ items:
+ maxLength: 30
+ pattern: ^([a-z][a-z0-9-]{4,28}[a-z0-9]|[0-9]{6,12})$
+ type: string
+ maxItems: 50
+ minItems: 1
+ type: array
+ forwardingRuleName:
+ description: forwardingRuleName is the name of the Internal Load Balancer
+ forwarding rule
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ natSubnet:
+ description: |-
+ natSubnet is the subnet used for NAT by the Service Attachment
+ Auto-populated by the HyperShift Operator
+ maxLength: 63
+ pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - consumerAcceptList
+ - forwardingRuleName
+ type: object
+ status:
+ description: status is the status of the GCPPrivateServiceConnect.
+ properties:
+ conditions:
+ description: |-
+ conditions represent the current state of PSC infrastructure
+ Current condition types are: "GCPPrivateServiceConnectAvailable", "GCPServiceAttachmentAvailable", "GCPEndpointAvailable", "GCPDNSAvailable"
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 10
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ dnsRecords:
+ description: dnsRecords lists the created DNS A records
+ items:
+ maxLength: 253
+ type: string
+ maxItems: 10
+ type: array
+ dnsZoneName:
+ description: dnsZoneName is the private DNS zone name
+ maxLength: 253
+ type: string
+ endpointIP:
+ description: endpointIP is the reserved IP address for the PSC endpoint
+ maxLength: 15
+ pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
+ type: string
+ serviceAttachmentName:
+ description: serviceAttachmentName is the name of the created Service
+ Attachment
+ maxLength: 63
+ type: string
+ serviceAttachmentURI:
+ description: |-
+ serviceAttachmentURI is the URI customers use to connect
+ Format: projects/{project}/regions/{region}/serviceAttachments/{name}
+ maxLength: 2048
+ pattern: ^projects/[a-z][a-z0-9-]{4,28}[a-z0-9]/regions/[a-z]+-[a-z0-9]+[0-9]/serviceAttachments/[a-z]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/gcpprivateserviceconnects-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/gcpprivateserviceconnects-TechPreviewNoUpgrade.crd.yaml
new file mode 100644
index 00000000000..6b581641bb0
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/gcpprivateserviceconnects-TechPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,192 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: TechPreviewNoUpgrade
+ name: gcpprivateserviceconnects.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ kind: GCPPrivateServiceConnect
+ listKind: GCPPrivateServiceConnectList
+ plural: gcpprivateserviceconnects
+ shortNames:
+ - gcppsc
+ singular: gcpprivateserviceconnect
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: Name of the Service Attachment
+ jsonPath: .status.serviceAttachmentName
+ name: Service Attachment
+ type: string
+ - description: IP address of the PSC endpoint
+ jsonPath: .status.endpointIP
+ name: Endpoint IP
+ type: string
+ - description: Overall PSC availability status
+ jsonPath: .status.conditions[?(@.type=="GCPPrivateServiceConnectAvailable")].status
+ name: Available
+ type: string
+ - jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ GCPPrivateServiceConnect represents GCP Private Service Connect infrastructure.
+ This resource is feature-gated behind the GCPPlatform feature gate.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the specification for the GCPPrivateServiceConnect.
+ properties:
+ consumerAcceptList:
+ description: |-
+ consumerAcceptList specifies which customer projects can connect
+ Accepts both project IDs (e.g. "my-project-123") and project numbers (e.g. "123456789012")
+ items:
+ maxLength: 30
+ pattern: ^([a-z][a-z0-9-]{4,28}[a-z0-9]|[0-9]{6,12})$
+ type: string
+ maxItems: 50
+ minItems: 1
+ type: array
+ forwardingRuleName:
+ description: forwardingRuleName is the name of the Internal Load Balancer
+ forwarding rule
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ natSubnet:
+ description: |-
+ natSubnet is the subnet used for NAT by the Service Attachment
+ Auto-populated by the HyperShift Operator
+ maxLength: 63
+ pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - consumerAcceptList
+ - forwardingRuleName
+ type: object
+ status:
+ description: status is the status of the GCPPrivateServiceConnect.
+ properties:
+ conditions:
+ description: |-
+ conditions represent the current state of PSC infrastructure
+ Current condition types are: "GCPPrivateServiceConnectAvailable", "GCPServiceAttachmentAvailable", "GCPEndpointAvailable", "GCPDNSAvailable"
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 10
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ dnsRecords:
+ description: dnsRecords lists the created DNS A records
+ items:
+ maxLength: 253
+ type: string
+ maxItems: 10
+ type: array
+ dnsZoneName:
+ description: dnsZoneName is the private DNS zone name
+ maxLength: 253
+ type: string
+ endpointIP:
+ description: endpointIP is the reserved IP address for the PSC endpoint
+ maxLength: 15
+ pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
+ type: string
+ serviceAttachmentName:
+ description: serviceAttachmentName is the name of the created Service
+ Attachment
+ maxLength: 63
+ type: string
+ serviceAttachmentURI:
+ description: |-
+ serviceAttachmentURI is the URI customers use to connect
+ Format: projects/{project}/regions/{region}/serviceAttachments/{name}
+ maxLength: 2048
+ pattern: ^projects/[a-z][a-z0-9-]{4,28}[a-z0-9]/regions/[a-z]+-[a-z0-9]+[0-9]/serviceAttachments/[a-z]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/hostedclusters-CustomNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/hostedclusters-CustomNoUpgrade.crd.yaml
new file mode 100644
index 00000000000..ef0dde5874f
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/hostedclusters-CustomNoUpgrade.crd.yaml
@@ -0,0 +1,8230 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: CustomNoUpgrade
+ name: hostedclusters.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ kind: HostedCluster
+ listKind: HostedClusterList
+ plural: hostedclusters
+ shortNames:
+ - hc
+ - hcs
+ singular: hostedcluster
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: Version
+ jsonPath: .status.version.history[?(@.state=="Completed")].version
+ name: Version
+ type: string
+ - description: KubeConfig Secret
+ jsonPath: .status.kubeconfig.name
+ name: KubeConfig
+ type: string
+ - description: Progress
+ jsonPath: .status.version.history[?(@.state!="")].state
+ name: Progress
+ type: string
+ - description: Available
+ jsonPath: .status.conditions[?(@.type=="Available")].status
+ name: Available
+ type: string
+ - description: Progressing
+ jsonPath: .status.conditions[?(@.type=="Progressing")].status
+ name: Progressing
+ type: string
+ - description: Message
+ jsonPath: .status.conditions[?(@.type=="Available")].message
+ name: Message
+ type: string
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ HostedCluster is the primary representation of a HyperShift cluster and encapsulates
+ the control plane and common data plane configuration. Creating a HostedCluster
+ results in a fully functional OpenShift control plane with no attached nodes.
+ To support workloads (e.g. pods), a HostedCluster may have one or more associated
+ NodePool resources.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the desired behavior of the HostedCluster.
+ properties:
+ additionalTrustBundle:
+ description: |-
+ additionalTrustBundle is a local reference to a ConfigMap that must have a "ca-bundle.crt" key
+ whose content must be a PEM-encoded X.509 certificate bundle that will be added to the hosted controlplane and nodes
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ This will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ auditWebhook:
+ description: |-
+ auditWebhook contains metadata for configuring an audit webhook endpoint
+ for a cluster to process cluster audit events. It references a secret that
+ contains the webhook information for the audit webhook endpoint. It is a
+ secret because if the endpoint has mTLS the kubeconfig will contain client
+ keys. The kubeconfig needs to be stored in the secret with a secret key
+ name that corresponds to the constant AuditWebhookKubeconfigKey.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ autoNode:
+ description: autoNode specifies the configuration for the autoNode
+ feature.
+ properties:
+ provisionerConfig:
+ description: provisionerConfig is the implementation used for
+ Node auto provisioning.
+ properties:
+ karpenter:
+ description: karpenter specifies the configuration for the
+ Karpenter provisioner.
+ properties:
+ aws:
+ description: aws specifies the AWS-specific configuration
+ for Karpenter.
+ properties:
+ roleARN:
+ description: roleARN specifies the ARN of the Karpenter
+ provisioner.
+ maxLength: 255
+ type: string
+ required:
+ - roleARN
+ type: object
+ platform:
+ description: platform specifies the platform-specific
+ configuration for Karpenter.
+ maxLength: 100
+ type: string
+ required:
+ - platform
+ type: object
+ name:
+ allOf:
+ - enum:
+ - Karpenter
+ - enum:
+ - Karpenter
+ description: name specifies the name of the provisioner to
+ use.
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - provisionerConfig
+ type: object
+ autoscaling:
+ description: |-
+ autoscaling specifies auto-scaling behavior that applies to all NodePools
+ associated with this HostedCluster.
+ properties:
+ balancingIgnoredLabels:
+ description: |-
+ balancingIgnoredLabels sets "--balancing-ignore-label " flag on cluster-autoscaler for each listed label.
+ This option specifies labels that cluster autoscaler should ignore when considering node group similarity.
+ For example, if you have nodes with "topology.ebs.csi.aws.com/zone" label, you can add name of this label here
+ to prevent cluster autoscaler from splitting nodes into different node groups based on its value.
+
+ HyperShift automatically appends platform-specific balancing ignore labels:
+ - AWS: "lifecycle", "k8s.amazonaws.com/eniConfig", "topology.k8s.aws/zone-id"
+ - Azure: "agentpool", "kubernetes.azure.com/agentpool"
+ - Common:
+ - "hypershift.openshift.io/nodePool"
+ - "topology.ebs.csi.aws.com/zone"
+ - "topology.disk.csi.azure.com/zone"
+ - "ibm-cloud.kubernetes.io/worker-id"
+ - "vpc-block-csi-driver-labels"
+ These labels are added by default and do not need to be manually specified.
+ items:
+ maxLength: 317
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-validations:
+ - message: Each balancingIgnoredLabels item must be a valid label
+ key
+ rule: self.all(l, l.matches('^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?[a-zA-Z0-9]([a-zA-Z0-9_.-]{0,61}[a-zA-Z0-9])?$'))
+ expanders:
+ description: |-
+ expanders guide the autoscaler in choosing node groups during scale-out.
+ Sets the order of expanders for scaling out node groups.
+ Options include:
+ * LeastWaste - selects the group with minimal idle CPU and memory after scaling.
+ * Priority - selects the group with the highest user-defined priority.
+ * Random - selects a group randomly.
+ If not specified, `[Priority, LeastWaste]` is the default.
+ Maximum of 3 expanders can be specified.
+ items:
+ description: ExpanderString contains the name of an expander
+ to be used by the cluster autoscaler.
+ enum:
+ - LeastWaste
+ - Priority
+ - Random
+ type: string
+ maxItems: 3
+ minItems: 1
+ type: array
+ maxFreeDifferenceRatioPercent:
+ description: |-
+ maxFreeDifferenceRatioPercent sets the maximum difference ratio for free resources between similar node groups. This parameter controls how strict the similarity check is when comparing node groups for load balancing.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means node groups must have exactly the same free resources to be considered similar (no difference allowed).
+ When set to 100, this means node groups will be considered similar regardless of their free resource differences (any difference allowed).
+ A value between 0 and 100 represents the maximum allowed difference ratio for free resources between node groups to be considered similar.
+ When omitted, the autoscaler defaults to 10%.
+ This affects the "--max-free-difference-ratio" flag on cluster-autoscaler.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ maxNodeProvisionTime:
+ description: |-
+ maxNodeProvisionTime is the maximum time to wait for node provisioning
+ before considering the provisioning to be unsuccessful, expressed as a Go
+ duration string. The default is 15 minutes.
+ maxLength: 100
+ pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
+ type: string
+ maxNodesTotal:
+ description: |-
+ maxNodesTotal is the maximum allowable number of nodes for the Autoscaler scale out to be operational.
+ The autoscaler will not grow the cluster beyond this number.
+ If omitted, the autoscaler will not have a maximum limit.
+ number.
+ format: int32
+ minimum: 0
+ type: integer
+ maxPodGracePeriod:
+ description: |-
+ maxPodGracePeriod is the maximum seconds to wait for graceful pod
+ termination before scaling down a NodePool. The default is 600 seconds.
+ format: int32
+ minimum: 0
+ type: integer
+ podPriorityThreshold:
+ description: |-
+ podPriorityThreshold enables users to schedule "best-effort" pods, which
+ shouldn't trigger autoscaler actions, but only run when there are spare
+ resources available. The default is -10.
+
+ See the following for more details:
+ https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#how-does-cluster-autoscaler-work-with-pod-priority-and-preemption
+ format: int32
+ type: integer
+ scaleDown:
+ description: |-
+ scaleDown configures the behavior of the Cluster Autoscaler scale down operation.
+ This field is only valid when scaling is set to ScaleUpAndScaleDown.
+ properties:
+ delayAfterAddSeconds:
+ description: |-
+ delayAfterAddSeconds sets how long after scale up the scale down evaluation resumes in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after scale up, without any delay.
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterDeleteSeconds:
+ description: |-
+ delayAfterDeleteSeconds sets how long after node deletion, scale down evaluation resumes, defaults to scan-interval.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after node deletion, without any delay.
+ When omitted, the autoscaler defaults to 0s.
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterFailureSeconds:
+ description: |-
+ delayAfterFailureSeconds sets how long after a scale down failure, scale down evaluation resumes.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after a scale down failure, without any delay.
+ When omitted, the autoscaler defaults to 180s (3 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ unneededDurationSeconds:
+ description: |-
+ unneededDurationSeconds establishes how long a node should be unneeded before it is eligible for scale down in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ utilizationThresholdPercent:
+ description: |-
+ utilizationThresholdPercent determines the node utilization level, defined as sum of requested resources divided by capacity, below which a node can be considered for scale down.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means nodes will only be considered for scale down if they are completely idle (0% utilization).
+ When set to 100, this means nodes will be considered for scale down regardless of their utilization level.
+ A value between 0 and 100 represents the utilization threshold below which a node can be considered for scale down.
+ When omitted, the autoscaler defaults to 50%.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ type: object
+ scaling:
+ default: ScaleUpAndScaleDown
+ description: |-
+ scaling defines the scaling behavior for the cluster autoscaler.
+ ScaleUpOnly means the autoscaler will only scale up nodes, never scale down.
+ ScaleUpAndScaleDown means the autoscaler will both scale up and scale down nodes.
+ When set to ScaleUpAndScaleDown, the scaleDown field can be used to configure scale down behavior.
+
+ Note: This field is only supported in OpenShift versions 4.19 and above.
+ enum:
+ - ScaleUpOnly
+ - ScaleUpAndScaleDown
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: scaleDown can only be set when scaling is ScaleUpAndScaleDown
+ rule: 'self.scaling == ''ScaleUpAndScaleDown'' ? true : !has(self.scaleDown)'
+ capabilities:
+ default: {}
+ description: |-
+ capabilities allows for disabling optional components at cluster install time.
+ This field is optional and once set cannot be changed.
+ properties:
+ disabled:
+ description: |-
+ disabled when specified, explicitly disables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+
+ Note: Disabling 'openshift-samples','Insights', 'Console', 'NodeTuning', 'Ingress' are only supported in OpenShift versions 4.20 and above.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Disabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Ingress capability can only be disabled if Console
+ capability is also disabled
+ rule: '!self.exists(cap, cap == ''Ingress'') || self.exists(cap,
+ cap == ''Console'')'
+ enabled:
+ description: |-
+ enabled when specified, explicitly enables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Enabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Capabilities is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Capabilities can not be both enabled and disabled at once.
+ rule: 'has(self.enabled) && has(self.disabled) ? self.enabled.all(e,
+ !(e in self.disabled)) : true'
+ channel:
+ description: |-
+ channel is an identifier for explicitly requesting that a non-default set of updates be applied to this cluster.
+ If omitted no particular upgrades are suggested.
+ maxLength: 100
+ minLength: 1
+ type: string
+ clusterID:
+ description: |-
+ clusterID uniquely identifies this cluster. This is expected to be an RFC4122 UUID value (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx in hexadecimal digits).
+ As with a Kubernetes metadata.uid, this ID uniquely identifies this cluster in space and time.
+ This value identifies the cluster in metrics pushed to telemetry and metrics produced by the control plane operators.
+ If a value is not specified, a random clusterID will be generated and set by the controller.
+ Once set, this value is immutable.
+ maxLength: 36
+ minLength: 36
+ type: string
+ x-kubernetes-validations:
+ - message: clusterID must be an RFC4122 UUID value (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+ in hexadecimal digits)
+ rule: self.matches('[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}')
+ - message: clusterID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ configuration:
+ description: |-
+ configuration specifies configuration for individual OCP components in the
+ cluster, represented as embedded resources that correspond to the openshift
+ configuration API.
+ properties:
+ apiServer:
+ description: |-
+ apiServer holds configuration (like serving certificates, client CA and CORS domains)
+ shared by all API servers in the system, among them especially kube-apiserver
+ and openshift-apiserver.
+ properties:
+ additionalCORSAllowedOrigins:
+ description: |-
+ additionalCORSAllowedOrigins lists additional, user-defined regular expressions describing hosts for which the
+ API server allows access using the CORS headers. This may be needed to access the API and the integrated OAuth
+ server from JavaScript applications.
+ The values are regular expressions that correspond to the Golang regular expression language.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ audit:
+ default:
+ profile: Default
+ description: |-
+ audit specifies the settings for audit configuration to be applied to all OpenShift-provided
+ API servers in the cluster.
+ properties:
+ customRules:
+ description: |-
+ customRules specify profiles per group. These profile take precedence over the
+ top-level profile field if they apply. They are evaluation from top to bottom and
+ the first one that matches, applies.
+ items:
+ description: |-
+ AuditCustomRule describes a custom rule for an audit profile that takes precedence over
+ the top-level profile.
+ properties:
+ group:
+ description: group is a name of group a request
+ user must be member of in order to this profile
+ to apply.
+ minLength: 1
+ type: string
+ profile:
+ description: |-
+ profile specifies the name of the desired audit policy configuration to be deployed to
+ all OpenShift-provided API servers in the cluster.
+
+ The following profiles are provided:
+ - Default: the existing default policy.
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ required:
+ - group
+ - profile
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - group
+ x-kubernetes-list-type: map
+ profile:
+ default: Default
+ description: |-
+ profile specifies the name of the desired top-level audit profile to be applied to all requests
+ sent to any of the OpenShift-provided API servers in the cluster (kube-apiserver,
+ openshift-apiserver and oauth-apiserver), with the exception of those requests that match
+ one or more of the customRules.
+
+ The following profiles are provided:
+ - Default: default policy which means MetaData level logging with the exception of events
+ (not logged at all), oauthaccesstokens and oauthauthorizetokens (both logged at RequestBody
+ level).
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ Warning: It is not recommended to disable audit logging by using the `None` profile unless you
+ are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues.
+ If you disable audit logging and a support situation arises, you might need to enable audit logging
+ and reproduce the issue in order to troubleshoot properly.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ type: object
+ clientCA:
+ description: |-
+ clientCA references a ConfigMap containing a certificate bundle for the signers that will be recognized for
+ incoming client certificates in addition to the operator managed signers. If this is empty, then only operator managed signers are valid.
+ You usually only have to set this if you have your own PKI you wish to honor client certificates from.
+ The ConfigMap must exist in the openshift-config namespace and contain the following required fields:
+ - ConfigMap.Data["ca-bundle.crt"] - CA bundle.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ encryption:
+ description: encryption allows the configuration of encryption
+ of resources at the datastore layer.
+ properties:
+ kms:
+ description: |-
+ kms defines the configuration for the external KMS instance that manages the encryption keys,
+ when KMS encryption is enabled sensitive resources will be encrypted using keys managed by an
+ externally configured KMS instance.
+
+ The Key Management Service (KMS) instance provides symmetric encryption and is responsible for
+ managing the lifecyle of the encryption keys outside of the control plane.
+ This allows integration with an external provider to manage the data encryption keys securely.
+ properties:
+ aws:
+ description: |-
+ aws defines the key config for using an AWS KMS instance
+ for the encryption. The AWS KMS instance is managed
+ by the user outside the purview of the control plane.
+ properties:
+ keyARN:
+ description: |-
+ keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
+ The value must adhere to the format `arn:aws:kms:::key/`, where:
+ - `` is the AWS region consisting of lowercase letters and hyphens followed by a number.
+ - `` is a 12-digit numeric identifier for the AWS account.
+ - `` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
+ maxLength: 128
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: keyARN must follow the format `arn:aws:kms:::key/`.
+ The account ID must be a 12 digit number and
+ the region and key ID should consist only
+ of lowercase hexadecimal characters and hyphens
+ (-).
+ rule: self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')
+ region:
+ description: |-
+ region specifies the AWS region where the KMS instance exists, and follows the format
+ `--`, e.g.: `us-east-1`.
+ Only lowercase letters and hyphens followed by numbers are allowed.
+ maxLength: 64
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: region must be a valid AWS region,
+ consisting of lowercase characters, digits
+ and hyphens (-) only.
+ rule: self.matches('^[a-z0-9]+(-[a-z0-9]+)*$')
+ required:
+ - keyARN
+ - region
+ type: object
+ type:
+ description: |-
+ type defines the kind of platform for the KMS provider.
+ Available provider types are AWS only.
+ enum:
+ - AWS
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: aws config is required when kms provider type
+ is AWS, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws)
+ : !has(self.aws)'
+ type:
+ description: |-
+ type defines what encryption type should be used to encrypt resources at the datastore layer.
+ When this field is unset (i.e. when it is set to the empty string), identity is implied.
+ The behavior of unset can and will change over time. Even if encryption is enabled by default,
+ the meaning of unset may change to a different encryption type based on changes in best practices.
+
+ When encryption is enabled, all sensitive resources shipped with the platform are encrypted.
+ This list of sensitive resources can and will change over time. The current authoritative list is:
+
+ 1. secrets
+ 2. configmaps
+ 3. routes.route.openshift.io
+ 4. oauthaccesstokens.oauth.openshift.io
+ 5. oauthauthorizetokens.oauth.openshift.io
+ enum:
+ - ""
+ - identity
+ - aescbc
+ - aesgcm
+ - KMS
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: kms config is required when encryption type is
+ KMS, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms)
+ : !has(self.kms)'
+ servingCerts:
+ description: |-
+ servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates
+ will be used for serving secure traffic.
+ properties:
+ namedCertificates:
+ description: |-
+ namedCertificates references secrets containing the TLS cert info for serving secure traffic to specific hostnames.
+ If no named certificates are provided, or no named certificates match the server name as understood by a client,
+ the defaultServingCertificate will be used.
+ items:
+ description: APIServerNamedServingCert maps a server
+ DNS name, as understood by a client, to a certificate.
+ properties:
+ names:
+ description: |-
+ names is a optional list of explicit DNS names (leading wildcards allowed) that should use this certificate to
+ serve secure traffic. If no names are provided, the implicit names will be extracted from the certificates.
+ Exact names trump over wildcard names. Explicit names defined here trump over extracted implicit names.
+ items:
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-list-type: atomic
+ servingCertificate:
+ description: |-
+ servingCertificate references a kubernetes.io/tls type secret containing the TLS cert info for serving secure traffic.
+ The secret must exist in the openshift-config namespace and contain the following required fields:
+ - Secret.Data["tls.key"] - TLS private key.
+ - Secret.Data["tls.crt"] - TLS certificate.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ tlsSecurityProfile:
+ description: |-
+ tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
+
+ If unset, a default (which may change between releases) is chosen. Note that only Old,
+ Intermediate and Custom profiles are currently supported, and the maximum available
+ minTLSVersion is VersionTLS12.
+ properties:
+ custom:
+ description: |-
+ custom is a user-defined TLS security profile. Be extremely careful using a custom
+ profile as invalid configurations can be catastrophic. An example custom profile
+ looks like this:
+
+ ciphers:
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ minTLSVersion: VersionTLS11
+ nullable: true
+ properties:
+ ciphers:
+ description: |-
+ ciphers is used to specify the cipher algorithms that are negotiated
+ during the TLS handshake. Operators may remove entries their operands
+ do not support. For example, to use DES-CBC3-SHA (yaml):
+
+ ciphers:
+ - DES-CBC3-SHA
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ minTLSVersion:
+ description: |-
+ minTLSVersion is used to specify the minimal version of the TLS protocol
+ that is negotiated during the TLS handshake. For example, to use TLS
+ versions 1.1, 1.2 and 1.3 (yaml):
+
+ minTLSVersion: VersionTLS11
+
+ NOTE: currently the highest minTLSVersion allowed is VersionTLS12
+ enum:
+ - VersionTLS10
+ - VersionTLS11
+ - VersionTLS12
+ - VersionTLS13
+ type: string
+ type: object
+ intermediate:
+ description: |-
+ intermediate is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ minTLSVersion: VersionTLS12
+ nullable: true
+ type: object
+ modern:
+ description: |-
+ modern is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ minTLSVersion: VersionTLS13
+ nullable: true
+ type: object
+ old:
+ description: |-
+ old is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ - DHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-ECDSA-AES128-SHA256
+
+ - ECDHE-RSA-AES128-SHA256
+
+ - ECDHE-ECDSA-AES128-SHA
+
+ - ECDHE-RSA-AES128-SHA
+
+ - ECDHE-ECDSA-AES256-SHA384
+
+ - ECDHE-RSA-AES256-SHA384
+
+ - ECDHE-ECDSA-AES256-SHA
+
+ - ECDHE-RSA-AES256-SHA
+
+ - DHE-RSA-AES128-SHA256
+
+ - DHE-RSA-AES256-SHA256
+
+ - AES128-GCM-SHA256
+
+ - AES256-GCM-SHA384
+
+ - AES128-SHA256
+
+ - AES256-SHA256
+
+ - AES128-SHA
+
+ - AES256-SHA
+
+ - DES-CBC3-SHA
+
+ minTLSVersion: VersionTLS10
+ nullable: true
+ type: object
+ type:
+ description: |-
+ type is one of Old, Intermediate, Modern or Custom. Custom provides
+ the ability to specify individual TLS security profile parameters.
+ Old, Intermediate and Modern are TLS security profiles based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
+
+ The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers
+ are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be
+ reduced.
+
+ Note that the Modern profile is currently not supported because it is not
+ yet well adopted by common software libraries.
+ enum:
+ - Old
+ - Intermediate
+ - Modern
+ - Custom
+ type: string
+ type: object
+ type: object
+ authentication:
+ description: |-
+ authentication specifies cluster-wide settings for authentication (like OAuth and
+ webhook token authenticators).
+ properties:
+ oauthMetadata:
+ description: |-
+ oauthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for an external OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ If oauthMetadata.name is non-empty, this value has precedence
+ over any metadata reference stored in status.
+ The key "oauthMetadata" is used to locate the data.
+ If specified and the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcProviders:
+ description: |-
+ oidcProviders are OIDC identity providers that can issue tokens
+ for this cluster
+ Can only be set if "Type" is set to "OIDC".
+
+ At most one provider can be configured.
+ items:
+ properties:
+ claimMappings:
+ description: |-
+ claimMappings is an optional field that configures the rules to be used by
+ the Kubernetes API server for translating claims in a JWT token, issued
+ by the identity provider, to a cluster identity.
+ properties:
+ extra:
+ description: |-
+ extra is an optional field for configuring the mappings
+ used to construct the extra attribute for the cluster identity.
+ When omitted, no extra attributes will be present on the cluster identity.
+ key values for extra mappings must be unique.
+ A maximum of 64 extra attribute mappings may be provided.
+ items:
+ description: |-
+ ExtraMapping allows specifying a key and CEL expression
+ to evaluate the keys' value. It is used to create additional
+ mappings and attributes added to a cluster identity from
+ a provided authentication token.
+ properties:
+ key:
+ description: |-
+ key is a required field that specifies the string
+ to use as the extra attribute key.
+
+ key must be a domain-prefix path (e.g 'example.org/foo').
+ key must not exceed 510 characters in length.
+ key must contain the '/' character, separating the domain and path characters.
+ key must not be empty.
+
+ The domain portion of the key (string of characters prior to the '/') must be a valid RFC1123 subdomain.
+ It must not exceed 253 characters in length.
+ It must start and end with an alphanumeric character.
+ It must only contain lower case alphanumeric characters and '-' or '.'.
+ It must not use the reserved domains, or be subdomains of, "kubernetes.io", "k8s.io", and "openshift.io".
+
+ The path portion of the key (string of characters after the '/') must not be empty and must consist of at least one
+ alphanumeric character, percent-encoded octets, '-', '.', '_', '~', '!', '$', '&', ''', '(', ')', '*', '+', ',', ';', '=', and ':'.
+ It must not exceed 256 characters in length.
+ maxLength: 510
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: key must contain the '/' character
+ rule: self.contains('/')
+ - message: the domain of the key must consist
+ of only lower case alphanumeric characters,
+ '-' or '.', and must start and end with
+ an alphanumeric character
+ rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
+ - message: the domain of the key must not
+ exceed 253 characters in length
+ rule: self.split('/', 2)[0].size() <= 253
+ - message: the domain 'kubernetes.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'kubernetes.io'
+ - message: the subdomains '*.kubernetes.io'
+ are reserved for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
+ - message: the domain 'k8s.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'k8s.io'
+ - message: the subdomains '*.k8s.io' are reserved
+ for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
+ - message: the domain 'openshift.io' is reserved
+ for OpenShift use
+ rule: self.split('/', 2)[0] != 'openshift.io'
+ - message: the subdomains '*.openshift.io'
+ are reserved for OpenShift use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
+ - message: the path of the key must not be
+ empty and must consist of at least one
+ alphanumeric character, percent-encoded
+ octets, apostrophe, '-', '.', '_', '~',
+ '!', '$', '&', '(', ')', '*', '+', ',',
+ ';', '=', and ':'
+ rule: self.split('/', 2)[1].matches('[A-Za-z0-9/\\-._~%!$&\'()*+;=:]+')
+ - message: the path of the key must not exceed
+ 256 characters in length
+ rule: self.split('/', 2)[1].size() <= 256
+ valueExpression:
+ description: |-
+ valueExpression is a required field to specify the CEL expression to extract
+ the extra attribute value from a JWT token's claims.
+ valueExpression must produce a string or string array value.
+ "", [], and null are treated as the extra mapping not being present.
+ Empty string values within an array are filtered out.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ valueExpression must not exceed 4096 characters in length.
+ valueExpression must not be empty.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ required:
+ - key
+ - valueExpression
+ type: object
+ maxItems: 64
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ groups:
+ description: |-
+ groups is an optional field that configures how the groups of a cluster identity
+ should be constructed from the claims in a JWT token issued
+ by the identity provider.
+ When referencing a claim, if the claim is present in the JWT
+ token, its value must be a list of groups separated by a comma (',').
+ For example - '"example"' and '"exampleOne", "exampleTwo", "exampleThree"' are valid claim values.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix is an optional field that configures the prefix that will be
+ applied to the cluster identity attribute during the process of mapping
+ JWT claims to cluster identity attributes.
+
+ When omitted (""), no prefix is applied to the cluster identity attribute.
+
+ Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains
+ an array of strings "a", "b" and "c", the mapping will result in an
+ array of string "myoidc:a", "myoidc:b" and "myoidc:c".
+ type: string
+ required:
+ - claim
+ type: object
+ uid:
+ description: |-
+ uid is an optional field for configuring the claim mapping
+ used to construct the uid for the cluster identity.
+
+ When using uid.claim to specify the claim it must be a single string value.
+ When using uid.expression the expression must result in a single string value.
+
+ When omitted, this means the user has no opinion and the platform
+ is left to choose a default, which is subject to change over time.
+ The current default is to use the 'sub' claim.
+ properties:
+ claim:
+ description: |-
+ claim is an optional field for specifying the
+ JWT token claim that is used in the mapping.
+ The value of this claim will be assigned to
+ the field in which this mapping is associated.
+
+ Precisely one of claim or expression must be set.
+ claim must not be specified when expression is set.
+ When specified, claim must be at least 1 character in length
+ and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ expression:
+ description: |-
+ expression is an optional field for specifying a
+ CEL expression that produces a string value from
+ JWT token claims.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ Precisely one of claim or expression must be set.
+ expression must not be specified when claim is set.
+ When specified, expression must be at least 1 character in length
+ and must not exceed 4096 characters in length.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: precisely one of claim or expression
+ must be set
+ rule: 'has(self.claim) ? !has(self.expression)
+ : has(self.expression)'
+ username:
+ description: |-
+ username is an optional field that configures how the username of a cluster identity
+ should be constructed from the claims in a JWT token issued by the identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix configures the prefix that should be prepended to the value
+ of the JWT claim.
+
+ prefix must be set when prefixPolicy is set to 'Prefix' and must be unset otherwise.
+ properties:
+ prefixString:
+ description: |-
+ prefixString is a required field that configures the prefix that will
+ be applied to cluster identity username attribute
+ during the process of mapping JWT claims to cluster identity attributes.
+
+ prefixString must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - prefixString
+ type: object
+ prefixPolicy:
+ description: |-
+ prefixPolicy is an optional field that configures how a prefix should be
+ applied to the value of the JWT claim specified in the 'claim' field.
+
+ Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
+
+ When set to 'Prefix', the value specified in the prefix field will be
+ prepended to the value of the JWT claim.
+ The prefix field must be set when prefixPolicy is 'Prefix'.
+
+ When set to 'NoPrefix', no prefix will be prepended to the value
+ of the JWT claim.
+
+ When omitted, this means no opinion and the platform is left to choose
+ any prefixes that are applied which is subject to change over time.
+ Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim
+ when the claim is not 'email'.
+ As an example, consider the following scenario:
+ `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
+ the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
+ and `claim` is set to:
+ - "username": the mapped value will be "https://myoidc.tld#userA"
+ - "email": the mapped value will be "userA@myoidc.tld"
+ enum:
+ - ""
+ - NoPrefix
+ - Prefix
+ type: string
+ required:
+ - claim
+ type: object
+ x-kubernetes-validations:
+ - message: prefix must be set if prefixPolicy is
+ 'Prefix', but must remain unset otherwise
+ rule: 'has(self.prefixPolicy) && self.prefixPolicy
+ == ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
+ > 0) : !has(self.prefix)'
+ type: object
+ claimValidationRules:
+ description: |-
+ claimValidationRules is an optional field that configures the rules to
+ be used by the Kubernetes API server for validating the claims in a JWT
+ token issued by the identity provider.
+
+ Validation rules are joined via an AND operation.
+ items:
+ properties:
+ requiredClaim:
+ description: |-
+ requiredClaim is an optional field that configures the required claim
+ and value that the Kubernetes API server will use to validate if an incoming
+ JWT is valid for this identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the name of the required claim.
+ When taken from the JWT claims, claim must be a string value.
+
+ claim must not be an empty string ("").
+ minLength: 1
+ type: string
+ requiredValue:
+ description: |-
+ requiredValue is a required field that configures the value that 'claim' must
+ have when taken from the incoming JWT claims.
+ If the value in the JWT claims does not match, the token
+ will be rejected for authentication.
+
+ requiredValue must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - claim
+ - requiredValue
+ type: object
+ type:
+ default: RequiredClaim
+ description: |-
+ type is an optional field that configures the type of the validation rule.
+
+ Allowed values are 'RequiredClaim' and omitted (not provided or an empty string).
+
+ When set to 'RequiredClaim', the Kubernetes API server
+ will be configured to validate that the incoming JWT
+ contains the required claim and that its value matches
+ the required value.
+
+ Defaults to 'RequiredClaim'.
+ enum:
+ - RequiredClaim
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ issuer:
+ description: |-
+ issuer is a required field that configures how the platform interacts
+ with the identity provider and how tokens issued from the identity provider
+ are evaluated by the Kubernetes API server.
+ properties:
+ audiences:
+ description: |-
+ audiences is a required field that configures the acceptable audiences
+ the JWT token, issued by the identity provider, must be issued to.
+ At least one of the entries must match the 'aud' claim in the JWT token.
+
+ audiences must contain at least one entry and must not exceed ten entries.
+ items:
+ minLength: 1
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ issuerCertificateAuthority:
+ description: |-
+ issuerCertificateAuthority is an optional field that configures the
+ certificate authority, used by the Kubernetes API server, to validate
+ the connection to the identity provider when fetching discovery information.
+
+ When not specified, the system trust is used.
+
+ When specified, it must reference a ConfigMap in the openshift-config
+ namespace containing the PEM-encoded CA certificates under the 'ca-bundle.crt'
+ key in the data field of the ConfigMap.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ issuerURL:
+ description: |-
+ issuerURL is a required field that configures the URL used to issue tokens
+ by the identity provider.
+ The Kubernetes API server determines how authentication tokens should be handled
+ by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ required:
+ - audiences
+ - issuerURL
+ type: object
+ name:
+ description: |-
+ name is a required field that configures the unique human-readable identifier
+ associated with the identity provider.
+ It is used to distinguish between multiple identity providers
+ and has no impact on token validation or authentication mechanics.
+
+ name must not be an empty string ("").
+ minLength: 1
+ type: string
+ oidcClients:
+ description: |-
+ oidcClients is an optional field that configures how on-cluster,
+ platform clients should request tokens from the identity provider.
+ oidcClients must not exceed 20 entries and entries must have unique namespace/name pairs.
+ items:
+ description: |-
+ OIDCClientConfig configures how platform clients
+ interact with identity providers as an authentication
+ method
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that configures the client identifier, from
+ the identity provider, that the platform component uses for authentication
+ requests made to the identity provider.
+ The identity provider must accept this identifier for platform components
+ to be able to use the identity provider as an authentication mode.
+
+ clientID must not be an empty string ("").
+ minLength: 1
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is an optional field that configures the client secret used
+ by the platform component when making authentication requests to the identity provider.
+
+ When not specified, no client secret will be used when making authentication requests
+ to the identity provider.
+
+ When specified, clientSecret references a Secret in the 'openshift-config'
+ namespace that contains the client secret in the 'clientSecret' key of the '.data' field.
+ The client secret will be used when making authentication requests to the identity provider.
+
+ Public clients do not require a client secret but private
+ clients do require a client secret to work with the identity provider.
+ properties:
+ name:
+ description: name is the metadata.name of
+ the referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component being configured to use the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component being configured to use the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ extraScopes:
+ description: |-
+ extraScopes is an optional field that configures the extra scopes that should
+ be requested by the platform component when making authentication requests to the
+ identity provider.
+ This is useful if you have configured claim mappings that requires specific
+ scopes to be requested beyond the standard OIDC scopes.
+
+ When omitted, no additional scopes are requested.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - clientID
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ required:
+ - issuer
+ - name
+ type: object
+ maxItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ serviceAccountIssuer:
+ description: |-
+ serviceAccountIssuer is the identifier of the bound service account token
+ issuer.
+ The default is https://kubernetes.default.svc
+ WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
+ previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
+ be trusted for a time period chosen by the platform (currently set to 24h).
+ This time period is subject to change over time.
+ This allows internal components to transition to use new service account issuer without service distruption.
+ type: string
+ type:
+ description: |-
+ type identifies the cluster managed, user facing authentication mode in use.
+ Specifically, it manages the component that responds to login attempts.
+ The default is IntegratedOAuth.
+ enum:
+ - ""
+ - None
+ - IntegratedOAuth
+ - OIDC
+ type: string
+ webhookTokenAuthenticator:
+ description: |-
+ webhookTokenAuthenticator configures a remote token reviewer.
+ These remote authentication webhooks can be used to verify bearer tokens
+ via the tokenreviews.authentication.k8s.io REST API. This is required to
+ honor bearer tokens that are provisioned by an external authentication service.
+
+ Can only be set if "Type" is set to "None".
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig references a secret that contains kube config file data which
+ describes how to access the remote webhook service.
+ The namespace for the referenced secret is openshift-config.
+
+ For further details, see:
+
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - kubeConfig
+ type: object
+ webhookTokenAuthenticators:
+ description: webhookTokenAuthenticators is DEPRECATED, setting
+ it has no effect.
+ items:
+ description: |-
+ deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
+ It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig contains kube config file data which describes how to access the remote webhook service.
+ For further details, see:
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ The namespace for this secret is determined by the point of use.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ featureGate:
+ description: featureGate holds cluster-wide information about
+ feature gates.
+ properties:
+ customNoUpgrade:
+ description: |-
+ customNoUpgrade allows the enabling or disabling of any feature. Turning this feature set on IS NOT SUPPORTED, CANNOT BE UNDONE, and PREVENTS UPGRADES.
+ Because of its nature, this setting cannot be validated. If you have any typos or accidentally apply invalid combinations
+ your cluster may fail in an unrecoverable way. featureSet must equal "CustomNoUpgrade" must be set to use this field.
+ nullable: true
+ properties:
+ disabled:
+ description: disabled is a list of all feature gates that
+ you want to force off
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ enabled:
+ description: enabled is a list of all feature gates that
+ you want to force on
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ type: object
+ featureSet:
+ description: |-
+ featureSet changes the list of features in the cluster. The default is empty. Be very careful adjusting this setting.
+ Turning on or off features may cause irreversible changes in your cluster which cannot be undone.
+ enum:
+ - CustomNoUpgrade
+ - DevPreviewNoUpgrade
+ - TechPreviewNoUpgrade
+ - ""
+ type: string
+ x-kubernetes-validations:
+ - message: CustomNoUpgrade may not be changed
+ rule: 'oldSelf == ''CustomNoUpgrade'' ? self == ''CustomNoUpgrade''
+ : true'
+ - message: TechPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''TechPreviewNoUpgrade'' ? self == ''TechPreviewNoUpgrade''
+ : true'
+ - message: DevPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''DevPreviewNoUpgrade'' ? self == ''DevPreviewNoUpgrade''
+ : true'
+ type: object
+ image:
+ description: |-
+ image governs policies related to imagestream imports and runtime configuration
+ for external registries. It allows cluster admins to configure which registries
+ OpenShift is allowed to import images from, extra CA trust bundles for external
+ registries, and policies to block or allow registry hostnames.
+ When exposing OpenShift's image registry to the public, this also lets cluster
+ admins specify the external hostname.
+ This input will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ additionalTrustedCA:
+ description: |-
+ additionalTrustedCA is a reference to a ConfigMap containing additional CAs that
+ should be trusted during imagestream import, pod image pull, build image pull, and
+ imageregistry pullthrough.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ allowedRegistriesForImport:
+ description: |-
+ allowedRegistriesForImport limits the container image registries that normal users may import
+ images from. Set this list to the registries that you trust to contain valid Docker
+ images and that you want applications to be able to import from. Users with
+ permission to create Images or ImageStreamMappings via the API are not affected by
+ this policy - typically only administrators or system integrations will have those
+ permissions.
+ items:
+ description: |-
+ RegistryLocation contains a location of the registry specified by the registry domain
+ name. The domain name might include wildcards, like '*' or '??'.
+ properties:
+ domainName:
+ description: |-
+ domainName specifies a domain name for the registry
+ In case the registry use non-standard (80 or 443) port, the port should be included
+ in the domain name as well.
+ type: string
+ insecure:
+ description: |-
+ insecure indicates whether the registry is secure (https) or insecure (http)
+ By default (if not specified) the registry is assumed as secure.
+ type: boolean
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalRegistryHostnames:
+ description: |-
+ externalRegistryHostnames provides the hostnames for the default external image
+ registry. The external hostname should be set only when the image registry
+ is exposed externally. The first value is used in 'publicDockerImageRepository'
+ field in ImageStreams. The value must be in "hostname[:port]" format.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ imageStreamImportMode:
+ description: |-
+ imageStreamImportMode controls the import mode behaviour of imagestreams.
+ It can be set to `Legacy` or `PreserveOriginal` or the empty string. If this value
+ is specified, this setting is applied to all newly created imagestreams which do not have the
+ value set. `Legacy` indicates that the legacy behaviour should be used.
+ For manifest lists, the legacy behaviour will discard the manifest list and import a single
+ sub-manifest. In this case, the platform is chosen in the following order of priority:
+ 1. tag annotations; 2. control plane arch/os; 3. linux/amd64; 4. the first manifest in the list.
+ `PreserveOriginal` indicates that the original manifest will be preserved. For manifest lists,
+ the manifest list and all its sub-manifests will be imported. When empty, the behaviour will be
+ decided based on the payload type advertised by the ClusterVersion status, i.e single arch payload
+ implies the import mode is Legacy and multi payload implies PreserveOriginal.
+ enum:
+ - ""
+ - Legacy
+ - PreserveOriginal
+ type: string
+ registrySources:
+ description: |-
+ registrySources contains configuration that determines how the container runtime
+ should treat individual registries when accessing images for builds+pods. (e.g.
+ whether or not to allow insecure access). It does not contain configuration for the
+ internal cluster registry.
+ properties:
+ allowedRegistries:
+ description: |-
+ allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ blockedRegistries:
+ description: |-
+ blockedRegistries cannot be used for image pull and push actions. All other registries are permitted.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ containerRuntimeSearchRegistries:
+ description: |-
+ containerRuntimeSearchRegistries are registries that will be searched when pulling images that do not have fully qualified
+ domains in their pull specs. Registries will be searched in the order provided in the list.
+ Note: this search list only works with the container runtime, i.e CRI-O. Will NOT work with builds or imagestream imports.
+ format: hostname
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ insecureRegistries:
+ description: insecureRegistries are registries which do
+ not have a valid TLS certificates or only support HTTP
+ connections.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-validations:
+ - message: Only one of blockedRegistries or allowedRegistries
+ may be set
+ rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
+ : true'
+ type: object
+ ingress:
+ description: |-
+ ingress holds cluster-wide information about ingress, including the default ingress domain
+ used for routes.
+ properties:
+ appsDomain:
+ description: |-
+ appsDomain is an optional domain to use instead of the one specified
+ in the domain field when a Route is created without specifying an explicit
+ host. If appsDomain is nonempty, this value is used to generate default
+ host values for Route. Unlike domain, appsDomain may be modified after
+ installation.
+ This assumes a new ingresscontroller has been setup with a wildcard
+ certificate.
+ type: string
+ componentRoutes:
+ description: |-
+ componentRoutes is an optional list of routes that are managed by OpenShift components
+ that a cluster-admin is able to configure the hostname and serving certificate for.
+ The namespace and name of each route in this list should match an existing entry in the
+ status.componentRoutes list.
+
+ To determine the set of configurable Routes, look at namespace and name of entries in the
+ .status.componentRoutes list, where participating operators write the status of
+ configurable routes.
+ items:
+ description: ComponentRouteSpec allows for configuration
+ of a route's hostname and serving certificate.
+ properties:
+ hostname:
+ description: hostname is the hostname that should be
+ used by the route.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ servingCertKeyPairSecret:
+ description: |-
+ servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
+ The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
+ If the custom hostname uses the default routing suffix of the cluster,
+ the Secret specification for a serving certificate will not be needed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - hostname
+ - name
+ - namespace
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ domain:
+ description: |-
+ domain is used to generate a default host name for a route when the
+ route's host name is empty. The generated host name will follow this
+ pattern: "..".
+
+ It is also used as the default wildcard domain suffix for ingress. The
+ default ingresscontroller domain will follow this pattern: "*.".
+
+ Once set, changing domain is not currently supported.
+ type: string
+ loadBalancer:
+ description: |-
+ loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
+ provider of the current cluster and are required for Ingress Controller to work on OpenShift.
+ properties:
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for the ingress load balancers.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains settings specific to the
+ Amazon Web Services infrastructure provider.
+ properties:
+ type:
+ description: |-
+ type allows user to set a load balancer type.
+ When this field is set the default ingresscontroller will get created using the specified LBType.
+ If this field is not set then the default ingress controller of LBType Classic will be created.
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - NLB
+ - Classic
+ type: string
+ required:
+ - type
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
+ "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
+ and must handle unrecognized platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ type: object
+ type: object
+ requiredHSTSPolicies:
+ description: |-
+ requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
+ matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
+ Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
+ annotation, and affect route admission.
+
+ A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
+ "haproxy.router.openshift.io/hsts_header"
+ E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
+
+ - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
+ is rejected.
+ - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
+ determines the route's admission status.
+ - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then it may use any HSTS Policy annotation.
+
+ The HSTS policy configuration may be changed after routes have already been created. An update to a previously
+ admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
+ However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
+
+ Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
+ items:
+ properties:
+ domainPatterns:
+ description: |-
+ domainPatterns is a list of domains for which the desired HSTS annotations are required.
+ If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
+ the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
+
+ The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
+ foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ includeSubDomainsPolicy:
+ description: |-
+ includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
+ domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
+ - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ enum:
+ - RequireIncludeSubDomains
+ - RequireNoIncludeSubDomains
+ - NoOpinion
+ type: string
+ maxAge:
+ description: |-
+ maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
+ If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
+ If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
+ maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
+ policy will eventually expire on that client.
+ properties:
+ largestMaxAge:
+ description: |-
+ The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ This value can be left unspecified, in which case no upper limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ smallestMaxAge:
+ description: |-
+ The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
+ tool for administrators to quickly correct mistakes.
+ This value can be left unspecified, in which case no lower limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ type: object
+ namespaceSelector:
+ description: |-
+ namespaceSelector specifies a label selector such that the policy applies only to those routes that
+ are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
+ Defaults to the empty LabelSelector, which matches everything.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label
+ selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the
+ selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ preloadPolicy:
+ description: |-
+ preloadPolicy directs the client to include hosts in its host preload list so that
+ it never needs to do an initial load to get the HSTS header (note that this is not defined
+ in RFC 6797 and is therefore client implementation-dependent).
+ enum:
+ - RequirePreload
+ - RequireNoPreload
+ - NoOpinion
+ type: string
+ required:
+ - domainPatterns
+ type: object
+ type: array
+ type: object
+ network:
+ description: |-
+ network holds cluster-wide information about the network. It is used to configure the desired network configuration, such as: IP address pools for services/pod IPs, network plugin, etc.
+ Please view network.spec for an explanation on what applies when configuring this resource.
+ properties:
+ clusterNetwork:
+ description: |-
+ IP address pool to use for pod IPs.
+ This field is immutable after installation.
+ items:
+ description: |-
+ ClusterNetworkEntry is a contiguous block of IP addresses from which pod IPs
+ are allocated.
+ properties:
+ cidr:
+ description: The complete block for pod IPs.
+ type: string
+ hostPrefix:
+ description: |-
+ The size (prefix) of block to allocate to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalIP:
+ description: |-
+ externalIP defines configuration for controllers that
+ affect Service.ExternalIP. If nil, then ExternalIP is
+ not allowed to be set.
+ properties:
+ autoAssignCIDRs:
+ description: |-
+ autoAssignCIDRs is a list of CIDRs from which to automatically assign
+ Service.ExternalIP. These are assigned when the service is of type
+ LoadBalancer. In general, this is only useful for bare-metal clusters.
+ In Openshift 3.x, this was misleadingly called "IngressIPs".
+ Automatically assigned External IPs are not affected by any
+ ExternalIPPolicy rules.
+ Currently, only one entry may be provided.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ policy:
+ description: |-
+ policy is a set of restrictions applied to the ExternalIP field.
+ If nil or empty, then ExternalIP is not allowed to be set.
+ properties:
+ allowedCIDRs:
+ description: allowedCIDRs is the list of allowed CIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ rejectedCIDRs:
+ description: |-
+ rejectedCIDRs is the list of disallowed CIDRs. These take precedence
+ over allowedCIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkDiagnostics:
+ description: |-
+ networkDiagnostics defines network diagnostics configuration.
+
+ Takes precedence over spec.disableNetworkDiagnostics in network.operator.openshift.io.
+ If networkDiagnostics is not specified or is empty,
+ and the spec.disableNetworkDiagnostics flag in network.operator.openshift.io is set to true,
+ the network diagnostics feature will be disabled.
+ properties:
+ mode:
+ description: |-
+ mode controls the network diagnostics mode
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is All.
+ enum:
+ - ""
+ - All
+ - Disabled
+ type: string
+ sourcePlacement:
+ description: |-
+ sourcePlacement controls the scheduling of network diagnostics source deployment
+
+ See NetworkDiagnosticsSourcePlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is an empty list.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ targetPlacement:
+ description: |-
+ targetPlacement controls the scheduling of network diagnostics target daemonset
+
+ See NetworkDiagnosticsTargetPlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `- operator: "Exists"` which means that all taints are tolerated.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkType:
+ description: |-
+ networkType is the plugin that is to be deployed (e.g. OVNKubernetes).
+ This should match a value that the cluster-network-operator understands,
+ or else no networking will be installed.
+ Currently supported values are:
+ - OVNKubernetes
+ This field is immutable after installation.
+ type: string
+ serviceNetwork:
+ description: |-
+ IP address pool for services.
+ Currently, we only support a single entry here.
+ This field is immutable after installation.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceNodePortRange:
+ description: |-
+ The port range allowed for Services of type NodePort.
+ If not specified, the default of 30000-32767 will be used.
+ Such Services without a NodePort specified will have one
+ automatically allocated from this range.
+ This parameter can be updated after the cluster is
+ installed.
+ pattern: ^([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])-([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot set networkDiagnostics.sourcePlacement and networkDiagnostics.targetPlacement
+ when networkDiagnostics.mode is Disabled
+ rule: '!has(self.networkDiagnostics) || !has(self.networkDiagnostics.mode)
+ || self.networkDiagnostics.mode!=''Disabled'' || !has(self.networkDiagnostics.sourcePlacement)
+ && !has(self.networkDiagnostics.targetPlacement)'
+ oauth:
+ description: |-
+ oauth holds cluster-wide information about OAuth.
+ It is used to configure the integrated OAuth server.
+ This configuration is only honored when the top level Authentication config has type set to IntegratedOAuth.
+ properties:
+ identityProviders:
+ description: |-
+ identityProviders is an ordered list of ways for a user to identify themselves.
+ When this list is empty, no identities are provisioned for users.
+ items:
+ description: IdentityProvider provides identities for users
+ authenticating using credentials
+ properties:
+ basicAuth:
+ description: basicAuth contains configuration options
+ for the BasicAuth IdP
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ github:
+ description: github enables user authentication using
+ GitHub credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ This can only be configured when hostname is set to a non-empty value.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostname:
+ description: |-
+ hostname is the optional domain (e.g. "mycompany.com") for use with a hosted instance of
+ GitHub Enterprise.
+ It must match the GitHub Enterprise settings value configured at /setup/settings#hostname.
+ type: string
+ organizations:
+ description: organizations optionally restricts
+ which organizations are allowed to log in
+ items:
+ type: string
+ type: array
+ teams:
+ description: teams optionally restricts which teams
+ are allowed to log in. Format is /.
+ items:
+ type: string
+ type: array
+ type: object
+ gitlab:
+ description: gitlab enables user authentication using
+ GitLab credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the oauth server base URL
+ type: string
+ type: object
+ google:
+ description: google enables user authentication using
+ Google credentials
+ properties:
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostedDomain:
+ description: hostedDomain is the optional Google
+ App domain (e.g. "mycompany.com") to restrict
+ logins to
+ type: string
+ type: object
+ htpasswd:
+ description: htpasswd enables user authentication using
+ an HTPasswd file to validate credentials
+ properties:
+ fileData:
+ description: |-
+ fileData is a required reference to a secret by name containing the data to use as the htpasswd file.
+ The key "htpasswd" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ If the specified htpasswd data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ keystone:
+ description: keystone enables user authentication using
+ keystone password credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ domainName:
+ description: domainName is required for keystone
+ v3
+ type: string
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ ldap:
+ description: ldap enables user authentication using
+ LDAP credentials
+ properties:
+ attributes:
+ description: attributes maps LDAP attributes to
+ identities
+ properties:
+ email:
+ description: |-
+ email is the list of attributes whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ id:
+ description: |-
+ id is the list of attributes whose values should be used as the user ID. Required.
+ First non-empty attribute is used. At least one attribute is required. If none of the listed
+ attribute have a value, authentication fails.
+ LDAP standard identity attribute is "dn"
+ items:
+ type: string
+ type: array
+ name:
+ description: |-
+ name is the list of attributes whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ LDAP standard display name attribute is "cn"
+ items:
+ type: string
+ type: array
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of attributes whose values should be used as the preferred username.
+ LDAP standard login attribute is "uid"
+ items:
+ type: string
+ type: array
+ type: object
+ bindDN:
+ description: bindDN is an optional DN to bind with
+ during the search phase.
+ type: string
+ bindPassword:
+ description: |-
+ bindPassword is an optional reference to a secret by name
+ containing a password to bind with during the search phase.
+ The key "bindPassword" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ insecure:
+ description: |-
+ insecure, if true, indicates the connection should not use TLS
+ WARNING: Should not be set to `true` with the URL scheme "ldaps://" as "ldaps://" URLs always
+ attempt to connect using TLS, even when `insecure` is set to `true`
+ When `true`, "ldap://" URLS connect insecurely. When `false`, "ldap://" URLs are upgraded to
+ a TLS connection using StartTLS as specified in https://tools.ietf.org/html/rfc2830.
+ type: boolean
+ url:
+ description: |-
+ url is an RFC 2255 URL which specifies the LDAP search parameters to use.
+ The syntax of the URL is:
+ ldap://host:port/basedn?attribute?scope?filter
+ type: string
+ type: object
+ mappingMethod:
+ description: |-
+ mappingMethod determines how identities from this provider are mapped to users
+ Defaults to "claim"
+ type: string
+ name:
+ description: |-
+ name is used to qualify the identities returned by this provider.
+ - It MUST be unique and not shared by any other identity provider used
+ - It MUST be a valid path segment: name cannot equal "." or ".." or contain "/" or "%" or ":"
+ Ref: https://godoc.org/github.com/openshift/origin/pkg/user/apis/user/validation#ValidateIdentityProviderName
+ type: string
+ openID:
+ description: openID enables user authentication using
+ OpenID credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ claims:
+ description: claims mappings
+ properties:
+ email:
+ description: |-
+ email is the list of claims whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ groups:
+ description: |-
+ groups is the list of claims value of which should be used to synchronize groups
+ from the OIDC provider to OpenShift for the user.
+ If multiple claims are specified, the first one with a non-empty value is used.
+ items:
+ description: |-
+ OpenIDClaim represents a claim retrieved from an OpenID provider's tokens or userInfo
+ responses
+ minLength: 1
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: |-
+ name is the list of claims whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of claims whose values should be used as the preferred username.
+ If unspecified, the preferred username is determined from the value of the sub claim
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ extraAuthorizeParameters:
+ additionalProperties:
+ type: string
+ description: extraAuthorizeParameters are any custom
+ parameters to add to the authorize request.
+ type: object
+ extraScopes:
+ description: extraScopes are any scopes to request
+ in addition to the standard "openid" scope.
+ items:
+ type: string
+ type: array
+ issuer:
+ description: |-
+ issuer is the URL that the OpenID Provider asserts as its Issuer Identifier.
+ It must use the https scheme with no query or fragment component.
+ type: string
+ type: object
+ requestHeader:
+ description: requestHeader enables user authentication
+ using request header credentials
+ properties:
+ ca:
+ description: |-
+ ca is a required reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ Specifically, it allows verification of incoming requests to prevent header spoofing.
+ The key "ca.crt" is used to locate the data.
+ If the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ challengeURL:
+ description: |-
+ challengeURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect WWW-Authenticate challenges will be
+ redirected here.
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when challenge is set to true.
+ type: string
+ clientCommonNames:
+ description: |-
+ clientCommonNames is an optional list of common names to require a match from. If empty, any
+ client certificate validated against the clientCA bundle is considered authoritative.
+ items:
+ type: string
+ type: array
+ emailHeaders:
+ description: emailHeaders is the set of headers
+ to check for the email address
+ items:
+ type: string
+ type: array
+ headers:
+ description: headers is the set of headers to check
+ for identity information
+ items:
+ type: string
+ type: array
+ loginURL:
+ description: |-
+ loginURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect interactive logins will be redirected here
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when login is set to true.
+ type: string
+ nameHeaders:
+ description: nameHeaders is the set of headers to
+ check for the display name
+ items:
+ type: string
+ type: array
+ preferredUsernameHeaders:
+ description: preferredUsernameHeaders is the set
+ of headers to check for the preferred username
+ items:
+ type: string
+ type: array
+ type: object
+ type:
+ description: type identifies the identity provider type
+ for this entry.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ templates:
+ description: templates allow you to customize pages like the
+ login page.
+ properties:
+ error:
+ description: |-
+ error is the name of a secret that specifies a go template to use to render error pages
+ during the authentication or grant flow.
+ The key "errors.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default error page is used.
+ If the specified template is not valid, the default error page is used.
+ If unspecified, the default error page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ login:
+ description: |-
+ login is the name of a secret that specifies a go template to use to render the login page.
+ The key "login.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default login page is used.
+ If the specified template is not valid, the default login page is used.
+ If unspecified, the default login page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ providerSelection:
+ description: |-
+ providerSelection is the name of a secret that specifies a go template to use to render
+ the provider selection page.
+ The key "providers.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default provider selection page is used.
+ If the specified template is not valid, the default provider selection page is used.
+ If unspecified, the default provider selection page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ tokenConfig:
+ description: tokenConfig contains options for authorization
+ and access tokens
+ properties:
+ accessTokenInactivityTimeout:
+ description: |-
+ accessTokenInactivityTimeout defines the token inactivity timeout
+ for tokens granted by any client.
+ The value represents the maximum amount of time that can occur between
+ consecutive uses of the token. Tokens become invalid if they are not
+ used within this temporal window. The user will need to acquire a new
+ token to regain access once a token times out. Takes valid time
+ duration string such as "5m", "1.5h" or "2h45m". The minimum allowed
+ value for duration is 300s (5 minutes). If the timeout is configured
+ per client, then that value takes precedence. If the timeout value is
+ not specified and the client does not override the value, then tokens
+ are valid until their lifetime.
+
+ WARNING: existing tokens' timeout will not be affected (lowered) by changing this value
+ type: string
+ accessTokenInactivityTimeoutSeconds:
+ description: 'accessTokenInactivityTimeoutSeconds - DEPRECATED:
+ setting this field has no effect.'
+ format: int32
+ type: integer
+ accessTokenMaxAgeSeconds:
+ description: accessTokenMaxAgeSeconds defines the maximum
+ age of access tokens
+ format: int32
+ type: integer
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: spec.configuration.oauth.tokenConfig.accessTokenInactivityTimeout
+ minimum acceptable token timeout value is 300 seconds
+ rule: '!has(self.tokenConfig) || !has(self.tokenConfig.accessTokenInactivityTimeout)
+ || duration(self.tokenConfig.accessTokenInactivityTimeout).getSeconds()
+ >= 300'
+ operatorhub:
+ description: |-
+ operatorhub specifies the configuration for the Operator Lifecycle Manager in the HostedCluster. This is only configured at deployment time but the controller are not reconcilling over it.
+ The OperatorHub configuration will be constantly reconciled if catalog placement is management, but only on cluster creation otherwise.
+ properties:
+ disableAllDefaultSources:
+ description: |-
+ disableAllDefaultSources allows you to disable all the default hub
+ sources. If this is true, a specific entry in sources can be used to
+ enable a default source. If this is false, a specific entry in
+ sources can be used to disable or enable a default source.
+ type: boolean
+ sources:
+ description: |-
+ sources is the list of default hub sources and their configuration.
+ If the list is empty, it implies that the default hub sources are
+ enabled on the cluster unless disableAllDefaultSources is true.
+ If disableAllDefaultSources is true and sources is not empty,
+ the configuration present in sources will take precedence. The list of
+ default hub sources and their current state will always be reflected in
+ the status block.
+ items:
+ description: HubSource is used to specify the hub source
+ and its configuration
+ properties:
+ disabled:
+ description: disabled is used to disable a default hub
+ source on cluster
+ type: boolean
+ name:
+ description: name is the name of one of the default
+ hub sources
+ maxLength: 253
+ minLength: 1
+ type: string
+ type: object
+ type: array
+ type: object
+ proxy:
+ description: |-
+ proxy holds cluster-wide information on how to configure default proxies for the cluster.
+ This affects traffic flowing from the hosted cluster data plane.
+ The controllers will generate a machineConfig with the proxy config for the cluster.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ httpProxy:
+ description: httpProxy is the URL of the proxy for HTTP requests. Empty
+ means unset and will not result in an env var.
+ type: string
+ httpsProxy:
+ description: httpsProxy is the URL of the proxy for HTTPS
+ requests. Empty means unset and will not result in an env
+ var.
+ type: string
+ noProxy:
+ description: |-
+ noProxy is a comma-separated list of hostnames and/or CIDRs and/or IPs for which the proxy should not be used.
+ Empty means unset and will not result in an env var.
+ type: string
+ readinessEndpoints:
+ description: readinessEndpoints is a list of endpoints used
+ to verify readiness of the proxy.
+ items:
+ type: string
+ type: array
+ trustedCA:
+ description: |-
+ trustedCA is a reference to a ConfigMap containing a CA certificate bundle.
+ The trustedCA field should only be consumed by a proxy validator. The
+ validator is responsible for reading the certificate bundle from the required
+ key "ca-bundle.crt", merging it with the system default trust bundle,
+ and writing the merged trust bundle to a ConfigMap named "trusted-ca-bundle"
+ in the "openshift-config-managed" namespace. Clients that expect to make
+ proxy connections must use the trusted-ca-bundle for all HTTPS requests to
+ the proxy, and may use the trusted-ca-bundle for non-proxy HTTPS requests as
+ well.
+
+ The namespace for the ConfigMap referenced by trustedCA is
+ "openshift-config". Here is an example ConfigMap (in yaml):
+
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: user-ca-bundle
+ namespace: openshift-config
+ data:
+ ca-bundle.crt: |
+ -----BEGIN CERTIFICATE-----
+ Custom CA certificate bundle.
+ -----END CERTIFICATE-----
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ scheduler:
+ description: |-
+ scheduler holds cluster-wide config information to run the Kubernetes Scheduler
+ and influence its placement decisions. The canonical name for this config is `cluster`.
+ properties:
+ defaultNodeSelector:
+ description: |-
+ defaultNodeSelector helps set the cluster-wide default node selector to
+ restrict pod placement to specific nodes. This is applied to the pods
+ created in all namespaces and creates an intersection with any existing
+ nodeSelectors already set on a pod, additionally constraining that pod's selector.
+ For example,
+ defaultNodeSelector: "type=user-node,region=east" would set nodeSelector
+ field in pod spec to "type=user-node,region=east" to all pods created
+ in all namespaces. Namespaces having project-wide node selectors won't be
+ impacted even if this field is set. This adds an annotation section to
+ the namespace.
+ For example, if a new namespace is created with
+ node-selector='type=user-node,region=east',
+ the annotation openshift.io/node-selector: type=user-node,region=east
+ gets added to the project. When the openshift.io/node-selector annotation
+ is set on the project the value is used in preference to the value we are setting
+ for defaultNodeSelector field.
+ For instance,
+ openshift.io/node-selector: "type=user-node,region=west" means
+ that the default of "type=user-node,region=east" set in defaultNodeSelector
+ would not be applied.
+ type: string
+ mastersSchedulable:
+ description: |-
+ mastersSchedulable allows masters nodes to be schedulable. When this flag is
+ turned on, all the master nodes in the cluster will be made schedulable,
+ so that workload pods can run on them. The default value for this field is false,
+ meaning none of the master nodes are schedulable.
+ Important Note: Once the workload pods start running on the master nodes,
+ extreme care must be taken to ensure that cluster-critical control plane components
+ are not impacted.
+ Please turn on this field after doing due diligence.
+ type: boolean
+ policy:
+ description: |-
+ DEPRECATED: the scheduler Policy API has been deprecated and will be removed in a future release.
+ policy is a reference to a ConfigMap containing scheduler policy which has
+ user specified predicates and priorities. If this ConfigMap is not available
+ scheduler will default to use DefaultAlgorithmProvider.
+ The namespace for this configmap is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ profile:
+ description: |-
+ profile sets which scheduling profile should be set in order to configure scheduling
+ decisions for new pods.
+
+ Valid values are "LowNodeUtilization", "HighNodeUtilization", "NoScoring"
+ Defaults to "LowNodeUtilization"
+ enum:
+ - ""
+ - LowNodeUtilization
+ - HighNodeUtilization
+ - NoScoring
+ type: string
+ profileCustomizations:
+ description: profileCustomizations contains configuration
+ for modifying the default behavior of existing scheduler
+ profiles.
+ properties:
+ dynamicResourceAllocation:
+ description: |-
+ dynamicResourceAllocation allows to enable or disable dynamic resource allocation within the scheduler.
+ Dynamic resource allocation is an API for requesting and sharing resources between pods and containers inside a pod.
+ Third-party resource drivers are responsible for tracking and allocating resources.
+ Different kinds of resources support arbitrary parameters for defining requirements and initialization.
+ Valid values are Enabled, Disabled and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default,
+ which is subject to change over time.
+ The current default is Disabled.
+ enum:
+ - ""
+ - Enabled
+ - Disabled
+ type: string
+ type: object
+ type: object
+ type: object
+ controlPlaneRelease:
+ description: |-
+ controlPlaneRelease is like spec.release but only for the components running on the management cluster.
+ This excludes any operand which will land in the hosted cluster data plane.
+ It is useful when you need to apply patch management side like a CVE, transparently for the hosted cluster.
+ Version input for this field is free, no validation is performed against spec.release or maximum and minimum is performed.
+ If defined, it will dicate the version of the components running management side, while spec.release will dictate the version of the components landing in the hosted cluster data plane.
+ If not defined, spec.release is used for both.
+ Changing this field will trigger a rollout of the control plane.
+ The behavior of the rollout will be driven by the ControllerAvailabilityPolicy and InfrastructureAvailabilityPolicy for PDBs and maxUnavailable and surce policies.
+ properties:
+ image:
+ description: |-
+ image is the image pullspec of an OCP release payload image.
+ See https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags for a list of available images.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: Image must start with a word character (letters, digits,
+ or underscores) and contain no white spaces
+ rule: self.matches('^(\\w+\\S+)$')
+ required:
+ - image
+ type: object
+ controllerAvailabilityPolicy:
+ default: HighlyAvailable
+ description: |-
+ controllerAvailabilityPolicy specifies the availability policy applied to critical control plane components like the Kube API Server.
+ Possible values are HighlyAvailable and SingleReplica. The default value is HighlyAvailable.
+ This field is immutable.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ x-kubernetes-validations:
+ - message: ControllerAvailabilityPolicy is immutable
+ rule: self == oldSelf
+ dns:
+ description: dns specifies the DNS configuration for the hosted cluster
+ ingress.
+ properties:
+ baseDomain:
+ description: |-
+ baseDomain is the base domain of the hosted cluster.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Once set, this field is immutable.
+ When the value is the empty string "", the controller might default to a value depending on the platform.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomain must be a valid domain name (e.g., example,
+ example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomain is immutable
+ rule: oldSelf == "" || self == oldSelf
+ baseDomainPrefix:
+ description: |-
+ baseDomainPrefix is the base domain prefix for the hosted cluster ingress.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Set baseDomainPrefix to an empty string "", if you don't want a prefix at all (not even hostedCluster.name) to be prepended to baseDomain.
+ This field is immutable.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomainPrefix must be a valid domain name (e.g.,
+ example, example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomainPrefix is immutable
+ rule: self == oldSelf
+ privateZoneID:
+ description: |-
+ privateZoneID is the Hosted Zone ID where all the DNS records that are only available internally to the cluster exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: privateZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ publicZoneID:
+ description: |-
+ publicZoneID is the Hosted Zone ID where all the DNS records that are publicly accessible to the internet exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: publicZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ required:
+ - baseDomain
+ type: object
+ etcd:
+ default:
+ managed:
+ storage:
+ persistentVolume:
+ size: 8Gi
+ type: PersistentVolume
+ managementType: Managed
+ description: |-
+ etcd specifies configuration for the control plane etcd cluster. The
+ default managementType is Managed. Once set, the managementType cannot be
+ changed.
+ properties:
+ managed:
+ description: managed specifies the behavior of an etcd cluster
+ managed by HyperShift.
+ properties:
+ storage:
+ description: storage specifies how etcd data is persisted.
+ properties:
+ persistentVolume:
+ description: |-
+ persistentVolume is the configuration for PersistentVolume etcd storage.
+ With this implementation, a PersistentVolume will be allocated for every
+ etcd member (either 1 or 3 depending on the HostedCluster control plane
+ availability configuration).
+ properties:
+ size:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 8Gi
+ description: |-
+ size is the minimum size of the data volume for each etcd member.
+ Default is 8Gi.
+ This field is immutable
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ x-kubernetes-validations:
+ - message: Etcd PV storage size is immutable
+ rule: self == oldSelf
+ storageClassName:
+ description: |-
+ storageClassName is the StorageClass of the data volume for each etcd member.
+ See https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: storageClassName is immutable
+ rule: self == oldSelf
+ type: object
+ restoreSnapshotURL:
+ description: |-
+ restoreSnapshotURL allows an optional URL to be provided where
+ an etcd snapshot can be downloaded, for example a pre-signed URL
+ referencing a storage service.
+ This snapshot will be restored on initial startup, only when the etcd PV
+ is empty.
+ items:
+ maxLength: 1024
+ type: string
+ maxItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: RestoreSnapshotURL shouldn't contain more than
+ 1 entry
+ rule: self.size() <= 1
+ type:
+ description: |-
+ type is the kind of persistent storage implementation to use for etcd.
+ Only PersistentVolume is supported at the moment.
+ enum:
+ - PersistentVolume
+ type: string
+ required:
+ - type
+ type: object
+ required:
+ - storage
+ type: object
+ managementType:
+ description: |-
+ managementType defines how the etcd cluster is managed.
+ This can be either Managed or Unmanaged.
+ This field is immutable.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ x-kubernetes-validations:
+ - message: managementType is immutable
+ rule: self == oldSelf
+ unmanaged:
+ description: |-
+ unmanaged specifies configuration which enables the control plane to
+ integrate with an externally managed etcd cluster.
+ properties:
+ endpoint:
+ description: |-
+ endpoint is the full etcd cluster client endpoint URL. For example:
+
+ https://etcd-client:2379
+
+ If the URL uses an HTTPS scheme, the TLS field is required.
+ maxLength: 255
+ pattern: ^https://
+ type: string
+ tls:
+ description: tls specifies TLS configuration for HTTPS etcd
+ client endpoints.
+ properties:
+ clientSecret:
+ description: |-
+ clientSecret refers to a secret for client mTLS authentication with the etcd cluster. It
+ may have the following key/value pairs:
+
+ etcd-client-ca.crt: Certificate Authority value
+ etcd-client.crt: Client certificate value
+ etcd-client.key: Client certificate key value
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - clientSecret
+ type: object
+ required:
+ - endpoint
+ - tls
+ type: object
+ required:
+ - managementType
+ type: object
+ x-kubernetes-validations:
+ - message: Only managed configuration must be set when managementType
+ is Managed
+ rule: 'self.managementType == ''Managed'' ? has(self.managed) :
+ !has(self.managed)'
+ - message: Only unmanaged configuration must be set when managementType
+ is Unmanaged
+ rule: 'self.managementType == ''Unmanaged'' ? has(self.unmanaged)
+ : !has(self.unmanaged)'
+ fips:
+ description: |-
+ fips indicates whether this cluster's nodes will be running in FIPS mode.
+ If set to true, the control plane's ignition server will be configured to
+ expect that nodes joining the cluster will be FIPS-enabled.
+ type: boolean
+ x-kubernetes-validations:
+ - message: fips is immutable
+ rule: self == oldSelf
+ imageContentSources:
+ description: |-
+ imageContentSources specifies image mirrors that can be used by cluster
+ nodes to pull content.
+ When imageContentSources is set, the controllers will generate a machineConfig.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ items:
+ description: |-
+ ImageContentSource specifies image mirrors that can be used by cluster nodes
+ to pull content. For cluster workloads, if a container image registry host of
+ the pullspec matches Source then one of the Mirrors are substituted as hosts
+ in the pullspec and tried in order to fetch the image.
+ properties:
+ mirrors:
+ description: mirrors are one or more repositories that may also
+ contain the same images.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 255
+ type: array
+ x-kubernetes-list-type: set
+ source:
+ description: |-
+ source is the repository that users refer to, e.g. in image pull
+ specifications.
+ maxLength: 255
+ type: string
+ required:
+ - source
+ type: object
+ maxItems: 255
+ type: array
+ infraID:
+ description: |-
+ infraID is a globally unique identifier for the cluster.
+ It must consist of lowercase alphanumeric characters and hyphens ('-') only, and start and end with an alphanumeric character.
+ It must be no more than 253 characters in length.
+ This identifier will be used to associate various cloud resources with the HostedCluster and its associated NodePools.
+ infraID is used to compute and tag created resources with "kubernetes.io/cluster/"+hcluster.Spec.InfraID which has contractual meaning for the cloud provider implementations.
+ If a value is not specified, a random infraID will be generated and set by the controller.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: infraID must consist of lowercase alphanumeric characters
+ or '-', start and end with an alphanumeric character, and be between
+ 1 and 253 characters
+ rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?$')
+ - message: infraID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ infrastructureAvailabilityPolicy:
+ default: SingleReplica
+ description: |-
+ infrastructureAvailabilityPolicy specifies the availability policy applied to infrastructure services which run on the hosted cluster data plane like the ingress controller and image registry controller.
+ Possible values are HighlyAvailable and SingleReplica. The default value is SingleReplica.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ issuerURL:
+ default: https://kubernetes.default.svc
+ description: |-
+ issuerURL is an OIDC issuer URL which will be used as the issuer in all
+ ServiceAccount tokens generated by the control plane API server via --service-account-issuer kube api server flag.
+ https://k8s-docs.netlify.app/en/docs/reference/command-line-tools-reference/kube-apiserver/
+ https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection
+ The default value is kubernetes.default.svc, which only works for in-cluster
+ validation.
+ If the platform is AWS and this value is set, the controller will update an s3 object with the appropriate OIDC documents (using the serviceAccountSigningKey info) into that issuerURL.
+ The expectation is for this s3 url to be backed by an OIDC provider in the AWS IAM.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: issuerURL is immutable
+ rule: self == oldSelf
+ - message: issuerURL must be a valid absolute URL
+ rule: isURL(self)
+ kubeAPIServerDNSName:
+ description: |-
+ kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
+ When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
+ If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
+ The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
+ This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
+ access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
+ for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
+ This API endpoint only works in OCP version 4.19 or later. Older versions will result in a no-op.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ labels:
+ additionalProperties:
+ type: string
+ description: |-
+ labels when specified, define what custom labels are added to the hcp pods.
+ Changing this day 2 will cause a rollout of all hcp pods.
+ Duplicate keys are not supported. If duplicate keys are defined, only the last key/value pair is preserved.
+ Valid values are those in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
+
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(key) <= 317 && key.matches('^(([A-Za-z0-9]+(\\.[A-Za-z0-9]+)?)*[A-Za-z0-9]\\/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$'))`, message="label key must have two segments: an optional prefix and name, separated by a slash (/). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (_), dots (.), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (.), not longer than 253 characters in total, followed by a slash (/)"
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(self[key]) <= 63 && self[key].matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$'))`, message="label value must be 63 characters or less (can be empty), consist of alphanumeric characters, dashes (-), underscores (_) or dots (.), and begin and end with an alphanumeric character"
+ maxProperties: 20
+ type: object
+ networking:
+ default:
+ clusterNetwork:
+ - cidr: 10.132.0.0/14
+ networkType: OVNKubernetes
+ serviceNetwork:
+ - cidr: 172.31.0.0/16
+ description: |-
+ networking specifies network configuration for the hosted cluster.
+ Defaults to OVNKubernetes with a cluster network of cidr: "10.132.0.0/14" and a service network of cidr: "172.31.0.0/16".
+ properties:
+ apiServer:
+ description: |-
+ apiServer contains advanced network settings for the API server that affect
+ how the APIServer is exposed inside a hosted cluster node.
+ properties:
+ advertiseAddress:
+ description: |-
+ advertiseAddress is the address that pods within the nodes will use to talk to the API
+ server. This is an address associated with the loopback adapter of each
+ node. If not specified, the controller will take default values.
+ The default values will be set as 172.20.0.1 or fd00::1.
+ This value is immutable.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: advertiseAddress is immutable
+ rule: self == oldSelf
+ allowedCIDRBlocks:
+ description: |-
+ allowedCIDRBlocks is an allow list of CIDR blocks that can access the APIServer.
+ If not specified, traffic is allowed from all addresses.
+ This field is enforced for ARO (Azure Red Hat OpenShift) via the shared-ingress HAProxy.
+ For platforms other than ARO, the enforcement depends on whether the underlying cloud provider supports the Service LoadBalancerSourceRanges field.
+ If the platform does not support LoadBalancerSourceRanges, this field may have no effect.
+ items:
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ maxItems: 500
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the port at which the APIServer is exposed inside a node. Other
+ pods using host networking cannot listen on this port.
+ If omitted 6443 is used.
+ This is useful to choose a port other than the default one which might interfere with customer environments e.g. https://github.com/openshift/hypershift/pull/356.
+ Setting this to 443 is possible only for backward compatibility reasons and it's discouraged.
+ Doing so, it would result in the controller overriding the KAS endpoint in the guest cluster having a discrepancy with the KAS Pod and potentially causing temporarily network failures.
+ This value is immutable.
+ format: int32
+ type: integer
+ x-kubernetes-validations:
+ - message: port is immutable
+ rule: self == oldSelf
+ type: object
+ clusterNetwork:
+ default:
+ - cidr: 10.132.0.0/14
+ description: |-
+ clusterNetwork is the list of IP address pools for pods.
+ Defaults to cidr: "10.132.0.0/14".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: |-
+ ClusterNetworkEntry is a single IP address block for pod IP blocks. IP blocks
+ are allocated with size 2^HostSubnetLength.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ hostPrefix:
+ description: |-
+ hostPrefix is the prefix size to allocate to each node from the CIDR.
+ For example, 24 would allocate 2^(32-24)=2^8=256 addresses to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ type: integer
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: clusterNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ machineNetwork:
+ description: |-
+ machineNetwork is the list of IP address pools for machines.
+ This might be used among other things to generate appropriate networking security groups in some clouds providers.
+ Currently only one entry or two for dual stack is supported.
+ This field is immutable.
+ items:
+ description: MachineNetworkEntry is a single IP address block
+ for node IP blocks.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for machines
+ within the cluster.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: machineNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ networkType:
+ default: OVNKubernetes
+ description: |-
+ networkType specifies the SDN provider used for cluster networking.
+ Defaults to OVNKubernetes.
+ This field is required and immutable.
+ kubebuilder:validation:XValidation:rule="self == oldSelf", message="networkType is immutable"
+ enum:
+ - OpenShiftSDN
+ - Calico
+ - OVNKubernetes
+ - Other
+ type: string
+ serviceNetwork:
+ default:
+ - cidr: 172.31.0.0/16
+ description: |-
+ serviceNetwork is the list of IP address pools for services.
+ Defaults to cidr: "172.31.0.0/16".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: ServiceNetworkEntry is a single IP address block
+ for the service network.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for services
+ within the cluster in CIDR format (e.g., 192.168.1.0/24
+ or 2001:0db8::/64)
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: serviceNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+ must be unique and non-overlapping
+ rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
+ c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
+ self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
+ self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
+ self.serviceNetwork.all(s, c.cidr != s.cidr)))))
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector when specified, is propagated to all control plane Deployments and Stateful sets running management side.
+ It must be satisfied by the management Nodes for the pods to be scheduled. Otherwise the HostedCluster will enter a degraded state.
+ Changes to this field will propagate to existing Deployments and StatefulSets.
+ type: object
+ x-kubernetes-validations:
+ - message: nodeSelector map can have at most 20 entries
+ rule: size(self) <= 20
+ olmCatalogPlacement:
+ default: management
+ description: |-
+ olmCatalogPlacement specifies the placement of OLM catalog components. By default,
+ this is set to management and OLM catalog components are deployed onto the management
+ cluster. If set to guest, the OLM catalog components will be deployed onto the guest
+ cluster.
+ enum:
+ - management
+ - guest
+ type: string
+ x-kubernetes-validations:
+ - message: OLMCatalogPlacement is immutable
+ rule: self == oldSelf
+ operatorConfiguration:
+ description: operatorConfiguration specifies configuration for individual
+ OCP operators in the cluster.
+ properties:
+ clusterNetworkOperator:
+ description: clusterNetworkOperator specifies the configuration
+ for the Cluster Network Operator in the hosted cluster.
+ properties:
+ disableMultiNetwork:
+ default: false
+ description: |-
+ disableMultiNetwork when set to true disables the Multus CNI plugin and related components
+ in the hosted cluster. This prevents the installation of multus daemon sets in the
+ guest cluster and the multus-admission-controller in the management cluster.
+ Default is false (Multus is enabled).
+ This field is immutable.
+ This field can only be set to true when NetworkType is "Other". Setting it to true
+ with any other NetworkType will result in a validation error during cluster creation.
+ type: boolean
+ x-kubernetes-validations:
+ - message: disableMultiNetwork is immutable
+ rule: self == oldSelf
+ ovnKubernetesConfig:
+ description: |-
+ ovnKubernetesConfig holds OVN-Kubernetes specific configuration.
+ This is only consumed when NetworkType is OVNKubernetes.
+ minProperties: 1
+ properties:
+ ipv4:
+ description: |-
+ ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
+ this means no opinions and the default configuration is used. Check individual
+ fields within ipv4 for details of default values.
+ minProperties: 1
+ properties:
+ internalJoinSubnet:
+ description: |-
+ internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the
+ default one is being already used by something else. It must not overlap with
+ any other subnet being used by OpenShift or by the node network. The size of the
+ subnet must be larger than the number of nodes.
+ The current default value is 100.64.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ (e.g., 192.168.1.1/24)
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ internalTransitSwitchSubnet:
+ description: |-
+ internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally
+ by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect
+ architecture that connects the cluster routers on each node together to enable
+ east west traffic. The subnet chosen should not overlap with other networks
+ specified for OVN-Kubernetes as well as other networks used on the host.
+ When omitted, this means no opinion and the platform is left to choose a reasonable
+ default which is subject to change over time.
+ The current default subnet is 100.88.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: internalJoinSubnet and internalTransitSwitchSubnet
+ must not be the same
+ rule: '!has(self.ipv4) || !has(self.ipv4.internalJoinSubnet)
+ || !has(self.ipv4.internalTransitSwitchSubnet) || self.ipv4.internalJoinSubnet
+ != self.ipv4.internalTransitSwitchSubnet'
+ type: object
+ clusterVersionOperator:
+ description: clusterVersionOperator specifies the configuration
+ for the Cluster Version Operator in the hosted cluster.
+ properties:
+ operatorLogLevel:
+ default: Normal
+ description: |-
+ operatorLogLevel is an intent based logging for the operator itself. It does not give fine-grained control,
+ but it is a simple way to manage coarse grained logging choices that operators have to interpret for themselves.
+
+ Valid values are: "Normal", "Debug", "Trace", "TraceAll".
+ Defaults to "Normal".
+ enum:
+ - ""
+ - Normal
+ - Debug
+ - Trace
+ - TraceAll
+ type: string
+ type: object
+ ingressOperator:
+ description: |-
+ ingressOperator specifies the configuration for the Ingress Operator in the hosted cluster.
+ This allows configuring how the default ingress controller endpoints are published.
+ properties:
+ endpointPublishingStrategy:
+ description: |-
+ endpointPublishingStrategy is used to publish the default ingress controller endpoints.
+
+ The endpoint publishing strategy is determined by the following precedence order:
+ 1. User-specified endpointPublishingStrategy (highest priority) - if this field is set,
+ it takes precedence over all other configuration methods
+ 2. Platform-specific defaults with annotation overrides - if no user strategy is set,
+ the platform type determines the default strategy, which can be further modified by:
+ - hypershift.openshift.io/private-ingress-controller annotation (sets PrivateStrategyType)
+ - hypershift.openshift.io/ingress-controller-load-balancer-scope annotation (sets LoadBalancerScope)
+ 3. Generic LoadBalancer fallback - if the platform is not recognized, defaults to
+ LoadBalancerService with External scope
+
+ Platform-specific defaults when endpointPublishingStrategy is not set:
+ - AWS: LoadBalancerService with External scope (or NLB if configured)
+ - Azure, GCP: LoadBalancerService with External scope
+ - IBMCloud: LoadBalancerService with External scope (or NodePort for UPI)
+ - None: HostNetwork
+ - KubeVirt: NodePortService
+ - OpenStack: LoadBalancerService with External scope and optional FloatingIP
+ - Other platforms: LoadBalancerService with External scope
+
+ See the OpenShift Ingress Operator EndpointPublishingStrategy type for the full specification:
+ https://github.com/openshift/api/blob/master/operator/v1/types_ingress.go
+ properties:
+ hostNetwork:
+ description: |-
+ hostNetwork holds parameters for the HostNetwork endpoint publishing
+ strategy. Present only if type is HostNetwork.
+ properties:
+ httpPort:
+ default: 80
+ description: |-
+ httpPort is the port on the host which should be used to listen for
+ HTTP requests. This field should be set when port 80 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 80.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ httpsPort:
+ default: 443
+ description: |-
+ httpsPort is the port on the host which should be used to listen for
+ HTTPS requests. This field should be set when port 443 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 443.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ statsPort:
+ default: 1936
+ description: |-
+ statsPort is the port on the host where the stats from the router are
+ published. The value should not coincide with the NodePort range of the
+ cluster. If an external load balancer is configured to forward connections
+ to this IngressController, the load balancer should use this port for
+ health checks. The load balancer can send HTTP probes on this port on a
+ given node, with the path /healthz/ready to determine if the ingress
+ controller is ready to receive traffic on the node. For proper operation
+ the load balancer must not forward traffic to a node until the health
+ check reports ready. The load balancer should also stop forwarding requests
+ within a maximum of 45 seconds after /healthz/ready starts reporting
+ not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with
+ a threshold of two successful or failed requests to become healthy or
+ unhealthy respectively, are well-tested values. When the value is 0 or
+ is not specified it defaults to 1936.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ type: object
+ loadBalancer:
+ description: |-
+ loadBalancer holds parameters for the load balancer. Present only if
+ type is LoadBalancerService.
+ properties:
+ allowedSourceRanges:
+ description: |-
+ allowedSourceRanges specifies an allowlist of IP address ranges to which
+ access to the load balancer should be restricted. Each range must be
+ specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is
+ specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default,
+ which allows all source addresses.
+
+ To facilitate migration from earlier versions of OpenShift that did
+ not have the allowedSourceRanges field, you may set the
+ service.beta.kubernetes.io/load-balancer-source-ranges annotation on
+ the "router-" service in the
+ "openshift-ingress" namespace, and this annotation will take
+ effect if allowedSourceRanges is empty on OpenShift 4.12.
+ items:
+ description: |-
+ CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8"
+ or "fd00::/8").
+ pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)
+ type: string
+ nullable: true
+ type: array
+ x-kubernetes-list-type: atomic
+ dnsManagementPolicy:
+ default: Managed
+ description: |-
+ dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record
+ associated with the load balancer service will be managed by
+ the ingress operator. It defaults to Managed.
+ Valid values are: Managed and Unmanaged.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ providerParameters:
+ description: |-
+ providerParameters holds desired load balancer information specific to
+ the underlying infrastructure provider.
+
+ If empty, defaults will be applied. See specific providerParameters
+ fields for details about their defaults.
+ properties:
+ aws:
+ description: |-
+ aws provides configuration settings that are specific to AWS
+ load balancers.
+
+ If empty, defaults will be applied. See specific aws fields for
+ details about their defaults.
+ properties:
+ classicLoadBalancer:
+ description: |-
+ classicLoadBalancerParameters holds configuration parameters for an AWS
+ classic load balancer. Present only if type is Classic.
+ properties:
+ connectionIdleTimeout:
+ description: |-
+ connectionIdleTimeout specifies the maximum time period that a
+ connection may be idle before the load balancer closes the
+ connection. The value must be parseable as a time duration value;
+ see . A nil or zero value
+ means no opinion, in which case a default value is used. The default
+ value for this field is 60s. This default is subject to change.
+ format: duration
+ type: string
+ subnets:
+ description: |-
+ subnets specifies the subnets to which the load balancer will
+ attach. The subnets may be specified by either their
+ ID or name. The total number of subnets is limited to 10.
+
+ In order for the load balancer to be provisioned with subnets,
+ each subnet must exist, each subnet must be from a different
+ availability zone, and the load balancer service must be
+ recreated to pick up new values.
+
+ When omitted from the spec, the subnets will be auto-discovered
+ for each availability zone. Auto-discovered subnets are not reported
+ in the status of the IngressController object.
+ properties:
+ ids:
+ description: |-
+ ids specifies a list of AWS subnets by subnet ID.
+ Subnet IDs must start with "subnet-", consist only
+ of alphanumeric characters, must be exactly 24
+ characters long, must be unique, and the total
+ number of subnets specified by ids and names
+ must not exceed 10.
+ items:
+ description: AWSSubnetID is a reference
+ to an AWS subnet ID.
+ maxLength: 24
+ minLength: 24
+ pattern: ^subnet-[0-9A-Za-z]+$
+ type: string
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: subnet ids cannot contain
+ duplicates
+ rule: self.all(x, self.exists_one(y,
+ x == y))
+ names:
+ description: |-
+ names specifies a list of AWS subnets by subnet name.
+ Subnet names must not start with "subnet-", must not
+ include commas, must be under 256 characters in length,
+ must be unique, and the total number of subnets
+ specified by ids and names must not exceed 10.
+ items:
+ description: AWSSubnetName is a
+ reference to an AWS subnet name.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: subnet name cannot contain
+ a comma
+ rule: '!self.contains('','')'
+ - message: subnet name cannot start
+ with 'subnet-'
+ rule: '!self.startsWith(''subnet-'')'
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: subnet names cannot contain
+ duplicates
+ rule: self.all(x, self.exists_one(y,
+ x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: the total number of subnets
+ cannot exceed 10
+ rule: 'has(self.ids) && has(self.names)
+ ? size(self.ids + self.names) <= 10
+ : true'
+ - message: must specify at least 1 subnet
+ name or id
+ rule: has(self.ids) && self.ids.size()
+ > 0 || has(self.names) && self.names.size()
+ > 0
+ type: object
+ networkLoadBalancer:
+ description: |-
+ networkLoadBalancerParameters holds configuration parameters for an AWS
+ network load balancer. Present only if type is NLB.
+ properties:
+ eipAllocations:
+ description: |-
+ eipAllocations is a list of IDs for Elastic IP (EIP) addresses that
+ are assigned to the Network Load Balancer.
+ The following restrictions apply:
+
+ eipAllocations can only be used with external scope, not internal.
+ An EIP can be allocated to only a single IngressController.
+ The number of EIP allocations must match the number of subnets that are used for the load balancer.
+ Each EIP allocation must be unique.
+ A maximum of 10 EIP allocations are permitted.
+
+ See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html for general
+ information about configuration, characteristics, and limitations of Elastic IP addresses.
+ items:
+ description: |-
+ EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment.
+ Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters.
+ maxLength: 26
+ minLength: 26
+ type: string
+ x-kubernetes-validations:
+ - message: eipAllocations should start
+ with 'eipalloc-'
+ rule: self.startsWith('eipalloc-')
+ - message: eipAllocations must be 'eipalloc-'
+ followed by exactly 17 hexadecimal
+ characters (0-9, a-f, A-F)
+ rule: self.split("-", 2)[1].matches('[0-9a-fA-F]{17}$')
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: eipAllocations cannot contain
+ duplicates
+ rule: self.all(x, self.exists_one(y,
+ x == y))
+ subnets:
+ description: |-
+ subnets specifies the subnets to which the load balancer will
+ attach. The subnets may be specified by either their
+ ID or name. The total number of subnets is limited to 10.
+
+ In order for the load balancer to be provisioned with subnets,
+ each subnet must exist, each subnet must be from a different
+ availability zone, and the load balancer service must be
+ recreated to pick up new values.
+
+ When omitted from the spec, the subnets will be auto-discovered
+ for each availability zone. Auto-discovered subnets are not reported
+ in the status of the IngressController object.
+ properties:
+ ids:
+ description: |-
+ ids specifies a list of AWS subnets by subnet ID.
+ Subnet IDs must start with "subnet-", consist only
+ of alphanumeric characters, must be exactly 24
+ characters long, must be unique, and the total
+ number of subnets specified by ids and names
+ must not exceed 10.
+ items:
+ description: AWSSubnetID is a reference
+ to an AWS subnet ID.
+ maxLength: 24
+ minLength: 24
+ pattern: ^subnet-[0-9A-Za-z]+$
+ type: string
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: subnet ids cannot contain
+ duplicates
+ rule: self.all(x, self.exists_one(y,
+ x == y))
+ names:
+ description: |-
+ names specifies a list of AWS subnets by subnet name.
+ Subnet names must not start with "subnet-", must not
+ include commas, must be under 256 characters in length,
+ must be unique, and the total number of subnets
+ specified by ids and names must not exceed 10.
+ items:
+ description: AWSSubnetName is a
+ reference to an AWS subnet name.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: subnet name cannot contain
+ a comma
+ rule: '!self.contains('','')'
+ - message: subnet name cannot start
+ with 'subnet-'
+ rule: '!self.startsWith(''subnet-'')'
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: subnet names cannot contain
+ duplicates
+ rule: self.all(x, self.exists_one(y,
+ x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: the total number of subnets
+ cannot exceed 10
+ rule: 'has(self.ids) && has(self.names)
+ ? size(self.ids + self.names) <= 10
+ : true'
+ - message: must specify at least 1 subnet
+ name or id
+ rule: has(self.ids) && self.ids.size()
+ > 0 || has(self.names) && self.names.size()
+ > 0
+ type: object
+ type:
+ description: |-
+ type is the type of AWS load balancer to instantiate for an ingresscontroller.
+
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - Classic
+ - NLB
+ type: string
+ required:
+ - type
+ type: object
+ gcp:
+ description: |-
+ gcp provides configuration settings that are specific to GCP
+ load balancers.
+
+ If empty, defaults will be applied. See specific gcp fields for
+ details about their defaults.
+ properties:
+ clientAccess:
+ description: |-
+ clientAccess describes how client access is restricted for internal
+ load balancers.
+
+ Valid values are:
+ * "Global": Specifying an internal load balancer with Global client access
+ allows clients from any region within the VPC to communicate with the load
+ balancer.
+
+ https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access
+
+ * "Local": Specifying an internal load balancer with Local client access
+ means only clients within the same region (and VPC) as the GCP load balancer
+ can communicate with the load balancer. Note that this is the default behavior.
+
+ https://cloud.google.com/load-balancing/docs/internal#client_access
+ enum:
+ - Global
+ - Local
+ type: string
+ type: object
+ ibm:
+ description: |-
+ ibm provides configuration settings that are specific to IBM Cloud
+ load balancers.
+
+ If empty, defaults will be applied. See specific ibm fields for
+ details about their defaults.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the load balancer uses PROXY protocol to forward connections to
+ the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features:
+ "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas"
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ Valid values for protocol are TCP, PROXY and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is TCP, without the proxy protocol enabled.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ openstack:
+ description: |-
+ openstack provides configuration settings that are specific to OpenStack
+ load balancers.
+
+ If empty, defaults will be applied. See specific openstack fields for
+ details about their defaults.
+ properties:
+ floatingIP:
+ description: |-
+ floatingIP specifies the IP address that the load balancer will use.
+ When not specified, an IP address will be assigned randomly by the OpenStack cloud provider.
+ When specified, the floating IP has to be pre-created. If the
+ specified value is not a floating IP or is already claimed, the
+ OpenStack cloud provider won't be able to provision the load
+ balancer.
+ This field may only be used if the IngressController has External scope.
+ This value must be a valid IPv4 or IPv6 address.
+ type: string
+ x-kubernetes-validations:
+ - message: floatingIP must be a valid IPv4
+ or IPv6 address
+ rule: isIP(self)
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the load balancer.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix",
+ "OpenStack", and "VSphere".
+ enum:
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Nutanix
+ - OpenStack
+ - VSphere
+ - IBM
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: openstack is not permitted when type is
+ not OpenStack
+ rule: 'has(self.type) && self.type == ''OpenStack''
+ ? true : !has(self.openstack)'
+ scope:
+ description: |-
+ scope indicates the scope at which the load balancer is exposed.
+ Possible values are "External" and "Internal".
+ enum:
+ - Internal
+ - External
+ type: string
+ required:
+ - dnsManagementPolicy
+ - scope
+ type: object
+ x-kubernetes-validations:
+ - message: eipAllocations are forbidden when the scope
+ is Internal.
+ rule: '!has(self.scope) || self.scope != ''Internal''
+ || !has(self.providerParameters) || !has(self.providerParameters.aws)
+ || !has(self.providerParameters.aws.networkLoadBalancer)
+ || !has(self.providerParameters.aws.networkLoadBalancer.eipAllocations)'
+ - message: cannot specify a floating ip when scope is
+ internal
+ rule: '!has(self.scope) || self.scope != ''Internal''
+ || !has(self.providerParameters) || !has(self.providerParameters.openstack)
+ || !has(self.providerParameters.openstack.floatingIP)
+ || self.providerParameters.openstack.floatingIP ==
+ ""'
+ nodePort:
+ description: |-
+ nodePort holds parameters for the NodePortService endpoint publishing strategy.
+ Present only if type is NodePortService.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ private:
+ description: |-
+ private holds parameters for the Private endpoint publishing
+ strategy. Present only if type is Private.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy to use. Valid values are:
+
+ * LoadBalancerService
+
+ Publishes the ingress controller using a Kubernetes LoadBalancer Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A LoadBalancer Service is created to publish the deployment.
+
+ See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
+
+ If domain is set, a wildcard DNS record will be managed to point at the
+ LoadBalancer Service's external name. DNS records are managed only in DNS
+ zones defined by dns.config.openshift.io/cluster .spec.publicZone and
+ .spec.privateZone.
+
+ Wildcard DNS management is currently supported only on the AWS, Azure,
+ and GCP platforms.
+
+ * HostNetwork
+
+ Publishes the ingress controller on node ports where the ingress controller
+ is deployed.
+
+ In this configuration, the ingress controller deployment uses host
+ networking, bound to node ports 80 and 443. The user is responsible for
+ configuring an external load balancer to publish the ingress controller via
+ the node ports.
+
+ * Private
+
+ Does not publish the ingress controller.
+
+ In this configuration, the ingress controller deployment uses container
+ networking, and is not explicitly published. The user must manually publish
+ the ingress controller.
+
+ * NodePortService
+
+ Publishes the ingress controller using a Kubernetes NodePort Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A NodePort Service is created to publish the deployment. The
+ specific node ports are dynamically allocated by OpenShift; however, to
+ support static port allocations, user changes to the node port
+ field of the managed NodePort Service will preserved.
+ enum:
+ - LoadBalancerService
+ - HostNetwork
+ - Private
+ - NodePortService
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-preserve-unknown-fields: true
+ type: object
+ type: object
+ pausedUntil:
+ description: |-
+ pausedUntil is a field that can be used to pause reconciliation on the HostedCluster controller, resulting in any change to the HostedCluster being ignored.
+ Either a date can be provided in RFC3339 format or a boolean as in 'true', 'false', 'True', 'False'. If a date is
+ provided: reconciliation is paused on the resource until that date. If the boolean true is
+ provided: reconciliation is paused on the resource until the field is removed.
+ maxLength: 35
+ minLength: 4
+ type: string
+ x-kubernetes-validations:
+ - message: PausedUntil must be a date in RFC3339 format or 'True',
+ 'true', 'False' or 'false'
+ rule: self.matches('^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}.*$')
+ || self in ['true', 'false', 'True', 'False']
+ platform:
+ description: |-
+ platform specifies the underlying infrastructure provider for the cluster
+ and is used to configure platform specific behavior.
+ properties:
+ agent:
+ description: agent specifies configuration for agent-based installations.
+ properties:
+ agentNamespace:
+ description: agentNamespace is the namespace where to search
+ for Agents for this cluster
+ maxLength: 63
+ type: string
+ required:
+ - agentNamespace
+ type: object
+ aws:
+ description: aws specifies configuration for clusters running
+ on Amazon Web Services.
+ properties:
+ additionalAllowedPrincipals:
+ description: |-
+ additionalAllowedPrincipals specifies a list of additional allowed principal ARNs
+ to be added to the hosted control plane's VPC Endpoint Service to enable additional
+ VPC Endpoint connection requests to be automatically accepted.
+ See https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html
+ for more details around VPC Endpoint Service allowed principals.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 25
+ type: array
+ cloudProviderConfig:
+ description: |-
+ cloudProviderConfig specifies AWS networking configuration for the control
+ plane.
+ This is mainly used for cloud provider controller config:
+ https://github.com/kubernetes/kubernetes/blob/f5be5052e3d0808abb904aebd3218fe4a5c2dd82/staging/src/k8s.io/legacy-cloud-providers/aws/aws.go#L1347-L1364
+ properties:
+ subnet:
+ description: subnet is the subnet to use for control plane
+ cloud resources.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify
+ an AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for
+ the filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: vpc is the VPC to use for control plane cloud
+ resources.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ maxLength: 255
+ type: string
+ required:
+ - vpc
+ type: object
+ endpointAccess:
+ default: Public
+ description: |-
+ endpointAccess specifies the publishing scope of cluster endpoints. The
+ default is Public.
+ enum:
+ - Public
+ - PublicAndPrivate
+ - Private
+ type: string
+ multiArch:
+ default: false
+ description: |-
+ multiArch specifies whether the Hosted Cluster will be expected to support NodePools with different
+ CPU architectures, i.e., supporting arm64 NodePools and supporting amd64 NodePools on the same Hosted Cluster.
+ Deprecated: This field is no longer used. The HyperShift Operator now performs multi-arch validations
+ automatically despite the platform type. The HyperShift Operator will set HostedCluster.Status.PayloadArch based
+ on the HostedCluster release image. This field is used by the NodePool controller to validate the
+ NodePool.Spec.Arch is supported.
+ type: boolean
+ region:
+ description: |-
+ region is the AWS region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot AMI for a given release.
+ maxLength: 255
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created
+ for the cluster. See
+ https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for
+ information on tagging AWS resources. AWS supports a maximum of 50 tags per
+ resource. OpenShift reserves 25 tags for its use, leaving 25 tags available
+ for the user.
+ Changes to this field will be propagated in-place to AWS resources (VPC Endpoints, EC2 instances, initial EBS volumes and default/endpoint security groups).
+ These tags will be propagated to the infrastructure CR in the guest cluster, where other OCP operators might choose to honor this input to reconcile AWS resources created by them.
+ Please consult the official documentation for a list of all AWS resources that support in-place tag updates.
+ These take precedence over tags defined out of band (i.e., tags added manually or by other tools outside of HyperShift) in AWS in case of conflicts.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ value:
+ description: |-
+ value is the value of the tag.
+
+ Some AWS service do not support empty values. Since tags are added to
+ resources in many services, the length of the tag value must meet the
+ requirements of all services.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ rolesRef:
+ description: |-
+ rolesRef contains references to various AWS IAM roles required to enable
+ integrations such as OIDC.
+ properties:
+ controlPlaneOperatorARN:
+ description: "controlPlaneOperatorARN is an ARN value
+ referencing a role appropriate for the Control Plane
+ Operator.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"arn:aws:route53:::%s\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ imageRegistryARN:
+ description: "imageRegistryARN is an ARN value referencing
+ a role appropriate for the Image Registry Operator.\n\nThe
+ following is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"s3:CreateBucket\",\n\t\t\t\t\"s3:DeleteBucket\",\n\t\t\t\t\"s3:PutBucketTagging\",\n\t\t\t\t\"s3:GetBucketTagging\",\n\t\t\t\t\"s3:PutBucketPublicAccessBlock\",\n\t\t\t\t\"s3:GetBucketPublicAccessBlock\",\n\t\t\t\t\"s3:PutEncryptionConfiguration\",\n\t\t\t\t\"s3:GetEncryptionConfiguration\",\n\t\t\t\t\"s3:PutLifecycleConfiguration\",\n\t\t\t\t\"s3:GetLifecycleConfiguration\",\n\t\t\t\t\"s3:GetBucketLocation\",\n\t\t\t\t\"s3:ListBucket\",\n\t\t\t\t\"s3:GetObject\",\n\t\t\t\t\"s3:PutObject\",\n\t\t\t\t\"s3:DeleteObject\",\n\t\t\t\t\"s3:ListBucketMultipartUploads\",\n\t\t\t\t\"s3:AbortMultipartUpload\",\n\t\t\t\t\"s3:ListMultipartUploadParts\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing a
+ role appropriate for the Ingress Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"elasticloadbalancing:DescribeLoadBalancers\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"route53:ListHostedZones\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ [\n\t\t\t\t\"arn:aws:route53:::PUBLIC_ZONE_ID\",\n\t\t\t\t\"arn:aws:route53:::PRIVATE_ZONE_ID\"\n\t\t\t]\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ kubeCloudControllerARN:
+ description: |-
+ kubeCloudControllerARN is an ARN value referencing a role appropriate for the KCM/KCC.
+ Source: https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies
+
+ The following is an example of a valid policy document:
+
+ {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Action": [
+ "autoscaling:DescribeAutoScalingGroups",
+ "autoscaling:DescribeLaunchConfigurations",
+ "autoscaling:DescribeTags",
+ "ec2:DescribeAvailabilityZones",
+ "ec2:DescribeInstances",
+ "ec2:DescribeImages",
+ "ec2:DescribeRegions",
+ "ec2:DescribeRouteTables",
+ "ec2:DescribeSecurityGroups",
+ "ec2:DescribeSubnets",
+ "ec2:DescribeVolumes",
+ "ec2:CreateSecurityGroup",
+ "ec2:CreateTags",
+ "ec2:CreateVolume",
+ "ec2:ModifyInstanceAttribute",
+ "ec2:ModifyVolume",
+ "ec2:AttachVolume",
+ "ec2:AuthorizeSecurityGroupIngress",
+ "ec2:CreateRoute",
+ "ec2:DeleteRoute",
+ "ec2:DeleteSecurityGroup",
+ "ec2:DeleteVolume",
+ "ec2:DetachVolume",
+ "ec2:RevokeSecurityGroupIngress",
+ "ec2:DescribeVpcs",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:AttachLoadBalancerToSubnets",
+ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancerPolicy",
+ "elasticloadbalancing:CreateLoadBalancerListeners",
+ "elasticloadbalancing:ConfigureHealthCheck",
+ "elasticloadbalancing:DeleteLoadBalancer",
+ "elasticloadbalancing:DeleteLoadBalancerListeners",
+ "elasticloadbalancing:DescribeLoadBalancers",
+ "elasticloadbalancing:DescribeLoadBalancerAttributes",
+ "elasticloadbalancing:DetachLoadBalancerFromSubnets",
+ "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
+ "elasticloadbalancing:ModifyLoadBalancerAttributes",
+ "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
+ "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:CreateListener",
+ "elasticloadbalancing:CreateTargetGroup",
+ "elasticloadbalancing:DeleteListener",
+ "elasticloadbalancing:DeleteTargetGroup",
+ "elasticloadbalancing:DeregisterTargets",
+ "elasticloadbalancing:DescribeListeners",
+ "elasticloadbalancing:DescribeLoadBalancerPolicies",
+ "elasticloadbalancing:DescribeTargetGroups",
+ "elasticloadbalancing:DescribeTargetHealth",
+ "elasticloadbalancing:ModifyListener",
+ "elasticloadbalancing:ModifyTargetGroup",
+ "elasticloadbalancing:RegisterTargets",
+ "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
+ "iam:CreateServiceLinkedRole",
+ "kms:DescribeKey"
+ ],
+ "Resource": [
+ "*"
+ ],
+ "Effect": "Allow"
+ }
+ ]
+ }
+ maxLength: 2048
+ type: string
+ networkARN:
+ description: "networkARN is an ARN value referencing a
+ role appropriate for the Network Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:DescribeInstances\",\n
+ \ \"ec2:DescribeInstanceStatus\",\n \"ec2:DescribeInstanceTypes\",\n
+ \ \"ec2:UnassignPrivateIpAddresses\",\n \"ec2:AssignPrivateIpAddresses\",\n
+ \ \"ec2:UnassignIpv6Addresses\",\n \"ec2:AssignIpv6Addresses\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeNetworkInterfaces\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ nodePoolManagementARN:
+ description: "nodePoolManagementARN is an ARN value referencing
+ a role appropriate for the CAPI Controller.\n\nThe following
+ is an example of a valid policy document:\n\n{\n \"Version\":
+ \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\":
+ [\n \"ec2:AssociateRouteTable\",\n \"ec2:AttachInternetGateway\",\n
+ \ \"ec2:AuthorizeSecurityGroupIngress\",\n \"ec2:CreateInternetGateway\",\n
+ \ \"ec2:CreateNatGateway\",\n \"ec2:CreateRoute\",\n
+ \ \"ec2:CreateRouteTable\",\n \"ec2:CreateSecurityGroup\",\n
+ \ \"ec2:CreateSubnet\",\n \"ec2:CreateTags\",\n
+ \ \"ec2:DeleteInternetGateway\",\n \"ec2:DeleteNatGateway\",\n
+ \ \"ec2:DeleteRouteTable\",\n \"ec2:DeleteSecurityGroup\",\n
+ \ \"ec2:DeleteSubnet\",\n \"ec2:DeleteTags\",\n
+ \ \"ec2:DescribeAccountAttributes\",\n \"ec2:DescribeAddresses\",\n
+ \ \"ec2:DescribeAvailabilityZones\",\n \"ec2:DescribeImages\",\n
+ \ \"ec2:DescribeInstances\",\n \"ec2:DescribeInternetGateways\",\n
+ \ \"ec2:DescribeNatGateways\",\n \"ec2:DescribeNetworkInterfaces\",\n
+ \ \"ec2:DescribeNetworkInterfaceAttribute\",\n
+ \ \"ec2:DescribeRouteTables\",\n \"ec2:DescribeSecurityGroups\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeVpcs\",\n
+ \ \"ec2:DescribeVpcAttribute\",\n \"ec2:DescribeVolumes\",\n
+ \ \"ec2:DetachInternetGateway\",\n \"ec2:DisassociateRouteTable\",\n
+ \ \"ec2:DisassociateAddress\",\n \"ec2:ModifyInstanceAttribute\",\n
+ \ \"ec2:ModifyNetworkInterfaceAttribute\",\n \"ec2:ModifySubnetAttribute\",\n
+ \ \"ec2:RevokeSecurityGroupIngress\",\n \"ec2:RunInstances\",\n
+ \ \"ec2:TerminateInstances\",\n \"tag:GetResources\",\n
+ \ \"ec2:CreateLaunchTemplate\",\n \"ec2:CreateLaunchTemplateVersion\",\n
+ \ \"ec2:DescribeLaunchTemplates\",\n \"ec2:DescribeLaunchTemplateVersions\",\n
+ \ \"ec2:DeleteLaunchTemplate\",\n \"ec2:DeleteLaunchTemplateVersions\"\n
+ \ ],\n \"Resource\": [\n \"*\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n {\n \"Condition\":
+ {\n \"StringLike\": {\n \"iam:AWSServiceName\":
+ \"elasticloadbalancing.amazonaws.com\"\n }\n },\n
+ \ \"Action\": [\n \"iam:CreateServiceLinkedRole\"\n
+ \ ],\n \"Resource\": [\n \"arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing\"\n
+ \ ],\n \"Effect\": \"Allow\"\n },\n {\n \"Action\":
+ [\n \"iam:PassRole\"\n ],\n \"Resource\":
+ [\n \"arn:*:iam::*:role/*-worker-role\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n\t {\n\t \t\"Effect\":
+ \"Allow\",\n\t \t\"Action\": [\n\t \t\t\"kms:Decrypt\",\n\t
+ \ \t\t\"kms:ReEncrypt\",\n\t \t\t\"kms:GenerateDataKeyWithoutPlainText\",\n\t
+ \ \t\t\"kms:DescribeKey\"\n\t \t],\n\t \t\"Resource\":
+ \"*\"\n\t },\n\t {\n\t \t\"Effect\": \"Allow\",\n\t
+ \ \t\"Action\": [\n\t \t\t\"kms:CreateGrant\"\n\t \t],\n\t
+ \ \t\"Resource\": \"*\",\n\t \t\"Condition\": {\n\t
+ \ \t\t\"Bool\": {\n\t \t\t\t\"kms:GrantIsForAWSResource\":
+ true\n\t \t\t}\n\t \t}\n\t }\n ]\n}"
+ maxLength: 2048
+ type: string
+ storageARN:
+ description: "storageARN is an ARN value referencing a
+ role appropriate for the Storage Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:AttachVolume\",\n\t\t\t\t\"ec2:CreateSnapshot\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"ec2:CreateVolume\",\n\t\t\t\t\"ec2:DeleteSnapshot\",\n\t\t\t\t\"ec2:DeleteTags\",\n\t\t\t\t\"ec2:DeleteVolume\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeSnapshots\",\n\t\t\t\t\"ec2:DescribeTags\",\n\t\t\t\t\"ec2:DescribeVolumes\",\n\t\t\t\t\"ec2:DescribeVolumesModifications\",\n\t\t\t\t\"ec2:DetachVolume\",\n\t\t\t\t\"ec2:ModifyVolume\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - controlPlaneOperatorARN
+ - imageRegistryARN
+ - ingressARN
+ - kubeCloudControllerARN
+ - networkARN
+ - nodePoolManagementARN
+ - storageARN
+ type: object
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints specifies optional custom endpoints which will override
+ the default service endpoint of specific AWS Services.
+
+ There must be only one ServiceEndpoint for a given service name.
+ items:
+ description: |-
+ AWSServiceEndpoint stores the configuration for services to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ This must be provided and cannot be empty.
+ maxLength: 255
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 50
+ type: array
+ sharedVPC:
+ description: |-
+ sharedVPC contains fields that must be specified if the HostedCluster must use a VPC that is
+ created in a different AWS account and is shared with the AWS account where the HostedCluster
+ will be created.
+ properties:
+ localZoneID:
+ description: |-
+ localZoneID is the ID of the route53 hosted zone for [cluster-name].hypershift.local that is
+ associated with the HostedCluster's VPC and exists in the VPC owner account.
+ maxLength: 32
+ type: string
+ rolesRef:
+ description: |-
+ rolesRef contains references to roles in the VPC owner account that enable a
+ HostedCluster on a shared VPC.
+ properties:
+ controlPlaneARN:
+ description: "controlPlaneARN is an ARN value referencing
+ the role in the VPC owner account that allows\nthe
+ control plane operator in the cluster account to
+ create and manage a VPC endpoint, its\ncorresponding
+ Security Group, and DNS records in the hypershift
+ local hosted zone.\n\nThe referenced role must have
+ a trust relationship that allows it to be assumed
+ by the\ncontrol plane operator role in the VPC creator
+ account.\nExample:\n{\n\t \"Version\": \"2012-10-17\",\n\t
+ \"Statement\": [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t
+ \t\t\"Effect\": \"Allow\",\n\t \t\t\"Principal\":
+ {\n\t \t\t\t\"AWS\": \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-control-plane-operator\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing
+ the role in the VPC owner account that allows the\ningress
+ operator in the cluster account to create and manage
+ records in the private DNS\nhosted zone.\n\nThe
+ referenced role must have a trust relationship that
+ allows it to be assumed by the\ningress operator
+ role in the VPC creator account.\nExample:\n{\n\t
+ \"Version\": \"2012-10-17\",\n\t \"Statement\":
+ [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t \t\t\"Effect\":
+ \"Allow\",\n\t \t\t\"Principal\": {\n\t \t\t\t\"AWS\":
+ \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-openshift-ingress\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n(Based on https://docs.openshift.com/rosa/rosa_install_access_delete_clusters/rosa-shared-vpc-config.html#rosa-sharing-vpc-dns-and-roles_rosa-shared-vpc-config)\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"route53:ListHostedZonesByName\",\n\t\t\t\t\"route53:ChangeTagsForResource\",\n\t\t\t\t\"route53:GetAccountLimit\",\n\t\t\t\t\"route53:GetChange\",\n\t\t\t\t\"route53:GetHostedZone\",\n\t\t\t\t\"route53:ListTagsForResource\",\n\t\t\t\t\"route53:UpdateHostedZoneComment\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"tag:UntagResources\"\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ required:
+ - controlPlaneARN
+ - ingressARN
+ type: object
+ required:
+ - localZoneID
+ - rolesRef
+ type: object
+ required:
+ - region
+ - rolesRef
+ type: object
+ azure:
+ description: azure defines azure specific settings
+ properties:
+ azureAuthenticationConfig:
+ description: |-
+ azureAuthenticationConfig is the type of Azure authentication configuration to use to authenticate with Azure's
+ Cloud API.
+ properties:
+ azureAuthenticationConfigType:
+ description: |-
+ azureAuthenticationConfigType is the type of identity configuration used in the Hosted Cluster. This field is
+ used to determine which identity configuration is being used. Valid values are "ManagedIdentities" and
+ "WorkloadIdentities".
+ enum:
+ - ManagedIdentities
+ - WorkloadIdentities
+ type: string
+ managedIdentities:
+ description: |-
+ managedIdentities contains the managed identities needed for HCP control plane and data plane components that
+ authenticate with Azure's API.
+
+ These are required for managed Azure, also known as ARO HCP.
+ properties:
+ controlPlane:
+ description: |-
+ controlPlane contains the client IDs of all the managed identities on the HCP control plane needing to
+ authenticate with Azure's API.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is a pre-existing managed identity associated with the azure cloud provider, aka cloud controller
+ manager.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ controlPlaneOperator:
+ description: controlPlaneOperator is a pre-existing
+ managed identity associated with the control
+ plane operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ disk:
+ description: disk is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ file:
+ description: file is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ imageRegistry:
+ description: imageRegistry is a pre-existing managed
+ identity associated with the cluster-image-registry-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ ingress:
+ description: ingress is a pre-existing managed
+ identity associated with the cluster-ingress-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ managedIdentitiesKeyVault:
+ description: |-
+ managedIdentitiesKeyVault contains information on the management cluster's managed identities Azure Key Vault.
+ This Key Vault is where the managed identities certificates are stored. These certificates are pulled out of the
+ Key Vault by the Secrets Store CSI driver and mounted into a volume on control plane pods requiring
+ authentication with Azure API.
+
+ More information on how the Secrets Store CSI driver works to do this can be found here:
+ https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver.
+ properties:
+ name:
+ description: name is the name of the Azure
+ Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ tenantID:
+ description: tenantID is the tenant ID of
+ the Azure Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - tenantID
+ type: object
+ network:
+ description: network is a pre-existing managed
+ identity associated with the cluster-network-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ nodePoolManagement:
+ description: nodePoolManagement is a pre-existing
+ managed identity associated with the operator
+ managing the NodePools.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - cloudProvider
+ - controlPlaneOperator
+ - disk
+ - file
+ - ingress
+ - managedIdentitiesKeyVault
+ - network
+ - nodePoolManagement
+ type: object
+ dataPlane:
+ description: |-
+ dataPlane contains the client IDs of all the managed identities on the data plane needing to authenticate with
+ Azure's API.
+ properties:
+ diskMSIClientID:
+ description: diskMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI Disk driver.
+ maxLength: 255
+ type: string
+ fileMSIClientID:
+ description: fileMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI File driver.
+ maxLength: 255
+ type: string
+ imageRegistryMSIClientID:
+ description: |-
+ imageRegistryMSIClientID is the client ID of a pre-existing managed identity ID associated with the image
+ registry controller.
+ maxLength: 255
+ type: string
+ required:
+ - diskMSIClientID
+ - fileMSIClientID
+ - imageRegistryMSIClientID
+ type: object
+ required:
+ - controlPlane
+ - dataPlane
+ type: object
+ workloadIdentities:
+ description: |-
+ workloadIdentities is a struct of client IDs for each component that needs to authenticate with Azure's API in
+ self-managed Azure. These client IDs are used to authenticate with Azure cloud on both the control plane and data
+ plane.
+
+ This is required for self-managed Azure.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is the client ID of a federated managed identity, associated with azure-cloud-provider, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ disk:
+ description: |-
+ disk is the client ID of a federated managed identity, associated with cluster-storage-operator-disk,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ file:
+ description: |-
+ file is the client ID of a federated managed identity, associated with cluster-storage-operator-file,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ imageRegistry:
+ description: |-
+ imageRegistry is the client ID of a federated managed identity, associated with cluster-image-registry-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ ingress:
+ description: |-
+ ingress is the client ID of a federated managed identity, associated with cluster-ingress-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ network:
+ description: |-
+ network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ nodePoolManagement:
+ description: |-
+ nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
+ in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ required:
+ - cloudProvider
+ - disk
+ - file
+ - imageRegistry
+ - ingress
+ - network
+ - nodePoolManagement
+ type: object
+ required:
+ - azureAuthenticationConfigType
+ type: object
+ x-kubernetes-validations:
+ - message: managedIdentities is required when azureAuthenticationConfigType
+ is ManagedIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''ManagedIdentities''
+ ? has(self.managedIdentities) : !has(self.managedIdentities)'
+ - message: workloadIdentities is required when azureAuthenticationConfigType
+ is WorkloadIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''WorkloadIdentities''
+ ? has(self.workloadIdentities) : !has(self.workloadIdentities)'
+ cloud:
+ default: AzurePublicCloud
+ description: 'cloud is the cloud environment identifier, valid
+ values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33'
+ enum:
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ location:
+ description: |-
+ location is the Azure region in where all the cloud infrastructure resources will be created.
+
+ Example: eastus
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: Location is immutable
+ rule: self == oldSelf
+ resourceGroup:
+ default: default
+ description: |-
+ resourceGroup is the name of an existing resource group where all cloud resources created by the Hosted
+ Cluster are to be placed. The resource group is expected to exist under the same subscription as SubscriptionID.
+
+ In ARO HCP, this will be the managed resource group where customer cloud resources will be created.
+
+ Resource group naming requirements can be found here: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ResourceGroup.Name/.
+
+ Example: if your resource group ID is /subscriptions//resourceGroups/, your
+ ResourceGroupName is .
+ maxLength: 90
+ pattern: ^[a-zA-Z0-9_()\-\.]{1,89}[a-zA-Z0-9_()\-]$
+ type: string
+ x-kubernetes-validations:
+ - message: ResourceGroupName is immutable
+ rule: self == oldSelf
+ securityGroupID:
+ description: |-
+ securityGroupID is the ID of an existing security group on the SubnetID. This field is provided as part of the
+ configuration for the Azure cloud provider, aka Azure cloud controller manager (CCM). This security group is
+ expected to exist under the same subscription as SubscriptionID.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SecurityGroupID is immutable
+ rule: self == oldSelf
+ subnetID:
+ description: |-
+ subnetID is the subnet ID of an existing subnet where the nodes in the nodepool will be created. This can be a
+ different subnet than the one listed in the HostedCluster, HostedCluster.Spec.Platform.Azure.SubnetID, but must
+ exist in the same network, HostedCluster.Spec.Platform.Azure.VnetID, and must exist under the same subscription ID,
+ HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ subnetID is immutable once set.
+ The subnetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The vnetName should be between 2 and 64 characters, consisting only of alphanumeric characters, hyphens, underscores and periods and must not end with either a period (.) or hyphen (-) character.
+ The subnetName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores and must start with an alphanumeric character and must not end with a period (.) or hyphen (-) character.
+ maxLength: 355
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`
+ rule: size(self.split('/')) == 11 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Network/virtualNetworks/.*/subnets/.*$')
+ - message: The resourceGroupName should be between 1 and 90
+ characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the subnetID must not
+ end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The vnetName should be between 2 and 64 characters,
+ consisting only of alphanumeric characters, hyphens, underscores
+ and periods
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_\\.]{2,64}')
+ - message: the vnetName in the subnetID must not end with
+ either a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[8].endsWith(''.'') && !self.split(''/'')[8].endsWith(''-'')'
+ - message: The subnetName should be between 1 and 80 characters,
+ consisting only of alphanumeric characters, hyphens and
+ underscores and must start with an alphanumeric character
+ rule: self.split('/')[10].matches('[a-zA-Z0-9][a-zA-Z0-9-_\\.]{0,79}')
+ - message: the subnetName in the subnetID must not end with
+ a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[10].endsWith(''.'') && !self.split(''/'')[10].endsWith(''-'')'
+ - message: SubnetID is immutable
+ rule: self == oldSelf
+ subscriptionID:
+ description: subscriptionID is a unique identifier for an
+ Azure subscription used to manage resources.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SubscriptionID is immutable
+ rule: self == oldSelf
+ tenantID:
+ description: tenantID is a unique identifier for the tenant
+ where Azure resources will be created and managed in.
+ maxLength: 255
+ type: string
+ vnetID:
+ description: |-
+ vnetID is the ID of an existing VNET to use in creating VMs. The VNET can exist in a different resource group
+ other than the one specified in ResourceGroupName, but it must exist under the same subscription as
+ SubscriptionID.
+
+ In ARO HCP, this will be the ID of the customer provided VNET.
+
+ Example: /subscriptions//resourceGroups//providers/Microsoft.Network/virtualNetworks/
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: VnetID is immutable
+ rule: self == oldSelf
+ required:
+ - azureAuthenticationConfig
+ - location
+ - resourceGroup
+ - securityGroupID
+ - subnetID
+ - subscriptionID
+ - tenantID
+ - vnetID
+ type: object
+ gcp:
+ description: gcp specifies configuration for clusters running
+ on Google Cloud Platform.
+ properties:
+ endpointAccess:
+ default: Private
+ description: |-
+ endpointAccess controls API endpoint accessibility for the HostedControlPlane on GCP.
+ Allowed values: "Private", "PublicAndPrivate". Defaults to "Private".
+ enum:
+ - PublicAndPrivate
+ - Private
+ type: string
+ networkConfig:
+ description: |-
+ networkConfig specifies VPC configuration for Private Service Connect.
+ Required for VPC configuration in Private Service Connect deployments.
+ properties:
+ network:
+ description: network is the VPC network name
+ properties:
+ name:
+ description: name is the name of the GCP resource
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ required:
+ - name
+ type: object
+ privateServiceConnectSubnet:
+ description: privateServiceConnectSubnet is the subnet
+ for Private Service Connect endpoints
+ properties:
+ name:
+ description: name is the name of the GCP resource
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - network
+ - privateServiceConnectSubnet
+ type: object
+ project:
+ description: |-
+ project is the GCP project ID.
+ A valid project ID must satisfy the following rules:
+ length: Must be between 6 and 30 characters, inclusive
+ characters: Only lowercase letters (`a-z`), digits (`0-9`), and hyphens (`-`) are allowed
+ start and end: Must begin with a lowercase letter and must not end with a hyphen
+ hyphens: No consecutive hyphens are allowed (e.g., "my--project" is invalid)
+ valid examples: "my-project", "my-project-1", "my-project-123".
+ maxLength: 30
+ minLength: 6
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ x-kubernetes-validations:
+ - message: Project is immutable
+ rule: self == oldSelf
+ region:
+ description: |-
+ region is the GCP region in which the cluster resides.
+ A valid region must satisfy the following rules:
+ format: Must be in the form `-`
+ characters: Only lowercase letters (`a-z`), digits (`0-9`), and a single hyphen (`-`) separator
+ valid examples: "us-central1", "europe-west2"
+ region must not include zone suffixes (e.g., "-a").
+ For a full list of valid regions, see: https://cloud.google.com/compute/docs/regions-zones.
+ maxLength: 63
+ pattern: ^[a-z]+-[a-z0-9]+[0-9]$
+ type: string
+ x-kubernetes-validations:
+ - message: Region is immutable
+ rule: self == oldSelf
+ required:
+ - networkConfig
+ - project
+ - region
+ type: object
+ ibmcloud:
+ description: ibmcloud defines IBMCloud specific settings for components
+ properties:
+ providerType:
+ description: providerType is a specific supported infrastructure
+ provider within IBM Cloud.
+ type: string
+ type: object
+ kubevirt:
+ description: kubevirt defines KubeVirt specific settings for cluster
+ components.
+ properties:
+ baseDomainPassthrough:
+ description: |-
+ baseDomainPassthrough toggles whether or not an automatically
+ generated base domain for the guest cluster should be used that
+ is a subdomain of the management cluster's *.apps DNS.
+
+ For the KubeVirt platform, the basedomain can be autogenerated using
+ the *.apps domain of the management/infra hosting cluster
+ This makes the guest cluster's base domain a subdomain of the
+ hypershift infra/mgmt cluster's base domain.
+
+ Example:
+ Infra/Mgmt cluster's DNS
+ Base: example.com
+ Cluster: mgmt-cluster.example.com
+ Apps: *.apps.mgmt-cluster.example.com
+ KubeVirt Guest cluster's DNS
+ Base: apps.mgmt-cluster.example.com
+ Cluster: guest.apps.mgmt-cluster.example.com
+ Apps: *.apps.guest.apps.mgmt-cluster.example.com
+
+ This is possible using OCP wildcard routes
+ type: boolean
+ x-kubernetes-validations:
+ - message: baseDomainPassthrough is immutable
+ rule: self == oldSelf
+ credentials:
+ description: |-
+ credentials defines the client credentials used when creating KubeVirt virtual machines.
+ Defining credentials is only necessary when the KubeVirt virtual machines are being placed
+ on a cluster separate from the one hosting the Hosted Control Plane components.
+
+ The default behavior when Credentials is not defined is for the KubeVirt VMs to be placed on
+ the same cluster and namespace as the Hosted Control Plane.
+ properties:
+ infraKubeConfigSecret:
+ description: |-
+ infraKubeConfigSecret is a reference to the secret containing the kubeconfig
+ of an external infrastructure cluster for kubevirt provider
+ properties:
+ key:
+ description: key is the key in the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: infraKubeConfigSecret is immutable
+ rule: self == oldSelf
+ infraNamespace:
+ description: |-
+ infraNamespace is the namespace in the external infrastructure cluster
+ where kubevirt resources will be created
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: infraNamespace is immutable
+ rule: self == oldSelf
+ required:
+ - infraNamespace
+ type: object
+ generateID:
+ description: |-
+ generateID is used to uniquely apply a name suffix to resources associated with
+ kubevirt infrastructure resources
+ maxLength: 11
+ type: string
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is immutable once set
+ rule: self == oldSelf
+ storageDriver:
+ description: |-
+ storageDriver defines how the KubeVirt CSI driver exposes StorageClasses on
+ the infra cluster (hosting the VMs) to the guest cluster.
+ properties:
+ manual:
+ description: |-
+ manual is used to explicitly define how the infra storageclasses are
+ mapped to guest storageclasses
+ properties:
+ storageClassMapping:
+ description: |-
+ storageClassMapping maps StorageClasses on the infra cluster hosting
+ the KubeVirt VMs to StorageClasses that are made available within the
+ Guest Cluster.
+
+ NOTE: It is possible that not all capabilities of an infra cluster's
+ storageclass will be present for the corresponding guest clusters storageclass.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestStorageClassName:
+ description: |-
+ guestStorageClassName is the name that the corresponding storageclass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraStorageClassName:
+ description: |-
+ infraStorageClassName is the name of the infra cluster storage class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestStorageClassName
+ - infraStorageClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: storageClassMapping is immutable
+ rule: self == oldSelf
+ volumeSnapshotClassMapping:
+ description: |-
+ volumeSnapshotClassMapping maps VolumeSnapshotClasses on the infra cluster hosting
+ the KubeVirt VMs to VolumeSnapshotClasses that are made available within the
+ Guest Cluster.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestVolumeSnapshotClassName:
+ description: |-
+ guestVolumeSnapshotClassName is the name that the corresponding volumeSnapshotClass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraVolumeSnapshotClassName:
+ description: |-
+ infraVolumeSnapshotClassName is the name of the infra cluster volume snapshot class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestVolumeSnapshotClassName
+ - infraVolumeSnapshotClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: volumeSnapshotClassMapping is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver.Manual is immutable
+ rule: self == oldSelf
+ type:
+ default: Default
+ description: type represents the type of kubevirt csi
+ driver configuration to use
+ enum:
+ - None
+ - Default
+ - Manual
+ type: string
+ x-kubernetes-validations:
+ - message: storageDriver.Type is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is required once set
+ rule: '!has(oldSelf.generateID) || has(self.generateID)'
+ openstack:
+ description: openstack specifies configuration for clusters running
+ on OpenStack.
+ properties:
+ disableExternalNetwork:
+ description: |-
+ disableExternalNetwork specifies whether or not to attempt to connect the cluster
+ to an external network. This allows for the creation of clusters when connecting
+ to an external network is not possible or desirable, e.g. if using a provider network.
+ type: boolean
+ externalNetwork:
+ description: |-
+ externalNetwork is the OpenStack Network to be used to get public internet to the VMs.
+ This option is ignored if DisableExternalNetwork is set to true.
+
+ If ExternalNetwork is defined it must refer to exactly one external network.
+
+ If ExternalNetwork is not defined or is empty the controller will use any
+ existing external network as long as there is only one. It is an
+ error if ExternalNetwork is not defined and there are multiple
+ external networks unless DisableExternalNetwork is also set.
+
+ If ExternalNetwork is not defined and there are no external networks
+ the controller will proceed as though DisableExternalNetwork was set.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ network. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ network to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the network to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the network
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the network to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ identityRef:
+ description: |-
+ identityRef is a reference to a secret holding OpenStack credentials
+ to be used when reconciling the hosted cluster.
+ properties:
+ cloudName:
+ description: cloudName specifies the name of the entry
+ in the clouds.yaml file to use.
+ maxLength: 255
+ type: string
+ name:
+ description: |-
+ name is the name of a secret in the same namespace as the resource being provisioned.
+ The secret must contain a key named `clouds.yaml` which contains an OpenStack clouds.yaml file.
+ The secret may optionally contain a key named `cacert` containing a PEM-encoded CA certificate.
+ maxLength: 255
+ type: string
+ required:
+ - cloudName
+ - name
+ type: object
+ ingressFloatingIP:
+ description: |-
+ ingressFloatingIP is an available floating IP in your OpenStack cluster that will
+ be associated with the OpenShift ingress port.
+ When not specified, an IP address will be assigned randomly by the OpenStack cloud provider.
+ When specified, the floating IP has to be pre-created. If the
+ specified value is not a floating IP or is already claimed, the
+ OpenStack cloud provider won't be able to provision the load
+ balancer.
+ This value must be a valid IPv4 or IPv6 address.
+ maxLength: 45
+ type: string
+ x-kubernetes-validations:
+ - message: floatingIP must be a valid IPv4 or IPv6 address
+ rule: isIP(self)
+ managedSubnets:
+ description: |-
+ managedSubnets describe the OpenStack Subnet to be created. Cluster actuator will create a network,
+ and a subnet with the defined DNSNameservers, AllocationPools and the CIDR defined in the HostedCluster
+ MachineNetwork, and a router connected to the subnet. Currently only one IPv4
+ subnet is supported.
+ items:
+ properties:
+ allocationPools:
+ description: |-
+ allocationPools is an array of AllocationPool objects that will be applied to OpenStack Subnet being created.
+ If set, OpenStack will only allocate these IPs for Machines. It will still be possible to create ports from
+ outside of these ranges manually.
+ items:
+ properties:
+ end:
+ description: end represents the end of the AlloctionPool,
+ that is the highest IP of the pool.
+ maxLength: 255
+ type: string
+ start:
+ description: start represents the start of the
+ AllocationPool, that is the lowest IP of the
+ pool.
+ maxLength: 255
+ type: string
+ required:
+ - end
+ - start
+ type: object
+ maxItems: 10
+ type: array
+ dnsNameservers:
+ description: |-
+ dnsNameservers holds a list of DNS server addresses that will be provided when creating
+ the subnet. These addresses need to have the same IP version as CIDR.
+ items:
+ maxLength: 45
+ type: string
+ maxItems: 10
+ type: array
+ type: object
+ maxItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network specifies an existing network to use if no ManagedSubnets
+ are specified.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ network. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ network to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the network to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the network
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the network to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ networkMTU:
+ description: networkMTU is the MTU for the network.
+ maximum: 9000
+ minimum: 1500
+ type: integer
+ router:
+ description: |-
+ router specifies an existing router to be used if ManagedSubnets are
+ specified. If specified, no new router will be created.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ router. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ router to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the router to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the router
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the router to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ subnets:
+ description: |-
+ subnets specifies existing subnets to use if not ManagedSubnets are
+ specified. All subnets must be in the network specified by Network.
+ There can be zero, one, or two subnets. If no subnets are specified,
+ all subnets in Network will be used. If 2 subnets are specified, one
+ must be IPv4 and the other IPv6.
+ items:
+ description: SubnetParam specifies an OpenStack subnet to
+ use. It may be specified by either ID or filter, but not
+ both.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select the
+ subnet. It must match exactly one subnet.
+ minProperties: 1
+ properties:
+ cidr:
+ description: cidr is the CIDR of the subnet to filter
+ by.
+ maxLength: 45
+ type: string
+ description:
+ description: description is the description of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ gatewayIP:
+ description: gatewayIP is the gateway IP of the
+ subnet to filter by.
+ maxLength: 45
+ type: string
+ ipVersion:
+ description: ipVersion is the IP version of the
+ subnet to filter by.
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ ipv6AddressMode:
+ description: ipv6AddressMode is the IPv6 address
+ mode of the subnet to filter by.
+ maxLength: 255
+ type: string
+ ipv6RAMode:
+ description: ipv6RAMode is the IPv6 RA mode of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the subnet to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the uuid of the subnet. It will not
+ be validated.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ tags:
+ description: tags to set on all resources in cluster which
+ support tags
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - identityRef
+ type: object
+ powervs:
+ description: |-
+ powervs specifies configuration for clusters running on IBMCloud Power VS Service.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ accountID:
+ description: |-
+ accountID is the IBMCloud account id.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the IBMCloud CIS Service Instance's Cloud Resource Name
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ pattern: '^crn:'
+ type: string
+ imageRegistryOperatorCloudCreds:
+ description: |-
+ imageRegistryOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for image registry operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ ingressOperatorCloudCreds:
+ description: |-
+ ingressOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for ingress operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ kubeCloudControllerCreds:
+ description: |
+ kubeCloudControllerCreds is a reference to a secret containing cloud
+ credentials with permissions matching the cloud controller policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ nodePoolManagementCreds:
+ description: |
+ nodePoolManagementCreds is a reference to a secret containing cloud
+ credentials with permissions matching the node pool management policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ region:
+ description: |-
+ region is the IBMCloud region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot image for a given release.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the IBMCloud Resource Group in which the cluster resides.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ serviceInstanceID:
+ description: |-
+ serviceInstanceID is the reference to the Power VS service on which the server instance(VM) will be created.
+ Power VS service is a container for all Power VS instances at a specific geographic region.
+ serviceInstance can be created via IBM Cloud catalog or CLI.
+ ServiceInstanceID is the unique identifier that can be obtained from IBM Cloud UI or IBM Cloud cli.
+
+ More detail about Power VS service instance.
+ https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-creating-power-virtual-server
+
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ storageOperatorCloudCreds:
+ description: |-
+ storageOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for storage operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ subnet:
+ description: |-
+ subnet is the subnet to use for control plane cloud resources.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ name:
+ description: name of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: |-
+ vpc specifies IBM Cloud PowerVS Load Balancing configuration for the control
+ plane.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ description: |-
+ name for VPC to used for all the service load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ region:
+ description: |-
+ region is the IBMCloud region in which VPC gets created, this VPC used for all the ingress traffic
+ into the OCP cluster.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ subnet:
+ description: |-
+ subnet is the subnet to use for load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where load balancer cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - region
+ type: object
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - accountID
+ - cisInstanceCRN
+ - imageRegistryOperatorCloudCreds
+ - ingressOperatorCloudCreds
+ - kubeCloudControllerCreds
+ - nodePoolManagementCreds
+ - region
+ - resourceGroup
+ - serviceInstanceID
+ - storageOperatorCloudCreds
+ - subnet
+ - vpc
+ - zone
+ type: object
+ type:
+ description: type is the type of infrastructure provider for the
+ cluster.
+ enum:
+ - AWS
+ - Azure
+ - IBMCloud
+ - KubeVirt
+ - Agent
+ - PowerVS
+ - None
+ - OpenStack
+ - GCP
+ maxLength: 100
+ type: string
+ x-kubernetes-validations:
+ - message: Type is immutable
+ rule: self == oldSelf
+ required:
+ - type
+ type: object
+ pullSecret:
+ description: |-
+ pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
+ and it will be injected into the container runtime of all NodePools.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ release:
+ description: |-
+ release specifies the desired OCP release payload for all the hosted cluster components.
+ This includes those components running management side like the Kube API Server and the CVO but also the operands which land in the hosted cluster data plane like the ingress controller, ovn agents, etc.
+ The maximum and minimum supported release versions are determined by the running Hypersfhit Operator.
+ Attempting to use an unsupported version will result in the HostedCluster being degraded and the validateReleaseImage condition being false.
+ Attempting to use a release with a skew against a NodePool release bigger than N-2 for the y-stream will result in leaving the NodePool in an unsupported state.
+ Changing this field will trigger a rollout of the control plane components.
+ The behavior of the rollout will be driven by the ControllerAvailabilityPolicy and InfrastructureAvailabilityPolicy for PDBs and maxUnavailable and surce policies.
+ properties:
+ image:
+ description: |-
+ image is the image pullspec of an OCP release payload image.
+ See https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags for a list of available images.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: Image must start with a word character (letters, digits,
+ or underscores) and contain no white spaces
+ rule: self.matches('^(\\w+\\S+)$')
+ required:
+ - image
+ type: object
+ secretEncryption:
+ description: |-
+ secretEncryption specifies a Kubernetes secret encryption strategy for the
+ control plane.
+ properties:
+ aescbc:
+ description: aescbc defines metadata about the AESCBC secret encryption
+ strategy
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to encrypt
+ new secrets
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - activeKey
+ type: object
+ kms:
+ description: kms defines metadata about the kms secret encryption
+ strategy
+ properties:
+ aws:
+ description: aws defines metadata about the configuration
+ of the AWS KMS Secret Encryption provider
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ auth:
+ description: auth defines metadata about the management
+ of credentials used to interact with AWS KMS
+ properties:
+ awsKms:
+ description: "awsKms is an ARN value referencing a
+ role appropriate for managing the auth via the AWS
+ KMS key.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n \t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"kms:Encrypt\",\n\t\t\t\t\"kms:Decrypt\",\n\t\t\t\t\"kms:ReEncrypt*\",\n\t\t\t\t\"kms:GenerateDataKey*\",\n\t\t\t\t\"kms:DescribeKey\"\n\t\t\t],\n\t\t\t\"Resource\":
+ %q\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - awsKms
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ region:
+ description: region contains the AWS region
+ maxLength: 255
+ type: string
+ required:
+ - activeKey
+ - auth
+ - region
+ type: object
+ azure:
+ description: azure defines metadata about the configuration
+ of the Azure KMS Secret Encryption provider using Azure
+ key vault
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ kms:
+ description: kms is a pre-existing managed identity used
+ to authenticate with Azure KMS.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity must
+ be a valid UUID. It should be 5 groups of hyphen
+ separated hexadecimal characters in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - activeKey
+ - kms
+ type: object
+ ibmcloud:
+ description: ibmcloud defines metadata for the IBM Cloud KMS
+ encryption strategy
+ properties:
+ auth:
+ description: auth defines metadata for how authentication
+ is done with IBM Cloud KMS
+ properties:
+ managed:
+ description: |-
+ managed defines metadata around the service to service authentication strategy for the IBM Cloud
+ KMS system (all provider managed).
+ type: object
+ type:
+ description: type defines the IBM Cloud KMS authentication
+ strategy
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ unmanaged:
+ description: unmanaged defines the auth metadata the
+ customer provides to interact with IBM Cloud KMS
+ properties:
+ credentials:
+ description: |-
+ credentials should reference a secret with a key field of IBMCloudIAMAPIKeySecretKey that contains a apikey to
+ call IBM Cloud KMS APIs
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - credentials
+ type: object
+ required:
+ - type
+ type: object
+ keyList:
+ description: keyList defines the list of keys used for
+ data encryption
+ items:
+ description: IBMCloudKMSKeyEntry defines metadata for
+ an IBM Cloud KMS encryption key
+ properties:
+ correlationID:
+ description: correlationID is an identifier used
+ to track all api call usage from hypershift
+ maxLength: 255
+ type: string
+ crkID:
+ description: crkID is the customer rook key id
+ maxLength: 255
+ type: string
+ instanceID:
+ description: instanceID is the id for the key protect
+ instance
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: |-
+ keyVersion is a unique number associated with the key. The number increments whenever a new
+ key is enabled for data encryption.
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ url:
+ description: url is the url to call key protect
+ apis over
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - correlationID
+ - crkID
+ - instanceID
+ - keyVersion
+ - url
+ type: object
+ maxItems: 100
+ type: array
+ region:
+ description: region is the IBM Cloud region
+ maxLength: 255
+ type: string
+ required:
+ - auth
+ - keyList
+ - region
+ type: object
+ provider:
+ description: provider defines the KMS provider
+ enum:
+ - IBMCloud
+ - AWS
+ - Azure
+ type: string
+ required:
+ - provider
+ type: object
+ type:
+ description: type defines the type of kube secret encryption being
+ used
+ enum:
+ - kms
+ - aescbc
+ type: string
+ required:
+ - type
+ type: object
+ serviceAccountSigningKey:
+ description: |-
+ serviceAccountSigningKey is a local reference to a secret that must have a "key" key whose content must be the private key
+ used by the service account token issuer.
+ If not specified, a service account signing key will
+ be generated automatically for the cluster.
+ When specifying a service account signing key, an IssuerURL must also be specified.
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ services:
+ description: |-
+ services specifies how individual control plane services endpoints are published for consumption.
+ This requires APIServer;OAuthServer;Konnectivity;Ignition.
+ This field is immutable for all platforms but IBMCloud.
+ Max is 6 to account for OIDC;OVNSbDb for backward compatibility though they are no-op.
+
+ -kubebuilder:validation:XValidation:rule="self.all(s, !(s.service == 'APIServer' && s.servicePublishingStrategy.type == 'Route') || has(s.servicePublishingStrategy.route.hostname))",message="If serviceType is 'APIServer' and publishing strategy is 'Route', then hostname must be set"
+ -kubebuilder:validation:XValidation:rule="self.platform.type == 'IBMCloud' ? ['APIServer', 'OAuthServer', 'Konnectivity'].all(requiredType, self.exists(s, s.service == requiredType))",message="Services list must contain at least 'APIServer', 'OAuthServer', and 'Konnectivity' service types" : ['APIServer', 'OAuthServer', 'Konnectivity', 'Ignition'].all(requiredType, self.exists(s, s.service == requiredType))",message="Services list must contain at least 'APIServer', 'OAuthServer', 'Konnectivity', and 'Ignition' service types"
+ -kubebuilder:validation:XValidation:rule="self.filter(s, s.servicePublishingStrategy.type == 'Route' && has(s.servicePublishingStrategy.route) && has(s.servicePublishingStrategy.route.hostname)).all(x, self.filter(y, y.servicePublishingStrategy.type == 'Route' && (has(y.servicePublishingStrategy.route) && has(y.servicePublishingStrategy.route.hostname) && y.servicePublishingStrategy.route.hostname == x.servicePublishingStrategy.route.hostname)).size() <= 1)",message="Each route publishingStrategy 'hostname' must be unique within the Services list."
+ -kubebuilder:validation:XValidation:rule="self.filter(s, s.servicePublishingStrategy.type == 'NodePort' && has(s.servicePublishingStrategy.nodePort) && has(s.servicePublishingStrategy.nodePort.address) && has(s.servicePublishingStrategy.nodePort.port)).all(x, self.filter(y, y.servicePublishingStrategy.type == 'NodePort' && (has(y.servicePublishingStrategy.nodePort) && has(y.servicePublishingStrategy.nodePort.address) && y.servicePublishingStrategy.nodePort.address == x.servicePublishingStrategy.nodePort.address && has(y.servicePublishingStrategy.nodePort.port) && y.servicePublishingStrategy.nodePort.port == x.servicePublishingStrategy.nodePort.port )).size() <= 1)",message="Each nodePort publishingStrategy 'nodePort' and 'hostname' must be unique within the Services list."
+ items:
+ description: |-
+ ServicePublishingStrategyMapping specifies how individual control plane services endpoints are published for consumption.
+ This includes APIServer;OAuthServer;Konnectivity;Ignition.
+ If a given service is not present in this list, it will be exposed publicly by default.
+ properties:
+ service:
+ description: |-
+ service identifies the type of service being published.
+ It can be APIServer;OAuthServer;Konnectivity;Ignition
+ OVNSbDb;OIDC are no-op and kept for backward compatibility.
+ This field is immutable.
+ enum:
+ - APIServer
+ - OAuthServer
+ - OIDC
+ - Konnectivity
+ - Ignition
+ - OVNSbDb
+ type: string
+ servicePublishingStrategy:
+ description: servicePublishingStrategy specifies how to publish
+ a service endpoint.
+ properties:
+ loadBalancer:
+ description: loadBalancer configures exposing a service
+ using a dedicated LoadBalancer.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the LoadBalancer and passed through to consumers of the service.
+ If omitted, the value will be inferred from the corev1.Service Load balancer type .status.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ nodePort:
+ description: nodePort configures exposing a service using
+ a NodePort.
+ properties:
+ address:
+ description: address is the host/ip that the NodePort
+ service is exposed over.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: address must be a valid hostname, IPv4, or
+ IPv6 address
+ rule: self.matches('^(([a-zA-Z0-9][-a-zA-Z0-9]*\\.)+[a-zA-Z]{2,}|localhost)$')
+ || self.matches('^((\\d{1,3}\\.){3}\\d{1,3})$')
+ || self.matches('^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$')
+ port:
+ description: |-
+ port is the port of the NodePort service. If <=0, the port is dynamically
+ assigned when the service is created.
+ format: int32
+ type: integer
+ required:
+ - address
+ type: object
+ route:
+ description: |-
+ route configures exposing a service using a Route through and an ingress controller behind a cloud Load Balancer.
+ The specifics of the setup are platform dependent.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the Route and passed through to consumers of the service.
+ If omitted, the value will be inferred from management ingress.Spec.Domain.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy used for the service.
+ It can be LoadBalancer;NodePort;Route;None;S3
+ enum:
+ - LoadBalancer
+ - NodePort
+ - Route
+ - None
+ - S3
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: nodePort is required when type is NodePort, and forbidden
+ otherwise
+ rule: 'self.type == ''NodePort'' ? has(self.nodePort) : !has(self.nodePort)'
+ - message: only route is allowed when type is Route, and forbidden
+ otherwise
+ rule: 'self.type == ''Route'' ? !has(self.nodePort) && !has(self.loadBalancer)
+ : !has(self.route)'
+ - message: only loadBalancer is required when type is LoadBalancer,
+ and forbidden otherwise
+ rule: 'self.type == ''LoadBalancer'' ? !has(self.nodePort)
+ && !has(self.route) : !has(self.loadBalancer)'
+ - message: None does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''None'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ - message: S3 does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''S3'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ required:
+ - service
+ - servicePublishingStrategy
+ type: object
+ maxItems: 6
+ type: array
+ sshKey:
+ description: |-
+ sshKey is a local reference to a Secret that must have a "id_rsa.pub" key whose content must be the public part of 1..N SSH keys.
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ When sshKey is set, the controllers will generate a machineConfig with the sshAuthorizedKeys https://coreos.github.io/ignition/configuration-v3_2/ populated with this value.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ tolerations:
+ description: tolerations when specified, define what custom tolerations
+ are added to the hcp pods.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ maxItems: 25
+ type: array
+ updateService:
+ description: |-
+ updateService may be used to specify the preferred upstream update service.
+ If omitted we will use the appropriate update service for the cluster and region.
+ This is used by the control plane operator to determine and signal the appropriate available upgrades in the hostedCluster.status.
+ type: string
+ x-kubernetes-validations:
+ - message: updateService must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - etcd
+ - networking
+ - platform
+ - pullSecret
+ - release
+ - services
+ type: object
+ x-kubernetes-validations:
+ - message: spec.services in body should have at least 4 items or 3 for
+ IBMCloud
+ rule: 'self.platform.type == ''IBMCloud'' ? size(self.services) >= 3
+ : size(self.services) >= 4'
+ - message: Services is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: 'self.platform.type != "IBMCloud" ? self.services == oldSelf.services
+ : true'
+ - message: Azure platform requires OAuthServer to use Route service publishing
+ strategy
+ rule: 'self.platform.type == "Azure" ? self.services.exists(s, s.service
+ == "OAuthServer" && s.servicePublishingStrategy.type == "Route") :
+ true'
+ - message: Azure platform requires Konnectivity to use Route service publishing
+ strategy
+ rule: 'self.platform.type == "Azure" ? self.services.exists(s, s.service
+ == "Konnectivity" && s.servicePublishingStrategy.type == "Route")
+ : true'
+ - message: Azure platform requires Ignition to use Route service publishing
+ strategy
+ rule: 'self.platform.type == "Azure" ? self.services.exists(s, s.service
+ == "Ignition" && s.servicePublishingStrategy.type == "Route") : true'
+ - message: If serviceAccountSigningKey is set, issuerURL must be set
+ rule: has(self.issuerURL) || !has(self.serviceAccountSigningKey)
+ - message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
+ rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
+ && s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
+ && has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
+ cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
+ - message: disableMultiNetwork can only be set to true when networkType
+ is 'Other'
+ rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)
+ || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork)
+ || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork
+ || self.networking.networkType == ''Other'''
+ - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
+ rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
+ || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
+ status:
+ description: status is the latest observed status of the HostedCluster.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the latest available observations of a control
+ plane's current state.
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ configuration:
+ description: configuration contains the cluster configuration status
+ of the HostedCluster
+ properties:
+ authentication:
+ description: |-
+ authentication contains the observed authentication configuration status from the hosted cluster.
+ This field reflects the current state of the cluster authentication including OAuth metadata,
+ OIDC client status, and other authentication-related configurations.
+ properties:
+ integratedOAuthMetadata:
+ description: |-
+ integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for the in-cluster integrated OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ This contains the observed value based on cluster state.
+ An explicitly set value in spec.oauthMetadata has precedence over this field.
+ This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
+ The key "oauthMetadata" is used to locate the data.
+ If the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config-managed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcClients:
+ description: |-
+ oidcClients is where participating operators place the current OIDC client status
+ for OIDC clients that can be customized by the cluster-admin.
+ items:
+ description: |-
+ OIDCClientStatus represents the current state
+ of platform components and how they interact with
+ the configured identity providers.
+ properties:
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component using the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component using the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ conditions:
+ description: |-
+ conditions are used to communicate the state of the `oidcClients` entry.
+
+ Supported conditions include Available, Degraded and Progressing.
+
+ If Available is true, the component is successfully using the configured client.
+ If Degraded is true, that means something has gone wrong trying to handle the client configuration.
+ If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or
+ in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ consumingUsers:
+ description: |-
+ consumingUsers is an optional list of ServiceAccounts requiring
+ read permissions on the `clientSecret` secret.
+
+ consumingUsers must not exceed 5 entries.
+ items:
+ description: ConsumingUser is an alias for string
+ which we add validation to. Currently only service
+ accounts are supported.
+ maxLength: 512
+ minLength: 1
+ pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ maxItems: 5
+ type: array
+ x-kubernetes-list-type: set
+ currentOIDCClients:
+ description: |-
+ currentOIDCClients is an optional list of clients that the component is currently using.
+ Entries must have unique issuerURL/clientID pairs.
+ items:
+ description: |-
+ OIDCClientReference is a reference to a platform component
+ client configuration.
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that specifies the client identifier, from
+ the identity provider, that the platform component is using for authentication
+ requests made to the identity provider.
+
+ clientID must not be empty.
+ minLength: 1
+ type: string
+ issuerURL:
+ description: |-
+ issuerURL is a required field that specifies the URL of the identity
+ provider that this client is configured to make requests against.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ oidcProviderName:
+ description: |-
+ oidcProviderName is a required reference to the 'name' of the identity provider
+ configured in 'oidcProviders' that this client is associated with.
+
+ oidcProviderName must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - clientID
+ - issuerURL
+ - oidcProviderName
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - issuerURL
+ - clientID
+ x-kubernetes-list-type: map
+ required:
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ type: object
+ type: object
+ controlPlaneEndpoint:
+ description: |-
+ controlPlaneEndpoint contains the endpoint information by which
+ external clients can access the control plane. This is populated
+ after the infrastructure is ready.
+ properties:
+ host:
+ description: host is the hostname on which the API server is serving.
+ maxLength: 255
+ type: string
+ port:
+ description: port is the port on which the API server is serving.
+ format: int32
+ type: integer
+ required:
+ - host
+ - port
+ type: object
+ customKubeconfig:
+ description: |-
+ customKubeconfig is a local secret reference to the external custom kubeconfig.
+ Once the hypershift operator sets this status field, it will generate a secret with the specified name containing a kubeconfig within the `HostedCluster` namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ ignitionEndpoint:
+ description: |-
+ ignitionEndpoint is the endpoint injected in the ign config userdata.
+ It exposes the config for instances to become kubernetes nodes.
+ maxLength: 1024
+ type: string
+ kubeadminPassword:
+ description: |-
+ kubeadminPassword is a reference to the secret that contains the initial
+ kubeadmin user password for the guest cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ kubeconfig:
+ description: |-
+ kubeconfig is a reference to the secret containing the default kubeconfig
+ for the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ oauthCallbackURLTemplate:
+ description: |-
+ oauthCallbackURLTemplate contains a template for the URL to use as a callback
+ for identity providers. The [identity-provider-name] placeholder must be replaced
+ with the name of an identity provider defined on the HostedCluster.
+ This is populated after the infrastructure is ready.
+ maxLength: 1024
+ type: string
+ payloadArch:
+ description: |-
+ payloadArch represents the CPU architecture type of the HostedCluster.Spec.Release.Image. The valid values are:
+ Multi, ARM64, AMD64, S390X, or PPC64LE.
+ enum:
+ - Multi
+ - ARM64
+ - AMD64
+ - PPC64LE
+ - S390X
+ type: string
+ platform:
+ description: platform contains platform-specific status of the HostedCluster
+ properties:
+ aws:
+ description: aws contains platform-specific status for AWS
+ properties:
+ defaultWorkerSecurityGroupID:
+ description: |-
+ defaultWorkerSecurityGroupID is the ID of a security group created by
+ the control plane operator. It is always added to worker machines in
+ addition to any security groups specified in the NodePool.
+ maxLength: 255
+ type: string
+ type: object
+ type: object
+ version:
+ description: |-
+ version is the status of the release version applied to the
+ HostedCluster.
+ properties:
+ availableUpdates:
+ description: |-
+ availableUpdates contains updates recommended for this
+ cluster. Updates which appear in conditionalUpdates but not in
+ availableUpdates may expose this cluster to known issues. This list
+ may be empty if no updates are recommended, if the update service
+ is unavailable, or if an invalid channel has been specified.
+ items:
+ description: Release represents an OpenShift release image and
+ associated metadata.
+ properties:
+ architecture:
+ description: |-
+ architecture is an optional field that indicates the
+ value of the cluster architecture. In this context cluster
+ architecture means either a single architecture or a multi
+ architecture.
+ Valid values are 'Multi' and empty.
+ enum:
+ - Multi
+ - ""
+ type: string
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ maxItems: 100
+ nullable: true
+ type: array
+ conditionalUpdates:
+ description: |-
+ conditionalUpdates contains the list of updates that may be
+ recommended for this cluster if it meets specific required
+ conditions. Consumers interested in the set of updates that are
+ actually recommended for this cluster should use
+ availableUpdates. This list may be empty if no updates are
+ recommended, if the update service is unavailable, or if an empty
+ or invalid channel has been specified.
+ items:
+ description: |-
+ ConditionalUpdate represents an update which is recommended to some
+ clusters on the version the current cluster is reconciling, but which
+ may not be recommended for the current cluster.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the observations of the conditional update's
+ current status. Known types are:
+ * Recommended, for whether the update is recommended for the current cluster.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in
+ foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ release:
+ description: release is the target of the update.
+ properties:
+ architecture:
+ description: |-
+ architecture is an optional field that indicates the
+ value of the cluster architecture. In this context cluster
+ architecture means either a single architecture or a multi
+ architecture.
+ Valid values are 'Multi' and empty.
+ enum:
+ - Multi
+ - ""
+ type: string
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ risks:
+ description: |-
+ risks represents the range of issues associated with
+ updating to the target release. The cluster-version
+ operator will evaluate all entries, and only recommend the
+ update if there is at least one entry and all entries
+ recommend the update.
+ items:
+ description: |-
+ ConditionalUpdateRisk represents a reason and cluster-state
+ for not recommending a conditional update.
+ properties:
+ matchingRules:
+ description: |-
+ matchingRules is a slice of conditions for deciding which
+ clusters match the risk and which do not. The slice is
+ ordered by decreasing precedence. The cluster-version
+ operator will walk the slice in order, and stop after the
+ first it can successfully evaluate. If no condition can be
+ successfully evaluated, the update will not be recommended.
+ items:
+ description: |-
+ ClusterCondition is a union of typed cluster conditions. The 'type'
+ property determines which of the type-specific properties are relevant.
+ When evaluated on a cluster, the condition may match, not match, or
+ fail to evaluate.
+ properties:
+ promql:
+ description: promql represents a cluster condition
+ based on PromQL.
+ properties:
+ promql:
+ description: |-
+ promql is a PromQL query classifying clusters. This query
+ query should return a 1 in the match case and a 0 in the
+ does-not-match case. Queries which return no time
+ series, or which return values besides 0 or 1, are
+ evaluation failures.
+ type: string
+ required:
+ - promql
+ type: object
+ type:
+ description: |-
+ type represents the cluster-condition type. This defines
+ the members and semantics of any additional properties.
+ enum:
+ - Always
+ - PromQL
+ type: string
+ required:
+ - type
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ message:
+ description: |-
+ message provides additional information about the risk of
+ updating, in the event that matchingRules match the cluster
+ state. This is only to be consumed by humans. It may
+ contain Line Feed characters (U+000A), which should be
+ rendered as new lines.
+ minLength: 1
+ type: string
+ name:
+ description: |-
+ name is the CamelCase reason for not recommending a
+ conditional update, in the event that matchingRules match the
+ cluster state.
+ minLength: 1
+ type: string
+ url:
+ description: url contains information about this risk.
+ format: uri
+ minLength: 1
+ type: string
+ required:
+ - matchingRules
+ - message
+ - name
+ - url
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - release
+ - risks
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-type: atomic
+ desired:
+ description: |-
+ desired is the version that the cluster is reconciling towards.
+ If the cluster is not yet fully initialized desired will be set
+ with the information available, which may be an image or a tag.
+ properties:
+ architecture:
+ description: |-
+ architecture is an optional field that indicates the
+ value of the cluster architecture. In this context cluster
+ architecture means either a single architecture or a multi
+ architecture.
+ Valid values are 'Multi' and empty.
+ enum:
+ - Multi
+ - ""
+ type: string
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ history:
+ description: |-
+ history contains a list of the most recent versions applied to the cluster.
+ This value may be empty during cluster startup, and then will be updated
+ when a new update is being applied. The newest update is first in the
+ list and it is ordered by recency. Updates in the history have state
+ Completed if the rollout completed - if an update was failing or halfway
+ applied the state will be Partial. Only a limited amount of update history
+ is preserved.
+ items:
+ description: UpdateHistory is a single attempted update to the
+ cluster.
+ properties:
+ acceptedRisks:
+ description: |-
+ acceptedRisks records risks which were accepted to initiate the update.
+ For example, it may menition an Upgradeable=False or missing signature
+ that was overriden via desiredUpdate.force, or an update that was
+ initiated despite not being in the availableUpdates set of recommended
+ update targets.
+ type: string
+ completionTime:
+ description: |-
+ completionTime, if set, is when the update was fully applied. The update
+ that is currently being applied will have a null completion time.
+ Completion time will always be set for entries that are not the current
+ update (usually to the started time of the next update).
+ format: date-time
+ nullable: true
+ type: string
+ image:
+ description: |-
+ image is a container image location that contains the update. This value
+ is always populated.
+ type: string
+ startedTime:
+ description: startedTime is the time at which the update
+ was started.
+ format: date-time
+ type: string
+ state:
+ description: |-
+ state reflects whether the update was fully applied. The Partial state
+ indicates the update is not fully applied, while the Completed state
+ indicates the update was successfully rolled out at least once (all
+ parts of the update successfully applied).
+ type: string
+ verified:
+ description: |-
+ verified indicates whether the provided update was properly verified
+ before it was installed. If this is false the cluster may not be trusted.
+ Verified does not cover upgradeable checks that depend on the cluster
+ state at the time when the update target was accepted.
+ type: boolean
+ version:
+ description: |-
+ version is a semantic version identifying the update version. If the
+ requested image does not define a version, or if a failure occurs
+ retrieving the image, this value may be empty.
+ type: string
+ required:
+ - completionTime
+ - image
+ - startedTime
+ - state
+ - verified
+ type: object
+ type: array
+ observedGeneration:
+ description: |-
+ observedGeneration reports which version of the spec is being synced.
+ If this value is not equal to metadata.generation, then the desired
+ and conditions fields may represent a previous version.
+ format: int64
+ type: integer
+ required:
+ - availableUpdates
+ - desired
+ - observedGeneration
+ type: object
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/hostedclusters-Default.crd.yaml b/cmd/install/assets/hypershift-operator/hostedclusters-Default.crd.yaml
new file mode 100644
index 00000000000..a2d6138dafb
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/hostedclusters-Default.crd.yaml
@@ -0,0 +1,7215 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: Default
+ name: hostedclusters.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ kind: HostedCluster
+ listKind: HostedClusterList
+ plural: hostedclusters
+ shortNames:
+ - hc
+ - hcs
+ singular: hostedcluster
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: Version
+ jsonPath: .status.version.history[?(@.state=="Completed")].version
+ name: Version
+ type: string
+ - description: KubeConfig Secret
+ jsonPath: .status.kubeconfig.name
+ name: KubeConfig
+ type: string
+ - description: Progress
+ jsonPath: .status.version.history[?(@.state!="")].state
+ name: Progress
+ type: string
+ - description: Available
+ jsonPath: .status.conditions[?(@.type=="Available")].status
+ name: Available
+ type: string
+ - description: Progressing
+ jsonPath: .status.conditions[?(@.type=="Progressing")].status
+ name: Progressing
+ type: string
+ - description: Message
+ jsonPath: .status.conditions[?(@.type=="Available")].message
+ name: Message
+ type: string
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ HostedCluster is the primary representation of a HyperShift cluster and encapsulates
+ the control plane and common data plane configuration. Creating a HostedCluster
+ results in a fully functional OpenShift control plane with no attached nodes.
+ To support workloads (e.g. pods), a HostedCluster may have one or more associated
+ NodePool resources.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the desired behavior of the HostedCluster.
+ properties:
+ additionalTrustBundle:
+ description: |-
+ additionalTrustBundle is a local reference to a ConfigMap that must have a "ca-bundle.crt" key
+ whose content must be a PEM-encoded X.509 certificate bundle that will be added to the hosted controlplane and nodes
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ This will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ auditWebhook:
+ description: |-
+ auditWebhook contains metadata for configuring an audit webhook endpoint
+ for a cluster to process cluster audit events. It references a secret that
+ contains the webhook information for the audit webhook endpoint. It is a
+ secret because if the endpoint has mTLS the kubeconfig will contain client
+ keys. The kubeconfig needs to be stored in the secret with a secret key
+ name that corresponds to the constant AuditWebhookKubeconfigKey.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ autoscaling:
+ description: |-
+ autoscaling specifies auto-scaling behavior that applies to all NodePools
+ associated with this HostedCluster.
+ properties:
+ balancingIgnoredLabels:
+ description: |-
+ balancingIgnoredLabels sets "--balancing-ignore-label " flag on cluster-autoscaler for each listed label.
+ This option specifies labels that cluster autoscaler should ignore when considering node group similarity.
+ For example, if you have nodes with "topology.ebs.csi.aws.com/zone" label, you can add name of this label here
+ to prevent cluster autoscaler from splitting nodes into different node groups based on its value.
+
+ HyperShift automatically appends platform-specific balancing ignore labels:
+ - AWS: "lifecycle", "k8s.amazonaws.com/eniConfig", "topology.k8s.aws/zone-id"
+ - Azure: "agentpool", "kubernetes.azure.com/agentpool"
+ - Common:
+ - "hypershift.openshift.io/nodePool"
+ - "topology.ebs.csi.aws.com/zone"
+ - "topology.disk.csi.azure.com/zone"
+ - "ibm-cloud.kubernetes.io/worker-id"
+ - "vpc-block-csi-driver-labels"
+ These labels are added by default and do not need to be manually specified.
+ items:
+ maxLength: 317
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-validations:
+ - message: Each balancingIgnoredLabels item must be a valid label
+ key
+ rule: self.all(l, l.matches('^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?[a-zA-Z0-9]([a-zA-Z0-9_.-]{0,61}[a-zA-Z0-9])?$'))
+ expanders:
+ description: |-
+ expanders guide the autoscaler in choosing node groups during scale-out.
+ Sets the order of expanders for scaling out node groups.
+ Options include:
+ * LeastWaste - selects the group with minimal idle CPU and memory after scaling.
+ * Priority - selects the group with the highest user-defined priority.
+ * Random - selects a group randomly.
+ If not specified, `[Priority, LeastWaste]` is the default.
+ Maximum of 3 expanders can be specified.
+ items:
+ description: ExpanderString contains the name of an expander
+ to be used by the cluster autoscaler.
+ enum:
+ - LeastWaste
+ - Priority
+ - Random
+ type: string
+ maxItems: 3
+ minItems: 1
+ type: array
+ maxFreeDifferenceRatioPercent:
+ description: |-
+ maxFreeDifferenceRatioPercent sets the maximum difference ratio for free resources between similar node groups. This parameter controls how strict the similarity check is when comparing node groups for load balancing.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means node groups must have exactly the same free resources to be considered similar (no difference allowed).
+ When set to 100, this means node groups will be considered similar regardless of their free resource differences (any difference allowed).
+ A value between 0 and 100 represents the maximum allowed difference ratio for free resources between node groups to be considered similar.
+ When omitted, the autoscaler defaults to 10%.
+ This affects the "--max-free-difference-ratio" flag on cluster-autoscaler.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ maxNodeProvisionTime:
+ description: |-
+ maxNodeProvisionTime is the maximum time to wait for node provisioning
+ before considering the provisioning to be unsuccessful, expressed as a Go
+ duration string. The default is 15 minutes.
+ maxLength: 100
+ pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
+ type: string
+ maxNodesTotal:
+ description: |-
+ maxNodesTotal is the maximum allowable number of nodes for the Autoscaler scale out to be operational.
+ The autoscaler will not grow the cluster beyond this number.
+ If omitted, the autoscaler will not have a maximum limit.
+ number.
+ format: int32
+ minimum: 0
+ type: integer
+ maxPodGracePeriod:
+ description: |-
+ maxPodGracePeriod is the maximum seconds to wait for graceful pod
+ termination before scaling down a NodePool. The default is 600 seconds.
+ format: int32
+ minimum: 0
+ type: integer
+ podPriorityThreshold:
+ description: |-
+ podPriorityThreshold enables users to schedule "best-effort" pods, which
+ shouldn't trigger autoscaler actions, but only run when there are spare
+ resources available. The default is -10.
+
+ See the following for more details:
+ https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#how-does-cluster-autoscaler-work-with-pod-priority-and-preemption
+ format: int32
+ type: integer
+ scaleDown:
+ description: |-
+ scaleDown configures the behavior of the Cluster Autoscaler scale down operation.
+ This field is only valid when scaling is set to ScaleUpAndScaleDown.
+ properties:
+ delayAfterAddSeconds:
+ description: |-
+ delayAfterAddSeconds sets how long after scale up the scale down evaluation resumes in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after scale up, without any delay.
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterDeleteSeconds:
+ description: |-
+ delayAfterDeleteSeconds sets how long after node deletion, scale down evaluation resumes, defaults to scan-interval.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after node deletion, without any delay.
+ When omitted, the autoscaler defaults to 0s.
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterFailureSeconds:
+ description: |-
+ delayAfterFailureSeconds sets how long after a scale down failure, scale down evaluation resumes.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after a scale down failure, without any delay.
+ When omitted, the autoscaler defaults to 180s (3 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ unneededDurationSeconds:
+ description: |-
+ unneededDurationSeconds establishes how long a node should be unneeded before it is eligible for scale down in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ utilizationThresholdPercent:
+ description: |-
+ utilizationThresholdPercent determines the node utilization level, defined as sum of requested resources divided by capacity, below which a node can be considered for scale down.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means nodes will only be considered for scale down if they are completely idle (0% utilization).
+ When set to 100, this means nodes will be considered for scale down regardless of their utilization level.
+ A value between 0 and 100 represents the utilization threshold below which a node can be considered for scale down.
+ When omitted, the autoscaler defaults to 50%.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ type: object
+ scaling:
+ default: ScaleUpAndScaleDown
+ description: |-
+ scaling defines the scaling behavior for the cluster autoscaler.
+ ScaleUpOnly means the autoscaler will only scale up nodes, never scale down.
+ ScaleUpAndScaleDown means the autoscaler will both scale up and scale down nodes.
+ When set to ScaleUpAndScaleDown, the scaleDown field can be used to configure scale down behavior.
+
+ Note: This field is only supported in OpenShift versions 4.19 and above.
+ enum:
+ - ScaleUpOnly
+ - ScaleUpAndScaleDown
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: scaleDown can only be set when scaling is ScaleUpAndScaleDown
+ rule: 'self.scaling == ''ScaleUpAndScaleDown'' ? true : !has(self.scaleDown)'
+ capabilities:
+ default: {}
+ description: |-
+ capabilities allows for disabling optional components at cluster install time.
+ This field is optional and once set cannot be changed.
+ properties:
+ disabled:
+ description: |-
+ disabled when specified, explicitly disables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+
+ Note: Disabling 'openshift-samples','Insights', 'Console', 'NodeTuning', 'Ingress' are only supported in OpenShift versions 4.20 and above.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Disabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Ingress capability can only be disabled if Console
+ capability is also disabled
+ rule: '!self.exists(cap, cap == ''Ingress'') || self.exists(cap,
+ cap == ''Console'')'
+ enabled:
+ description: |-
+ enabled when specified, explicitly enables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Enabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Capabilities is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Capabilities can not be both enabled and disabled at once.
+ rule: 'has(self.enabled) && has(self.disabled) ? self.enabled.all(e,
+ !(e in self.disabled)) : true'
+ channel:
+ description: |-
+ channel is an identifier for explicitly requesting that a non-default set of updates be applied to this cluster.
+ If omitted no particular upgrades are suggested.
+ maxLength: 100
+ minLength: 1
+ type: string
+ clusterID:
+ description: |-
+ clusterID uniquely identifies this cluster. This is expected to be an RFC4122 UUID value (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx in hexadecimal digits).
+ As with a Kubernetes metadata.uid, this ID uniquely identifies this cluster in space and time.
+ This value identifies the cluster in metrics pushed to telemetry and metrics produced by the control plane operators.
+ If a value is not specified, a random clusterID will be generated and set by the controller.
+ Once set, this value is immutable.
+ maxLength: 36
+ minLength: 36
+ type: string
+ x-kubernetes-validations:
+ - message: clusterID must be an RFC4122 UUID value (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+ in hexadecimal digits)
+ rule: self.matches('[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}')
+ - message: clusterID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ configuration:
+ description: |-
+ configuration specifies configuration for individual OCP components in the
+ cluster, represented as embedded resources that correspond to the openshift
+ configuration API.
+ properties:
+ apiServer:
+ description: |-
+ apiServer holds configuration (like serving certificates, client CA and CORS domains)
+ shared by all API servers in the system, among them especially kube-apiserver
+ and openshift-apiserver.
+ properties:
+ additionalCORSAllowedOrigins:
+ description: |-
+ additionalCORSAllowedOrigins lists additional, user-defined regular expressions describing hosts for which the
+ API server allows access using the CORS headers. This may be needed to access the API and the integrated OAuth
+ server from JavaScript applications.
+ The values are regular expressions that correspond to the Golang regular expression language.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ audit:
+ default:
+ profile: Default
+ description: |-
+ audit specifies the settings for audit configuration to be applied to all OpenShift-provided
+ API servers in the cluster.
+ properties:
+ customRules:
+ description: |-
+ customRules specify profiles per group. These profile take precedence over the
+ top-level profile field if they apply. They are evaluation from top to bottom and
+ the first one that matches, applies.
+ items:
+ description: |-
+ AuditCustomRule describes a custom rule for an audit profile that takes precedence over
+ the top-level profile.
+ properties:
+ group:
+ description: group is a name of group a request
+ user must be member of in order to this profile
+ to apply.
+ minLength: 1
+ type: string
+ profile:
+ description: |-
+ profile specifies the name of the desired audit policy configuration to be deployed to
+ all OpenShift-provided API servers in the cluster.
+
+ The following profiles are provided:
+ - Default: the existing default policy.
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ required:
+ - group
+ - profile
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - group
+ x-kubernetes-list-type: map
+ profile:
+ default: Default
+ description: |-
+ profile specifies the name of the desired top-level audit profile to be applied to all requests
+ sent to any of the OpenShift-provided API servers in the cluster (kube-apiserver,
+ openshift-apiserver and oauth-apiserver), with the exception of those requests that match
+ one or more of the customRules.
+
+ The following profiles are provided:
+ - Default: default policy which means MetaData level logging with the exception of events
+ (not logged at all), oauthaccesstokens and oauthauthorizetokens (both logged at RequestBody
+ level).
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ Warning: It is not recommended to disable audit logging by using the `None` profile unless you
+ are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues.
+ If you disable audit logging and a support situation arises, you might need to enable audit logging
+ and reproduce the issue in order to troubleshoot properly.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ type: object
+ clientCA:
+ description: |-
+ clientCA references a ConfigMap containing a certificate bundle for the signers that will be recognized for
+ incoming client certificates in addition to the operator managed signers. If this is empty, then only operator managed signers are valid.
+ You usually only have to set this if you have your own PKI you wish to honor client certificates from.
+ The ConfigMap must exist in the openshift-config namespace and contain the following required fields:
+ - ConfigMap.Data["ca-bundle.crt"] - CA bundle.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ encryption:
+ description: encryption allows the configuration of encryption
+ of resources at the datastore layer.
+ properties:
+ type:
+ description: |-
+ type defines what encryption type should be used to encrypt resources at the datastore layer.
+ When this field is unset (i.e. when it is set to the empty string), identity is implied.
+ The behavior of unset can and will change over time. Even if encryption is enabled by default,
+ the meaning of unset may change to a different encryption type based on changes in best practices.
+
+ When encryption is enabled, all sensitive resources shipped with the platform are encrypted.
+ This list of sensitive resources can and will change over time. The current authoritative list is:
+
+ 1. secrets
+ 2. configmaps
+ 3. routes.route.openshift.io
+ 4. oauthaccesstokens.oauth.openshift.io
+ 5. oauthauthorizetokens.oauth.openshift.io
+ enum:
+ - ""
+ - identity
+ - aescbc
+ - aesgcm
+ type: string
+ type: object
+ servingCerts:
+ description: |-
+ servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates
+ will be used for serving secure traffic.
+ properties:
+ namedCertificates:
+ description: |-
+ namedCertificates references secrets containing the TLS cert info for serving secure traffic to specific hostnames.
+ If no named certificates are provided, or no named certificates match the server name as understood by a client,
+ the defaultServingCertificate will be used.
+ items:
+ description: APIServerNamedServingCert maps a server
+ DNS name, as understood by a client, to a certificate.
+ properties:
+ names:
+ description: |-
+ names is a optional list of explicit DNS names (leading wildcards allowed) that should use this certificate to
+ serve secure traffic. If no names are provided, the implicit names will be extracted from the certificates.
+ Exact names trump over wildcard names. Explicit names defined here trump over extracted implicit names.
+ items:
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-list-type: atomic
+ servingCertificate:
+ description: |-
+ servingCertificate references a kubernetes.io/tls type secret containing the TLS cert info for serving secure traffic.
+ The secret must exist in the openshift-config namespace and contain the following required fields:
+ - Secret.Data["tls.key"] - TLS private key.
+ - Secret.Data["tls.crt"] - TLS certificate.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ tlsSecurityProfile:
+ description: |-
+ tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
+
+ If unset, a default (which may change between releases) is chosen. Note that only Old,
+ Intermediate and Custom profiles are currently supported, and the maximum available
+ minTLSVersion is VersionTLS12.
+ properties:
+ custom:
+ description: |-
+ custom is a user-defined TLS security profile. Be extremely careful using a custom
+ profile as invalid configurations can be catastrophic. An example custom profile
+ looks like this:
+
+ ciphers:
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ minTLSVersion: VersionTLS11
+ nullable: true
+ properties:
+ ciphers:
+ description: |-
+ ciphers is used to specify the cipher algorithms that are negotiated
+ during the TLS handshake. Operators may remove entries their operands
+ do not support. For example, to use DES-CBC3-SHA (yaml):
+
+ ciphers:
+ - DES-CBC3-SHA
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ minTLSVersion:
+ description: |-
+ minTLSVersion is used to specify the minimal version of the TLS protocol
+ that is negotiated during the TLS handshake. For example, to use TLS
+ versions 1.1, 1.2 and 1.3 (yaml):
+
+ minTLSVersion: VersionTLS11
+
+ NOTE: currently the highest minTLSVersion allowed is VersionTLS12
+ enum:
+ - VersionTLS10
+ - VersionTLS11
+ - VersionTLS12
+ - VersionTLS13
+ type: string
+ type: object
+ intermediate:
+ description: |-
+ intermediate is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ minTLSVersion: VersionTLS12
+ nullable: true
+ type: object
+ modern:
+ description: |-
+ modern is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ minTLSVersion: VersionTLS13
+ nullable: true
+ type: object
+ old:
+ description: |-
+ old is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ - DHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-ECDSA-AES128-SHA256
+
+ - ECDHE-RSA-AES128-SHA256
+
+ - ECDHE-ECDSA-AES128-SHA
+
+ - ECDHE-RSA-AES128-SHA
+
+ - ECDHE-ECDSA-AES256-SHA384
+
+ - ECDHE-RSA-AES256-SHA384
+
+ - ECDHE-ECDSA-AES256-SHA
+
+ - ECDHE-RSA-AES256-SHA
+
+ - DHE-RSA-AES128-SHA256
+
+ - DHE-RSA-AES256-SHA256
+
+ - AES128-GCM-SHA256
+
+ - AES256-GCM-SHA384
+
+ - AES128-SHA256
+
+ - AES256-SHA256
+
+ - AES128-SHA
+
+ - AES256-SHA
+
+ - DES-CBC3-SHA
+
+ minTLSVersion: VersionTLS10
+ nullable: true
+ type: object
+ type:
+ description: |-
+ type is one of Old, Intermediate, Modern or Custom. Custom provides
+ the ability to specify individual TLS security profile parameters.
+ Old, Intermediate and Modern are TLS security profiles based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
+
+ The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers
+ are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be
+ reduced.
+
+ Note that the Modern profile is currently not supported because it is not
+ yet well adopted by common software libraries.
+ enum:
+ - Old
+ - Intermediate
+ - Modern
+ - Custom
+ type: string
+ type: object
+ type: object
+ authentication:
+ description: |-
+ authentication specifies cluster-wide settings for authentication (like OAuth and
+ webhook token authenticators).
+ properties:
+ oauthMetadata:
+ description: |-
+ oauthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for an external OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ If oauthMetadata.name is non-empty, this value has precedence
+ over any metadata reference stored in status.
+ The key "oauthMetadata" is used to locate the data.
+ If specified and the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcProviders:
+ description: |-
+ oidcProviders are OIDC identity providers that can issue tokens
+ for this cluster
+ Can only be set if "Type" is set to "OIDC".
+
+ At most one provider can be configured.
+ items:
+ properties:
+ claimMappings:
+ description: |-
+ claimMappings is an optional field that configures the rules to be used by
+ the Kubernetes API server for translating claims in a JWT token, issued
+ by the identity provider, to a cluster identity.
+ properties:
+ extra:
+ description: |-
+ extra is an optional field for configuring the mappings
+ used to construct the extra attribute for the cluster identity.
+ When omitted, no extra attributes will be present on the cluster identity.
+ key values for extra mappings must be unique.
+ A maximum of 64 extra attribute mappings may be provided.
+ items:
+ description: |-
+ ExtraMapping allows specifying a key and CEL expression
+ to evaluate the keys' value. It is used to create additional
+ mappings and attributes added to a cluster identity from
+ a provided authentication token.
+ properties:
+ key:
+ description: |-
+ key is a required field that specifies the string
+ to use as the extra attribute key.
+
+ key must be a domain-prefix path (e.g 'example.org/foo').
+ key must not exceed 510 characters in length.
+ key must contain the '/' character, separating the domain and path characters.
+ key must not be empty.
+
+ The domain portion of the key (string of characters prior to the '/') must be a valid RFC1123 subdomain.
+ It must not exceed 253 characters in length.
+ It must start and end with an alphanumeric character.
+ It must only contain lower case alphanumeric characters and '-' or '.'.
+ It must not use the reserved domains, or be subdomains of, "kubernetes.io", "k8s.io", and "openshift.io".
+
+ The path portion of the key (string of characters after the '/') must not be empty and must consist of at least one
+ alphanumeric character, percent-encoded octets, '-', '.', '_', '~', '!', '$', '&', ''', '(', ')', '*', '+', ',', ';', '=', and ':'.
+ It must not exceed 256 characters in length.
+ maxLength: 510
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: key must contain the '/' character
+ rule: self.contains('/')
+ - message: the domain of the key must consist
+ of only lower case alphanumeric characters,
+ '-' or '.', and must start and end with
+ an alphanumeric character
+ rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
+ - message: the domain of the key must not
+ exceed 253 characters in length
+ rule: self.split('/', 2)[0].size() <= 253
+ - message: the domain 'kubernetes.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'kubernetes.io'
+ - message: the subdomains '*.kubernetes.io'
+ are reserved for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
+ - message: the domain 'k8s.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'k8s.io'
+ - message: the subdomains '*.k8s.io' are reserved
+ for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
+ - message: the domain 'openshift.io' is reserved
+ for OpenShift use
+ rule: self.split('/', 2)[0] != 'openshift.io'
+ - message: the subdomains '*.openshift.io'
+ are reserved for OpenShift use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
+ - message: the path of the key must not be
+ empty and must consist of at least one
+ alphanumeric character, percent-encoded
+ octets, apostrophe, '-', '.', '_', '~',
+ '!', '$', '&', '(', ')', '*', '+', ',',
+ ';', '=', and ':'
+ rule: self.split('/', 2)[1].matches('[A-Za-z0-9/\\-._~%!$&\'()*+;=:]+')
+ - message: the path of the key must not exceed
+ 256 characters in length
+ rule: self.split('/', 2)[1].size() <= 256
+ valueExpression:
+ description: |-
+ valueExpression is a required field to specify the CEL expression to extract
+ the extra attribute value from a JWT token's claims.
+ valueExpression must produce a string or string array value.
+ "", [], and null are treated as the extra mapping not being present.
+ Empty string values within an array are filtered out.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ valueExpression must not exceed 4096 characters in length.
+ valueExpression must not be empty.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ required:
+ - key
+ - valueExpression
+ type: object
+ maxItems: 64
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ groups:
+ description: |-
+ groups is an optional field that configures how the groups of a cluster identity
+ should be constructed from the claims in a JWT token issued
+ by the identity provider.
+ When referencing a claim, if the claim is present in the JWT
+ token, its value must be a list of groups separated by a comma (',').
+ For example - '"example"' and '"exampleOne", "exampleTwo", "exampleThree"' are valid claim values.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix is an optional field that configures the prefix that will be
+ applied to the cluster identity attribute during the process of mapping
+ JWT claims to cluster identity attributes.
+
+ When omitted (""), no prefix is applied to the cluster identity attribute.
+
+ Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains
+ an array of strings "a", "b" and "c", the mapping will result in an
+ array of string "myoidc:a", "myoidc:b" and "myoidc:c".
+ type: string
+ required:
+ - claim
+ type: object
+ uid:
+ description: |-
+ uid is an optional field for configuring the claim mapping
+ used to construct the uid for the cluster identity.
+
+ When using uid.claim to specify the claim it must be a single string value.
+ When using uid.expression the expression must result in a single string value.
+
+ When omitted, this means the user has no opinion and the platform
+ is left to choose a default, which is subject to change over time.
+ The current default is to use the 'sub' claim.
+ properties:
+ claim:
+ description: |-
+ claim is an optional field for specifying the
+ JWT token claim that is used in the mapping.
+ The value of this claim will be assigned to
+ the field in which this mapping is associated.
+
+ Precisely one of claim or expression must be set.
+ claim must not be specified when expression is set.
+ When specified, claim must be at least 1 character in length
+ and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ expression:
+ description: |-
+ expression is an optional field for specifying a
+ CEL expression that produces a string value from
+ JWT token claims.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ Precisely one of claim or expression must be set.
+ expression must not be specified when claim is set.
+ When specified, expression must be at least 1 character in length
+ and must not exceed 4096 characters in length.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: precisely one of claim or expression
+ must be set
+ rule: 'has(self.claim) ? !has(self.expression)
+ : has(self.expression)'
+ username:
+ description: |-
+ username is an optional field that configures how the username of a cluster identity
+ should be constructed from the claims in a JWT token issued by the identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix configures the prefix that should be prepended to the value
+ of the JWT claim.
+
+ prefix must be set when prefixPolicy is set to 'Prefix' and must be unset otherwise.
+ properties:
+ prefixString:
+ description: |-
+ prefixString is a required field that configures the prefix that will
+ be applied to cluster identity username attribute
+ during the process of mapping JWT claims to cluster identity attributes.
+
+ prefixString must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - prefixString
+ type: object
+ prefixPolicy:
+ description: |-
+ prefixPolicy is an optional field that configures how a prefix should be
+ applied to the value of the JWT claim specified in the 'claim' field.
+
+ Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
+
+ When set to 'Prefix', the value specified in the prefix field will be
+ prepended to the value of the JWT claim.
+ The prefix field must be set when prefixPolicy is 'Prefix'.
+
+ When set to 'NoPrefix', no prefix will be prepended to the value
+ of the JWT claim.
+
+ When omitted, this means no opinion and the platform is left to choose
+ any prefixes that are applied which is subject to change over time.
+ Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim
+ when the claim is not 'email'.
+ As an example, consider the following scenario:
+ `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
+ the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
+ and `claim` is set to:
+ - "username": the mapped value will be "https://myoidc.tld#userA"
+ - "email": the mapped value will be "userA@myoidc.tld"
+ enum:
+ - ""
+ - NoPrefix
+ - Prefix
+ type: string
+ required:
+ - claim
+ type: object
+ x-kubernetes-validations:
+ - message: prefix must be set if prefixPolicy is
+ 'Prefix', but must remain unset otherwise
+ rule: 'has(self.prefixPolicy) && self.prefixPolicy
+ == ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
+ > 0) : !has(self.prefix)'
+ type: object
+ claimValidationRules:
+ description: |-
+ claimValidationRules is an optional field that configures the rules to
+ be used by the Kubernetes API server for validating the claims in a JWT
+ token issued by the identity provider.
+
+ Validation rules are joined via an AND operation.
+ items:
+ properties:
+ requiredClaim:
+ description: |-
+ requiredClaim is an optional field that configures the required claim
+ and value that the Kubernetes API server will use to validate if an incoming
+ JWT is valid for this identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the name of the required claim.
+ When taken from the JWT claims, claim must be a string value.
+
+ claim must not be an empty string ("").
+ minLength: 1
+ type: string
+ requiredValue:
+ description: |-
+ requiredValue is a required field that configures the value that 'claim' must
+ have when taken from the incoming JWT claims.
+ If the value in the JWT claims does not match, the token
+ will be rejected for authentication.
+
+ requiredValue must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - claim
+ - requiredValue
+ type: object
+ type:
+ default: RequiredClaim
+ description: |-
+ type is an optional field that configures the type of the validation rule.
+
+ Allowed values are 'RequiredClaim' and omitted (not provided or an empty string).
+
+ When set to 'RequiredClaim', the Kubernetes API server
+ will be configured to validate that the incoming JWT
+ contains the required claim and that its value matches
+ the required value.
+
+ Defaults to 'RequiredClaim'.
+ enum:
+ - RequiredClaim
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ issuer:
+ description: |-
+ issuer is a required field that configures how the platform interacts
+ with the identity provider and how tokens issued from the identity provider
+ are evaluated by the Kubernetes API server.
+ properties:
+ audiences:
+ description: |-
+ audiences is a required field that configures the acceptable audiences
+ the JWT token, issued by the identity provider, must be issued to.
+ At least one of the entries must match the 'aud' claim in the JWT token.
+
+ audiences must contain at least one entry and must not exceed ten entries.
+ items:
+ minLength: 1
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ issuerCertificateAuthority:
+ description: |-
+ issuerCertificateAuthority is an optional field that configures the
+ certificate authority, used by the Kubernetes API server, to validate
+ the connection to the identity provider when fetching discovery information.
+
+ When not specified, the system trust is used.
+
+ When specified, it must reference a ConfigMap in the openshift-config
+ namespace containing the PEM-encoded CA certificates under the 'ca-bundle.crt'
+ key in the data field of the ConfigMap.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ issuerURL:
+ description: |-
+ issuerURL is a required field that configures the URL used to issue tokens
+ by the identity provider.
+ The Kubernetes API server determines how authentication tokens should be handled
+ by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ required:
+ - audiences
+ - issuerURL
+ type: object
+ name:
+ description: |-
+ name is a required field that configures the unique human-readable identifier
+ associated with the identity provider.
+ It is used to distinguish between multiple identity providers
+ and has no impact on token validation or authentication mechanics.
+
+ name must not be an empty string ("").
+ minLength: 1
+ type: string
+ oidcClients:
+ description: |-
+ oidcClients is an optional field that configures how on-cluster,
+ platform clients should request tokens from the identity provider.
+ oidcClients must not exceed 20 entries and entries must have unique namespace/name pairs.
+ items:
+ description: |-
+ OIDCClientConfig configures how platform clients
+ interact with identity providers as an authentication
+ method
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that configures the client identifier, from
+ the identity provider, that the platform component uses for authentication
+ requests made to the identity provider.
+ The identity provider must accept this identifier for platform components
+ to be able to use the identity provider as an authentication mode.
+
+ clientID must not be an empty string ("").
+ minLength: 1
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is an optional field that configures the client secret used
+ by the platform component when making authentication requests to the identity provider.
+
+ When not specified, no client secret will be used when making authentication requests
+ to the identity provider.
+
+ When specified, clientSecret references a Secret in the 'openshift-config'
+ namespace that contains the client secret in the 'clientSecret' key of the '.data' field.
+ The client secret will be used when making authentication requests to the identity provider.
+
+ Public clients do not require a client secret but private
+ clients do require a client secret to work with the identity provider.
+ properties:
+ name:
+ description: name is the metadata.name of
+ the referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component being configured to use the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component being configured to use the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ extraScopes:
+ description: |-
+ extraScopes is an optional field that configures the extra scopes that should
+ be requested by the platform component when making authentication requests to the
+ identity provider.
+ This is useful if you have configured claim mappings that requires specific
+ scopes to be requested beyond the standard OIDC scopes.
+
+ When omitted, no additional scopes are requested.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - clientID
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ required:
+ - issuer
+ - name
+ type: object
+ maxItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ serviceAccountIssuer:
+ description: |-
+ serviceAccountIssuer is the identifier of the bound service account token
+ issuer.
+ The default is https://kubernetes.default.svc
+ WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
+ previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
+ be trusted for a time period chosen by the platform (currently set to 24h).
+ This time period is subject to change over time.
+ This allows internal components to transition to use new service account issuer without service distruption.
+ type: string
+ type:
+ description: |-
+ type identifies the cluster managed, user facing authentication mode in use.
+ Specifically, it manages the component that responds to login attempts.
+ The default is IntegratedOAuth.
+ enum:
+ - ""
+ - None
+ - IntegratedOAuth
+ - OIDC
+ type: string
+ webhookTokenAuthenticator:
+ description: |-
+ webhookTokenAuthenticator configures a remote token reviewer.
+ These remote authentication webhooks can be used to verify bearer tokens
+ via the tokenreviews.authentication.k8s.io REST API. This is required to
+ honor bearer tokens that are provisioned by an external authentication service.
+
+ Can only be set if "Type" is set to "None".
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig references a secret that contains kube config file data which
+ describes how to access the remote webhook service.
+ The namespace for the referenced secret is openshift-config.
+
+ For further details, see:
+
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - kubeConfig
+ type: object
+ webhookTokenAuthenticators:
+ description: webhookTokenAuthenticators is DEPRECATED, setting
+ it has no effect.
+ items:
+ description: |-
+ deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
+ It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig contains kube config file data which describes how to access the remote webhook service.
+ For further details, see:
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ The namespace for this secret is determined by the point of use.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ featureGate:
+ description: featureGate holds cluster-wide information about
+ feature gates.
+ properties:
+ customNoUpgrade:
+ description: |-
+ customNoUpgrade allows the enabling or disabling of any feature. Turning this feature set on IS NOT SUPPORTED, CANNOT BE UNDONE, and PREVENTS UPGRADES.
+ Because of its nature, this setting cannot be validated. If you have any typos or accidentally apply invalid combinations
+ your cluster may fail in an unrecoverable way. featureSet must equal "CustomNoUpgrade" must be set to use this field.
+ nullable: true
+ properties:
+ disabled:
+ description: disabled is a list of all feature gates that
+ you want to force off
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ enabled:
+ description: enabled is a list of all feature gates that
+ you want to force on
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ type: object
+ featureSet:
+ description: |-
+ featureSet changes the list of features in the cluster. The default is empty. Be very careful adjusting this setting.
+ Turning on or off features may cause irreversible changes in your cluster which cannot be undone.
+ enum:
+ - CustomNoUpgrade
+ - DevPreviewNoUpgrade
+ - TechPreviewNoUpgrade
+ - ""
+ type: string
+ x-kubernetes-validations:
+ - message: CustomNoUpgrade may not be changed
+ rule: 'oldSelf == ''CustomNoUpgrade'' ? self == ''CustomNoUpgrade''
+ : true'
+ - message: TechPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''TechPreviewNoUpgrade'' ? self == ''TechPreviewNoUpgrade''
+ : true'
+ - message: DevPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''DevPreviewNoUpgrade'' ? self == ''DevPreviewNoUpgrade''
+ : true'
+ type: object
+ image:
+ description: |-
+ image governs policies related to imagestream imports and runtime configuration
+ for external registries. It allows cluster admins to configure which registries
+ OpenShift is allowed to import images from, extra CA trust bundles for external
+ registries, and policies to block or allow registry hostnames.
+ When exposing OpenShift's image registry to the public, this also lets cluster
+ admins specify the external hostname.
+ This input will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ additionalTrustedCA:
+ description: |-
+ additionalTrustedCA is a reference to a ConfigMap containing additional CAs that
+ should be trusted during imagestream import, pod image pull, build image pull, and
+ imageregistry pullthrough.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ allowedRegistriesForImport:
+ description: |-
+ allowedRegistriesForImport limits the container image registries that normal users may import
+ images from. Set this list to the registries that you trust to contain valid Docker
+ images and that you want applications to be able to import from. Users with
+ permission to create Images or ImageStreamMappings via the API are not affected by
+ this policy - typically only administrators or system integrations will have those
+ permissions.
+ items:
+ description: |-
+ RegistryLocation contains a location of the registry specified by the registry domain
+ name. The domain name might include wildcards, like '*' or '??'.
+ properties:
+ domainName:
+ description: |-
+ domainName specifies a domain name for the registry
+ In case the registry use non-standard (80 or 443) port, the port should be included
+ in the domain name as well.
+ type: string
+ insecure:
+ description: |-
+ insecure indicates whether the registry is secure (https) or insecure (http)
+ By default (if not specified) the registry is assumed as secure.
+ type: boolean
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalRegistryHostnames:
+ description: |-
+ externalRegistryHostnames provides the hostnames for the default external image
+ registry. The external hostname should be set only when the image registry
+ is exposed externally. The first value is used in 'publicDockerImageRepository'
+ field in ImageStreams. The value must be in "hostname[:port]" format.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ registrySources:
+ description: |-
+ registrySources contains configuration that determines how the container runtime
+ should treat individual registries when accessing images for builds+pods. (e.g.
+ whether or not to allow insecure access). It does not contain configuration for the
+ internal cluster registry.
+ properties:
+ allowedRegistries:
+ description: |-
+ allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ blockedRegistries:
+ description: |-
+ blockedRegistries cannot be used for image pull and push actions. All other registries are permitted.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ containerRuntimeSearchRegistries:
+ description: |-
+ containerRuntimeSearchRegistries are registries that will be searched when pulling images that do not have fully qualified
+ domains in their pull specs. Registries will be searched in the order provided in the list.
+ Note: this search list only works with the container runtime, i.e CRI-O. Will NOT work with builds or imagestream imports.
+ format: hostname
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ insecureRegistries:
+ description: insecureRegistries are registries which do
+ not have a valid TLS certificates or only support HTTP
+ connections.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-validations:
+ - message: Only one of blockedRegistries or allowedRegistries
+ may be set
+ rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
+ : true'
+ type: object
+ ingress:
+ description: |-
+ ingress holds cluster-wide information about ingress, including the default ingress domain
+ used for routes.
+ properties:
+ appsDomain:
+ description: |-
+ appsDomain is an optional domain to use instead of the one specified
+ in the domain field when a Route is created without specifying an explicit
+ host. If appsDomain is nonempty, this value is used to generate default
+ host values for Route. Unlike domain, appsDomain may be modified after
+ installation.
+ This assumes a new ingresscontroller has been setup with a wildcard
+ certificate.
+ type: string
+ componentRoutes:
+ description: |-
+ componentRoutes is an optional list of routes that are managed by OpenShift components
+ that a cluster-admin is able to configure the hostname and serving certificate for.
+ The namespace and name of each route in this list should match an existing entry in the
+ status.componentRoutes list.
+
+ To determine the set of configurable Routes, look at namespace and name of entries in the
+ .status.componentRoutes list, where participating operators write the status of
+ configurable routes.
+ items:
+ description: ComponentRouteSpec allows for configuration
+ of a route's hostname and serving certificate.
+ properties:
+ hostname:
+ description: hostname is the hostname that should be
+ used by the route.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ servingCertKeyPairSecret:
+ description: |-
+ servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
+ The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
+ If the custom hostname uses the default routing suffix of the cluster,
+ the Secret specification for a serving certificate will not be needed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - hostname
+ - name
+ - namespace
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ domain:
+ description: |-
+ domain is used to generate a default host name for a route when the
+ route's host name is empty. The generated host name will follow this
+ pattern: "..".
+
+ It is also used as the default wildcard domain suffix for ingress. The
+ default ingresscontroller domain will follow this pattern: "*.".
+
+ Once set, changing domain is not currently supported.
+ type: string
+ loadBalancer:
+ description: |-
+ loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
+ provider of the current cluster and are required for Ingress Controller to work on OpenShift.
+ properties:
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for the ingress load balancers.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains settings specific to the
+ Amazon Web Services infrastructure provider.
+ properties:
+ type:
+ description: |-
+ type allows user to set a load balancer type.
+ When this field is set the default ingresscontroller will get created using the specified LBType.
+ If this field is not set then the default ingress controller of LBType Classic will be created.
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - NLB
+ - Classic
+ type: string
+ required:
+ - type
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
+ "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
+ and must handle unrecognized platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ type: object
+ type: object
+ requiredHSTSPolicies:
+ description: |-
+ requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
+ matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
+ Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
+ annotation, and affect route admission.
+
+ A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
+ "haproxy.router.openshift.io/hsts_header"
+ E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
+
+ - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
+ is rejected.
+ - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
+ determines the route's admission status.
+ - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then it may use any HSTS Policy annotation.
+
+ The HSTS policy configuration may be changed after routes have already been created. An update to a previously
+ admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
+ However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
+
+ Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
+ items:
+ properties:
+ domainPatterns:
+ description: |-
+ domainPatterns is a list of domains for which the desired HSTS annotations are required.
+ If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
+ the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
+
+ The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
+ foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ includeSubDomainsPolicy:
+ description: |-
+ includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
+ domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
+ - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ enum:
+ - RequireIncludeSubDomains
+ - RequireNoIncludeSubDomains
+ - NoOpinion
+ type: string
+ maxAge:
+ description: |-
+ maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
+ If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
+ If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
+ maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
+ policy will eventually expire on that client.
+ properties:
+ largestMaxAge:
+ description: |-
+ The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ This value can be left unspecified, in which case no upper limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ smallestMaxAge:
+ description: |-
+ The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
+ tool for administrators to quickly correct mistakes.
+ This value can be left unspecified, in which case no lower limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ type: object
+ namespaceSelector:
+ description: |-
+ namespaceSelector specifies a label selector such that the policy applies only to those routes that
+ are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
+ Defaults to the empty LabelSelector, which matches everything.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label
+ selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the
+ selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ preloadPolicy:
+ description: |-
+ preloadPolicy directs the client to include hosts in its host preload list so that
+ it never needs to do an initial load to get the HSTS header (note that this is not defined
+ in RFC 6797 and is therefore client implementation-dependent).
+ enum:
+ - RequirePreload
+ - RequireNoPreload
+ - NoOpinion
+ type: string
+ required:
+ - domainPatterns
+ type: object
+ type: array
+ type: object
+ network:
+ description: |-
+ network holds cluster-wide information about the network. It is used to configure the desired network configuration, such as: IP address pools for services/pod IPs, network plugin, etc.
+ Please view network.spec for an explanation on what applies when configuring this resource.
+ properties:
+ clusterNetwork:
+ description: |-
+ IP address pool to use for pod IPs.
+ This field is immutable after installation.
+ items:
+ description: |-
+ ClusterNetworkEntry is a contiguous block of IP addresses from which pod IPs
+ are allocated.
+ properties:
+ cidr:
+ description: The complete block for pod IPs.
+ type: string
+ hostPrefix:
+ description: |-
+ The size (prefix) of block to allocate to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalIP:
+ description: |-
+ externalIP defines configuration for controllers that
+ affect Service.ExternalIP. If nil, then ExternalIP is
+ not allowed to be set.
+ properties:
+ autoAssignCIDRs:
+ description: |-
+ autoAssignCIDRs is a list of CIDRs from which to automatically assign
+ Service.ExternalIP. These are assigned when the service is of type
+ LoadBalancer. In general, this is only useful for bare-metal clusters.
+ In Openshift 3.x, this was misleadingly called "IngressIPs".
+ Automatically assigned External IPs are not affected by any
+ ExternalIPPolicy rules.
+ Currently, only one entry may be provided.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ policy:
+ description: |-
+ policy is a set of restrictions applied to the ExternalIP field.
+ If nil or empty, then ExternalIP is not allowed to be set.
+ properties:
+ allowedCIDRs:
+ description: allowedCIDRs is the list of allowed CIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ rejectedCIDRs:
+ description: |-
+ rejectedCIDRs is the list of disallowed CIDRs. These take precedence
+ over allowedCIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkDiagnostics:
+ description: |-
+ networkDiagnostics defines network diagnostics configuration.
+
+ Takes precedence over spec.disableNetworkDiagnostics in network.operator.openshift.io.
+ If networkDiagnostics is not specified or is empty,
+ and the spec.disableNetworkDiagnostics flag in network.operator.openshift.io is set to true,
+ the network diagnostics feature will be disabled.
+ properties:
+ mode:
+ description: |-
+ mode controls the network diagnostics mode
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is All.
+ enum:
+ - ""
+ - All
+ - Disabled
+ type: string
+ sourcePlacement:
+ description: |-
+ sourcePlacement controls the scheduling of network diagnostics source deployment
+
+ See NetworkDiagnosticsSourcePlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is an empty list.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ targetPlacement:
+ description: |-
+ targetPlacement controls the scheduling of network diagnostics target daemonset
+
+ See NetworkDiagnosticsTargetPlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `- operator: "Exists"` which means that all taints are tolerated.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkType:
+ description: |-
+ networkType is the plugin that is to be deployed (e.g. OVNKubernetes).
+ This should match a value that the cluster-network-operator understands,
+ or else no networking will be installed.
+ Currently supported values are:
+ - OVNKubernetes
+ This field is immutable after installation.
+ type: string
+ serviceNetwork:
+ description: |-
+ IP address pool for services.
+ Currently, we only support a single entry here.
+ This field is immutable after installation.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceNodePortRange:
+ description: |-
+ The port range allowed for Services of type NodePort.
+ If not specified, the default of 30000-32767 will be used.
+ Such Services without a NodePort specified will have one
+ automatically allocated from this range.
+ This parameter can be updated after the cluster is
+ installed.
+ pattern: ^([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])-([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot set networkDiagnostics.sourcePlacement and networkDiagnostics.targetPlacement
+ when networkDiagnostics.mode is Disabled
+ rule: '!has(self.networkDiagnostics) || !has(self.networkDiagnostics.mode)
+ || self.networkDiagnostics.mode!=''Disabled'' || !has(self.networkDiagnostics.sourcePlacement)
+ && !has(self.networkDiagnostics.targetPlacement)'
+ oauth:
+ description: |-
+ oauth holds cluster-wide information about OAuth.
+ It is used to configure the integrated OAuth server.
+ This configuration is only honored when the top level Authentication config has type set to IntegratedOAuth.
+ properties:
+ identityProviders:
+ description: |-
+ identityProviders is an ordered list of ways for a user to identify themselves.
+ When this list is empty, no identities are provisioned for users.
+ items:
+ description: IdentityProvider provides identities for users
+ authenticating using credentials
+ properties:
+ basicAuth:
+ description: basicAuth contains configuration options
+ for the BasicAuth IdP
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ github:
+ description: github enables user authentication using
+ GitHub credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ This can only be configured when hostname is set to a non-empty value.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostname:
+ description: |-
+ hostname is the optional domain (e.g. "mycompany.com") for use with a hosted instance of
+ GitHub Enterprise.
+ It must match the GitHub Enterprise settings value configured at /setup/settings#hostname.
+ type: string
+ organizations:
+ description: organizations optionally restricts
+ which organizations are allowed to log in
+ items:
+ type: string
+ type: array
+ teams:
+ description: teams optionally restricts which teams
+ are allowed to log in. Format is /.
+ items:
+ type: string
+ type: array
+ type: object
+ gitlab:
+ description: gitlab enables user authentication using
+ GitLab credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the oauth server base URL
+ type: string
+ type: object
+ google:
+ description: google enables user authentication using
+ Google credentials
+ properties:
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostedDomain:
+ description: hostedDomain is the optional Google
+ App domain (e.g. "mycompany.com") to restrict
+ logins to
+ type: string
+ type: object
+ htpasswd:
+ description: htpasswd enables user authentication using
+ an HTPasswd file to validate credentials
+ properties:
+ fileData:
+ description: |-
+ fileData is a required reference to a secret by name containing the data to use as the htpasswd file.
+ The key "htpasswd" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ If the specified htpasswd data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ keystone:
+ description: keystone enables user authentication using
+ keystone password credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ domainName:
+ description: domainName is required for keystone
+ v3
+ type: string
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ ldap:
+ description: ldap enables user authentication using
+ LDAP credentials
+ properties:
+ attributes:
+ description: attributes maps LDAP attributes to
+ identities
+ properties:
+ email:
+ description: |-
+ email is the list of attributes whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ id:
+ description: |-
+ id is the list of attributes whose values should be used as the user ID. Required.
+ First non-empty attribute is used. At least one attribute is required. If none of the listed
+ attribute have a value, authentication fails.
+ LDAP standard identity attribute is "dn"
+ items:
+ type: string
+ type: array
+ name:
+ description: |-
+ name is the list of attributes whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ LDAP standard display name attribute is "cn"
+ items:
+ type: string
+ type: array
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of attributes whose values should be used as the preferred username.
+ LDAP standard login attribute is "uid"
+ items:
+ type: string
+ type: array
+ type: object
+ bindDN:
+ description: bindDN is an optional DN to bind with
+ during the search phase.
+ type: string
+ bindPassword:
+ description: |-
+ bindPassword is an optional reference to a secret by name
+ containing a password to bind with during the search phase.
+ The key "bindPassword" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ insecure:
+ description: |-
+ insecure, if true, indicates the connection should not use TLS
+ WARNING: Should not be set to `true` with the URL scheme "ldaps://" as "ldaps://" URLs always
+ attempt to connect using TLS, even when `insecure` is set to `true`
+ When `true`, "ldap://" URLS connect insecurely. When `false`, "ldap://" URLs are upgraded to
+ a TLS connection using StartTLS as specified in https://tools.ietf.org/html/rfc2830.
+ type: boolean
+ url:
+ description: |-
+ url is an RFC 2255 URL which specifies the LDAP search parameters to use.
+ The syntax of the URL is:
+ ldap://host:port/basedn?attribute?scope?filter
+ type: string
+ type: object
+ mappingMethod:
+ description: |-
+ mappingMethod determines how identities from this provider are mapped to users
+ Defaults to "claim"
+ type: string
+ name:
+ description: |-
+ name is used to qualify the identities returned by this provider.
+ - It MUST be unique and not shared by any other identity provider used
+ - It MUST be a valid path segment: name cannot equal "." or ".." or contain "/" or "%" or ":"
+ Ref: https://godoc.org/github.com/openshift/origin/pkg/user/apis/user/validation#ValidateIdentityProviderName
+ type: string
+ openID:
+ description: openID enables user authentication using
+ OpenID credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ claims:
+ description: claims mappings
+ properties:
+ email:
+ description: |-
+ email is the list of claims whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ groups:
+ description: |-
+ groups is the list of claims value of which should be used to synchronize groups
+ from the OIDC provider to OpenShift for the user.
+ If multiple claims are specified, the first one with a non-empty value is used.
+ items:
+ description: |-
+ OpenIDClaim represents a claim retrieved from an OpenID provider's tokens or userInfo
+ responses
+ minLength: 1
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: |-
+ name is the list of claims whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of claims whose values should be used as the preferred username.
+ If unspecified, the preferred username is determined from the value of the sub claim
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ extraAuthorizeParameters:
+ additionalProperties:
+ type: string
+ description: extraAuthorizeParameters are any custom
+ parameters to add to the authorize request.
+ type: object
+ extraScopes:
+ description: extraScopes are any scopes to request
+ in addition to the standard "openid" scope.
+ items:
+ type: string
+ type: array
+ issuer:
+ description: |-
+ issuer is the URL that the OpenID Provider asserts as its Issuer Identifier.
+ It must use the https scheme with no query or fragment component.
+ type: string
+ type: object
+ requestHeader:
+ description: requestHeader enables user authentication
+ using request header credentials
+ properties:
+ ca:
+ description: |-
+ ca is a required reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ Specifically, it allows verification of incoming requests to prevent header spoofing.
+ The key "ca.crt" is used to locate the data.
+ If the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ challengeURL:
+ description: |-
+ challengeURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect WWW-Authenticate challenges will be
+ redirected here.
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when challenge is set to true.
+ type: string
+ clientCommonNames:
+ description: |-
+ clientCommonNames is an optional list of common names to require a match from. If empty, any
+ client certificate validated against the clientCA bundle is considered authoritative.
+ items:
+ type: string
+ type: array
+ emailHeaders:
+ description: emailHeaders is the set of headers
+ to check for the email address
+ items:
+ type: string
+ type: array
+ headers:
+ description: headers is the set of headers to check
+ for identity information
+ items:
+ type: string
+ type: array
+ loginURL:
+ description: |-
+ loginURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect interactive logins will be redirected here
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when login is set to true.
+ type: string
+ nameHeaders:
+ description: nameHeaders is the set of headers to
+ check for the display name
+ items:
+ type: string
+ type: array
+ preferredUsernameHeaders:
+ description: preferredUsernameHeaders is the set
+ of headers to check for the preferred username
+ items:
+ type: string
+ type: array
+ type: object
+ type:
+ description: type identifies the identity provider type
+ for this entry.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ templates:
+ description: templates allow you to customize pages like the
+ login page.
+ properties:
+ error:
+ description: |-
+ error is the name of a secret that specifies a go template to use to render error pages
+ during the authentication or grant flow.
+ The key "errors.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default error page is used.
+ If the specified template is not valid, the default error page is used.
+ If unspecified, the default error page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ login:
+ description: |-
+ login is the name of a secret that specifies a go template to use to render the login page.
+ The key "login.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default login page is used.
+ If the specified template is not valid, the default login page is used.
+ If unspecified, the default login page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ providerSelection:
+ description: |-
+ providerSelection is the name of a secret that specifies a go template to use to render
+ the provider selection page.
+ The key "providers.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default provider selection page is used.
+ If the specified template is not valid, the default provider selection page is used.
+ If unspecified, the default provider selection page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ tokenConfig:
+ description: tokenConfig contains options for authorization
+ and access tokens
+ properties:
+ accessTokenInactivityTimeout:
+ description: |-
+ accessTokenInactivityTimeout defines the token inactivity timeout
+ for tokens granted by any client.
+ The value represents the maximum amount of time that can occur between
+ consecutive uses of the token. Tokens become invalid if they are not
+ used within this temporal window. The user will need to acquire a new
+ token to regain access once a token times out. Takes valid time
+ duration string such as "5m", "1.5h" or "2h45m". The minimum allowed
+ value for duration is 300s (5 minutes). If the timeout is configured
+ per client, then that value takes precedence. If the timeout value is
+ not specified and the client does not override the value, then tokens
+ are valid until their lifetime.
+
+ WARNING: existing tokens' timeout will not be affected (lowered) by changing this value
+ type: string
+ accessTokenInactivityTimeoutSeconds:
+ description: 'accessTokenInactivityTimeoutSeconds - DEPRECATED:
+ setting this field has no effect.'
+ format: int32
+ type: integer
+ accessTokenMaxAgeSeconds:
+ description: accessTokenMaxAgeSeconds defines the maximum
+ age of access tokens
+ format: int32
+ type: integer
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: spec.configuration.oauth.tokenConfig.accessTokenInactivityTimeout
+ minimum acceptable token timeout value is 300 seconds
+ rule: '!has(self.tokenConfig) || !has(self.tokenConfig.accessTokenInactivityTimeout)
+ || duration(self.tokenConfig.accessTokenInactivityTimeout).getSeconds()
+ >= 300'
+ operatorhub:
+ description: |-
+ operatorhub specifies the configuration for the Operator Lifecycle Manager in the HostedCluster. This is only configured at deployment time but the controller are not reconcilling over it.
+ The OperatorHub configuration will be constantly reconciled if catalog placement is management, but only on cluster creation otherwise.
+ properties:
+ disableAllDefaultSources:
+ description: |-
+ disableAllDefaultSources allows you to disable all the default hub
+ sources. If this is true, a specific entry in sources can be used to
+ enable a default source. If this is false, a specific entry in
+ sources can be used to disable or enable a default source.
+ type: boolean
+ sources:
+ description: |-
+ sources is the list of default hub sources and their configuration.
+ If the list is empty, it implies that the default hub sources are
+ enabled on the cluster unless disableAllDefaultSources is true.
+ If disableAllDefaultSources is true and sources is not empty,
+ the configuration present in sources will take precedence. The list of
+ default hub sources and their current state will always be reflected in
+ the status block.
+ items:
+ description: HubSource is used to specify the hub source
+ and its configuration
+ properties:
+ disabled:
+ description: disabled is used to disable a default hub
+ source on cluster
+ type: boolean
+ name:
+ description: name is the name of one of the default
+ hub sources
+ maxLength: 253
+ minLength: 1
+ type: string
+ type: object
+ type: array
+ type: object
+ proxy:
+ description: |-
+ proxy holds cluster-wide information on how to configure default proxies for the cluster.
+ This affects traffic flowing from the hosted cluster data plane.
+ The controllers will generate a machineConfig with the proxy config for the cluster.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ httpProxy:
+ description: httpProxy is the URL of the proxy for HTTP requests. Empty
+ means unset and will not result in an env var.
+ type: string
+ httpsProxy:
+ description: httpsProxy is the URL of the proxy for HTTPS
+ requests. Empty means unset and will not result in an env
+ var.
+ type: string
+ noProxy:
+ description: |-
+ noProxy is a comma-separated list of hostnames and/or CIDRs and/or IPs for which the proxy should not be used.
+ Empty means unset and will not result in an env var.
+ type: string
+ readinessEndpoints:
+ description: readinessEndpoints is a list of endpoints used
+ to verify readiness of the proxy.
+ items:
+ type: string
+ type: array
+ trustedCA:
+ description: |-
+ trustedCA is a reference to a ConfigMap containing a CA certificate bundle.
+ The trustedCA field should only be consumed by a proxy validator. The
+ validator is responsible for reading the certificate bundle from the required
+ key "ca-bundle.crt", merging it with the system default trust bundle,
+ and writing the merged trust bundle to a ConfigMap named "trusted-ca-bundle"
+ in the "openshift-config-managed" namespace. Clients that expect to make
+ proxy connections must use the trusted-ca-bundle for all HTTPS requests to
+ the proxy, and may use the trusted-ca-bundle for non-proxy HTTPS requests as
+ well.
+
+ The namespace for the ConfigMap referenced by trustedCA is
+ "openshift-config". Here is an example ConfigMap (in yaml):
+
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: user-ca-bundle
+ namespace: openshift-config
+ data:
+ ca-bundle.crt: |
+ -----BEGIN CERTIFICATE-----
+ Custom CA certificate bundle.
+ -----END CERTIFICATE-----
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ scheduler:
+ description: |-
+ scheduler holds cluster-wide config information to run the Kubernetes Scheduler
+ and influence its placement decisions. The canonical name for this config is `cluster`.
+ properties:
+ defaultNodeSelector:
+ description: |-
+ defaultNodeSelector helps set the cluster-wide default node selector to
+ restrict pod placement to specific nodes. This is applied to the pods
+ created in all namespaces and creates an intersection with any existing
+ nodeSelectors already set on a pod, additionally constraining that pod's selector.
+ For example,
+ defaultNodeSelector: "type=user-node,region=east" would set nodeSelector
+ field in pod spec to "type=user-node,region=east" to all pods created
+ in all namespaces. Namespaces having project-wide node selectors won't be
+ impacted even if this field is set. This adds an annotation section to
+ the namespace.
+ For example, if a new namespace is created with
+ node-selector='type=user-node,region=east',
+ the annotation openshift.io/node-selector: type=user-node,region=east
+ gets added to the project. When the openshift.io/node-selector annotation
+ is set on the project the value is used in preference to the value we are setting
+ for defaultNodeSelector field.
+ For instance,
+ openshift.io/node-selector: "type=user-node,region=west" means
+ that the default of "type=user-node,region=east" set in defaultNodeSelector
+ would not be applied.
+ type: string
+ mastersSchedulable:
+ description: |-
+ mastersSchedulable allows masters nodes to be schedulable. When this flag is
+ turned on, all the master nodes in the cluster will be made schedulable,
+ so that workload pods can run on them. The default value for this field is false,
+ meaning none of the master nodes are schedulable.
+ Important Note: Once the workload pods start running on the master nodes,
+ extreme care must be taken to ensure that cluster-critical control plane components
+ are not impacted.
+ Please turn on this field after doing due diligence.
+ type: boolean
+ policy:
+ description: |-
+ DEPRECATED: the scheduler Policy API has been deprecated and will be removed in a future release.
+ policy is a reference to a ConfigMap containing scheduler policy which has
+ user specified predicates and priorities. If this ConfigMap is not available
+ scheduler will default to use DefaultAlgorithmProvider.
+ The namespace for this configmap is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ profile:
+ description: |-
+ profile sets which scheduling profile should be set in order to configure scheduling
+ decisions for new pods.
+
+ Valid values are "LowNodeUtilization", "HighNodeUtilization", "NoScoring"
+ Defaults to "LowNodeUtilization"
+ enum:
+ - ""
+ - LowNodeUtilization
+ - HighNodeUtilization
+ - NoScoring
+ type: string
+ profileCustomizations:
+ description: profileCustomizations contains configuration
+ for modifying the default behavior of existing scheduler
+ profiles.
+ properties:
+ dynamicResourceAllocation:
+ description: |-
+ dynamicResourceAllocation allows to enable or disable dynamic resource allocation within the scheduler.
+ Dynamic resource allocation is an API for requesting and sharing resources between pods and containers inside a pod.
+ Third-party resource drivers are responsible for tracking and allocating resources.
+ Different kinds of resources support arbitrary parameters for defining requirements and initialization.
+ Valid values are Enabled, Disabled and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default,
+ which is subject to change over time.
+ The current default is Disabled.
+ enum:
+ - ""
+ - Enabled
+ - Disabled
+ type: string
+ type: object
+ type: object
+ type: object
+ controlPlaneRelease:
+ description: |-
+ controlPlaneRelease is like spec.release but only for the components running on the management cluster.
+ This excludes any operand which will land in the hosted cluster data plane.
+ It is useful when you need to apply patch management side like a CVE, transparently for the hosted cluster.
+ Version input for this field is free, no validation is performed against spec.release or maximum and minimum is performed.
+ If defined, it will dicate the version of the components running management side, while spec.release will dictate the version of the components landing in the hosted cluster data plane.
+ If not defined, spec.release is used for both.
+ Changing this field will trigger a rollout of the control plane.
+ The behavior of the rollout will be driven by the ControllerAvailabilityPolicy and InfrastructureAvailabilityPolicy for PDBs and maxUnavailable and surce policies.
+ properties:
+ image:
+ description: |-
+ image is the image pullspec of an OCP release payload image.
+ See https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags for a list of available images.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: Image must start with a word character (letters, digits,
+ or underscores) and contain no white spaces
+ rule: self.matches('^(\\w+\\S+)$')
+ required:
+ - image
+ type: object
+ controllerAvailabilityPolicy:
+ default: HighlyAvailable
+ description: |-
+ controllerAvailabilityPolicy specifies the availability policy applied to critical control plane components like the Kube API Server.
+ Possible values are HighlyAvailable and SingleReplica. The default value is HighlyAvailable.
+ This field is immutable.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ x-kubernetes-validations:
+ - message: ControllerAvailabilityPolicy is immutable
+ rule: self == oldSelf
+ dns:
+ description: dns specifies the DNS configuration for the hosted cluster
+ ingress.
+ properties:
+ baseDomain:
+ description: |-
+ baseDomain is the base domain of the hosted cluster.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Once set, this field is immutable.
+ When the value is the empty string "", the controller might default to a value depending on the platform.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomain must be a valid domain name (e.g., example,
+ example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomain is immutable
+ rule: oldSelf == "" || self == oldSelf
+ baseDomainPrefix:
+ description: |-
+ baseDomainPrefix is the base domain prefix for the hosted cluster ingress.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Set baseDomainPrefix to an empty string "", if you don't want a prefix at all (not even hostedCluster.name) to be prepended to baseDomain.
+ This field is immutable.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomainPrefix must be a valid domain name (e.g.,
+ example, example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomainPrefix is immutable
+ rule: self == oldSelf
+ privateZoneID:
+ description: |-
+ privateZoneID is the Hosted Zone ID where all the DNS records that are only available internally to the cluster exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: privateZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ publicZoneID:
+ description: |-
+ publicZoneID is the Hosted Zone ID where all the DNS records that are publicly accessible to the internet exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: publicZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ required:
+ - baseDomain
+ type: object
+ etcd:
+ default:
+ managed:
+ storage:
+ persistentVolume:
+ size: 8Gi
+ type: PersistentVolume
+ managementType: Managed
+ description: |-
+ etcd specifies configuration for the control plane etcd cluster. The
+ default managementType is Managed. Once set, the managementType cannot be
+ changed.
+ properties:
+ managed:
+ description: managed specifies the behavior of an etcd cluster
+ managed by HyperShift.
+ properties:
+ storage:
+ description: storage specifies how etcd data is persisted.
+ properties:
+ persistentVolume:
+ description: |-
+ persistentVolume is the configuration for PersistentVolume etcd storage.
+ With this implementation, a PersistentVolume will be allocated for every
+ etcd member (either 1 or 3 depending on the HostedCluster control plane
+ availability configuration).
+ properties:
+ size:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 8Gi
+ description: |-
+ size is the minimum size of the data volume for each etcd member.
+ Default is 8Gi.
+ This field is immutable
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ x-kubernetes-validations:
+ - message: Etcd PV storage size is immutable
+ rule: self == oldSelf
+ storageClassName:
+ description: |-
+ storageClassName is the StorageClass of the data volume for each etcd member.
+ See https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: storageClassName is immutable
+ rule: self == oldSelf
+ type: object
+ restoreSnapshotURL:
+ description: |-
+ restoreSnapshotURL allows an optional URL to be provided where
+ an etcd snapshot can be downloaded, for example a pre-signed URL
+ referencing a storage service.
+ This snapshot will be restored on initial startup, only when the etcd PV
+ is empty.
+ items:
+ maxLength: 1024
+ type: string
+ maxItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: RestoreSnapshotURL shouldn't contain more than
+ 1 entry
+ rule: self.size() <= 1
+ type:
+ description: |-
+ type is the kind of persistent storage implementation to use for etcd.
+ Only PersistentVolume is supported at the moment.
+ enum:
+ - PersistentVolume
+ type: string
+ required:
+ - type
+ type: object
+ required:
+ - storage
+ type: object
+ managementType:
+ description: |-
+ managementType defines how the etcd cluster is managed.
+ This can be either Managed or Unmanaged.
+ This field is immutable.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ x-kubernetes-validations:
+ - message: managementType is immutable
+ rule: self == oldSelf
+ unmanaged:
+ description: |-
+ unmanaged specifies configuration which enables the control plane to
+ integrate with an externally managed etcd cluster.
+ properties:
+ endpoint:
+ description: |-
+ endpoint is the full etcd cluster client endpoint URL. For example:
+
+ https://etcd-client:2379
+
+ If the URL uses an HTTPS scheme, the TLS field is required.
+ maxLength: 255
+ pattern: ^https://
+ type: string
+ tls:
+ description: tls specifies TLS configuration for HTTPS etcd
+ client endpoints.
+ properties:
+ clientSecret:
+ description: |-
+ clientSecret refers to a secret for client mTLS authentication with the etcd cluster. It
+ may have the following key/value pairs:
+
+ etcd-client-ca.crt: Certificate Authority value
+ etcd-client.crt: Client certificate value
+ etcd-client.key: Client certificate key value
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - clientSecret
+ type: object
+ required:
+ - endpoint
+ - tls
+ type: object
+ required:
+ - managementType
+ type: object
+ x-kubernetes-validations:
+ - message: Only managed configuration must be set when managementType
+ is Managed
+ rule: 'self.managementType == ''Managed'' ? has(self.managed) :
+ !has(self.managed)'
+ - message: Only unmanaged configuration must be set when managementType
+ is Unmanaged
+ rule: 'self.managementType == ''Unmanaged'' ? has(self.unmanaged)
+ : !has(self.unmanaged)'
+ fips:
+ description: |-
+ fips indicates whether this cluster's nodes will be running in FIPS mode.
+ If set to true, the control plane's ignition server will be configured to
+ expect that nodes joining the cluster will be FIPS-enabled.
+ type: boolean
+ x-kubernetes-validations:
+ - message: fips is immutable
+ rule: self == oldSelf
+ imageContentSources:
+ description: |-
+ imageContentSources specifies image mirrors that can be used by cluster
+ nodes to pull content.
+ When imageContentSources is set, the controllers will generate a machineConfig.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ items:
+ description: |-
+ ImageContentSource specifies image mirrors that can be used by cluster nodes
+ to pull content. For cluster workloads, if a container image registry host of
+ the pullspec matches Source then one of the Mirrors are substituted as hosts
+ in the pullspec and tried in order to fetch the image.
+ properties:
+ mirrors:
+ description: mirrors are one or more repositories that may also
+ contain the same images.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 255
+ type: array
+ x-kubernetes-list-type: set
+ source:
+ description: |-
+ source is the repository that users refer to, e.g. in image pull
+ specifications.
+ maxLength: 255
+ type: string
+ required:
+ - source
+ type: object
+ maxItems: 255
+ type: array
+ infraID:
+ description: |-
+ infraID is a globally unique identifier for the cluster.
+ It must consist of lowercase alphanumeric characters and hyphens ('-') only, and start and end with an alphanumeric character.
+ It must be no more than 253 characters in length.
+ This identifier will be used to associate various cloud resources with the HostedCluster and its associated NodePools.
+ infraID is used to compute and tag created resources with "kubernetes.io/cluster/"+hcluster.Spec.InfraID which has contractual meaning for the cloud provider implementations.
+ If a value is not specified, a random infraID will be generated and set by the controller.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: infraID must consist of lowercase alphanumeric characters
+ or '-', start and end with an alphanumeric character, and be between
+ 1 and 253 characters
+ rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?$')
+ - message: infraID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ infrastructureAvailabilityPolicy:
+ default: SingleReplica
+ description: |-
+ infrastructureAvailabilityPolicy specifies the availability policy applied to infrastructure services which run on the hosted cluster data plane like the ingress controller and image registry controller.
+ Possible values are HighlyAvailable and SingleReplica. The default value is SingleReplica.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ issuerURL:
+ default: https://kubernetes.default.svc
+ description: |-
+ issuerURL is an OIDC issuer URL which will be used as the issuer in all
+ ServiceAccount tokens generated by the control plane API server via --service-account-issuer kube api server flag.
+ https://k8s-docs.netlify.app/en/docs/reference/command-line-tools-reference/kube-apiserver/
+ https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection
+ The default value is kubernetes.default.svc, which only works for in-cluster
+ validation.
+ If the platform is AWS and this value is set, the controller will update an s3 object with the appropriate OIDC documents (using the serviceAccountSigningKey info) into that issuerURL.
+ The expectation is for this s3 url to be backed by an OIDC provider in the AWS IAM.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: issuerURL is immutable
+ rule: self == oldSelf
+ - message: issuerURL must be a valid absolute URL
+ rule: isURL(self)
+ kubeAPIServerDNSName:
+ description: |-
+ kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
+ When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
+ If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
+ The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
+ This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
+ access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
+ for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
+ This API endpoint only works in OCP version 4.19 or later. Older versions will result in a no-op.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ labels:
+ additionalProperties:
+ type: string
+ description: |-
+ labels when specified, define what custom labels are added to the hcp pods.
+ Changing this day 2 will cause a rollout of all hcp pods.
+ Duplicate keys are not supported. If duplicate keys are defined, only the last key/value pair is preserved.
+ Valid values are those in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
+
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(key) <= 317 && key.matches('^(([A-Za-z0-9]+(\\.[A-Za-z0-9]+)?)*[A-Za-z0-9]\\/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$'))`, message="label key must have two segments: an optional prefix and name, separated by a slash (/). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (_), dots (.), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (.), not longer than 253 characters in total, followed by a slash (/)"
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(self[key]) <= 63 && self[key].matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$'))`, message="label value must be 63 characters or less (can be empty), consist of alphanumeric characters, dashes (-), underscores (_) or dots (.), and begin and end with an alphanumeric character"
+ maxProperties: 20
+ type: object
+ networking:
+ default:
+ clusterNetwork:
+ - cidr: 10.132.0.0/14
+ networkType: OVNKubernetes
+ serviceNetwork:
+ - cidr: 172.31.0.0/16
+ description: |-
+ networking specifies network configuration for the hosted cluster.
+ Defaults to OVNKubernetes with a cluster network of cidr: "10.132.0.0/14" and a service network of cidr: "172.31.0.0/16".
+ properties:
+ apiServer:
+ description: |-
+ apiServer contains advanced network settings for the API server that affect
+ how the APIServer is exposed inside a hosted cluster node.
+ properties:
+ advertiseAddress:
+ description: |-
+ advertiseAddress is the address that pods within the nodes will use to talk to the API
+ server. This is an address associated with the loopback adapter of each
+ node. If not specified, the controller will take default values.
+ The default values will be set as 172.20.0.1 or fd00::1.
+ This value is immutable.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: advertiseAddress is immutable
+ rule: self == oldSelf
+ allowedCIDRBlocks:
+ description: |-
+ allowedCIDRBlocks is an allow list of CIDR blocks that can access the APIServer.
+ If not specified, traffic is allowed from all addresses.
+ This field is enforced for ARO (Azure Red Hat OpenShift) via the shared-ingress HAProxy.
+ For platforms other than ARO, the enforcement depends on whether the underlying cloud provider supports the Service LoadBalancerSourceRanges field.
+ If the platform does not support LoadBalancerSourceRanges, this field may have no effect.
+ items:
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ maxItems: 500
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the port at which the APIServer is exposed inside a node. Other
+ pods using host networking cannot listen on this port.
+ If omitted 6443 is used.
+ This is useful to choose a port other than the default one which might interfere with customer environments e.g. https://github.com/openshift/hypershift/pull/356.
+ Setting this to 443 is possible only for backward compatibility reasons and it's discouraged.
+ Doing so, it would result in the controller overriding the KAS endpoint in the guest cluster having a discrepancy with the KAS Pod and potentially causing temporarily network failures.
+ This value is immutable.
+ format: int32
+ type: integer
+ x-kubernetes-validations:
+ - message: port is immutable
+ rule: self == oldSelf
+ type: object
+ clusterNetwork:
+ default:
+ - cidr: 10.132.0.0/14
+ description: |-
+ clusterNetwork is the list of IP address pools for pods.
+ Defaults to cidr: "10.132.0.0/14".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: |-
+ ClusterNetworkEntry is a single IP address block for pod IP blocks. IP blocks
+ are allocated with size 2^HostSubnetLength.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ hostPrefix:
+ description: |-
+ hostPrefix is the prefix size to allocate to each node from the CIDR.
+ For example, 24 would allocate 2^(32-24)=2^8=256 addresses to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ type: integer
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: clusterNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ machineNetwork:
+ description: |-
+ machineNetwork is the list of IP address pools for machines.
+ This might be used among other things to generate appropriate networking security groups in some clouds providers.
+ Currently only one entry or two for dual stack is supported.
+ This field is immutable.
+ items:
+ description: MachineNetworkEntry is a single IP address block
+ for node IP blocks.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for machines
+ within the cluster.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: machineNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ networkType:
+ default: OVNKubernetes
+ description: |-
+ networkType specifies the SDN provider used for cluster networking.
+ Defaults to OVNKubernetes.
+ This field is required and immutable.
+ kubebuilder:validation:XValidation:rule="self == oldSelf", message="networkType is immutable"
+ enum:
+ - OpenShiftSDN
+ - Calico
+ - OVNKubernetes
+ - Other
+ type: string
+ serviceNetwork:
+ default:
+ - cidr: 172.31.0.0/16
+ description: |-
+ serviceNetwork is the list of IP address pools for services.
+ Defaults to cidr: "172.31.0.0/16".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: ServiceNetworkEntry is a single IP address block
+ for the service network.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for services
+ within the cluster in CIDR format (e.g., 192.168.1.0/24
+ or 2001:0db8::/64)
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: serviceNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+ must be unique and non-overlapping
+ rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
+ c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
+ self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
+ self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
+ self.serviceNetwork.all(s, c.cidr != s.cidr)))))
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector when specified, is propagated to all control plane Deployments and Stateful sets running management side.
+ It must be satisfied by the management Nodes for the pods to be scheduled. Otherwise the HostedCluster will enter a degraded state.
+ Changes to this field will propagate to existing Deployments and StatefulSets.
+ type: object
+ x-kubernetes-validations:
+ - message: nodeSelector map can have at most 20 entries
+ rule: size(self) <= 20
+ olmCatalogPlacement:
+ default: management
+ description: |-
+ olmCatalogPlacement specifies the placement of OLM catalog components. By default,
+ this is set to management and OLM catalog components are deployed onto the management
+ cluster. If set to guest, the OLM catalog components will be deployed onto the guest
+ cluster.
+ enum:
+ - management
+ - guest
+ type: string
+ x-kubernetes-validations:
+ - message: OLMCatalogPlacement is immutable
+ rule: self == oldSelf
+ operatorConfiguration:
+ description: operatorConfiguration specifies configuration for individual
+ OCP operators in the cluster.
+ properties:
+ clusterNetworkOperator:
+ description: clusterNetworkOperator specifies the configuration
+ for the Cluster Network Operator in the hosted cluster.
+ properties:
+ disableMultiNetwork:
+ default: false
+ description: |-
+ disableMultiNetwork when set to true disables the Multus CNI plugin and related components
+ in the hosted cluster. This prevents the installation of multus daemon sets in the
+ guest cluster and the multus-admission-controller in the management cluster.
+ Default is false (Multus is enabled).
+ This field is immutable.
+ This field can only be set to true when NetworkType is "Other". Setting it to true
+ with any other NetworkType will result in a validation error during cluster creation.
+ type: boolean
+ x-kubernetes-validations:
+ - message: disableMultiNetwork is immutable
+ rule: self == oldSelf
+ ovnKubernetesConfig:
+ description: |-
+ ovnKubernetesConfig holds OVN-Kubernetes specific configuration.
+ This is only consumed when NetworkType is OVNKubernetes.
+ minProperties: 1
+ properties:
+ ipv4:
+ description: |-
+ ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
+ this means no opinions and the default configuration is used. Check individual
+ fields within ipv4 for details of default values.
+ minProperties: 1
+ properties:
+ internalJoinSubnet:
+ description: |-
+ internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the
+ default one is being already used by something else. It must not overlap with
+ any other subnet being used by OpenShift or by the node network. The size of the
+ subnet must be larger than the number of nodes.
+ The current default value is 100.64.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ (e.g., 192.168.1.1/24)
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ internalTransitSwitchSubnet:
+ description: |-
+ internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally
+ by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect
+ architecture that connects the cluster routers on each node together to enable
+ east west traffic. The subnet chosen should not overlap with other networks
+ specified for OVN-Kubernetes as well as other networks used on the host.
+ When omitted, this means no opinion and the platform is left to choose a reasonable
+ default which is subject to change over time.
+ The current default subnet is 100.88.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: internalJoinSubnet and internalTransitSwitchSubnet
+ must not be the same
+ rule: '!has(self.ipv4) || !has(self.ipv4.internalJoinSubnet)
+ || !has(self.ipv4.internalTransitSwitchSubnet) || self.ipv4.internalJoinSubnet
+ != self.ipv4.internalTransitSwitchSubnet'
+ type: object
+ ingressOperator:
+ description: |-
+ ingressOperator specifies the configuration for the Ingress Operator in the hosted cluster.
+ This allows configuring how the default ingress controller endpoints are published.
+ properties:
+ endpointPublishingStrategy:
+ description: |-
+ endpointPublishingStrategy is used to publish the default ingress controller endpoints.
+
+ The endpoint publishing strategy is determined by the following precedence order:
+ 1. User-specified endpointPublishingStrategy (highest priority) - if this field is set,
+ it takes precedence over all other configuration methods
+ 2. Platform-specific defaults with annotation overrides - if no user strategy is set,
+ the platform type determines the default strategy, which can be further modified by:
+ - hypershift.openshift.io/private-ingress-controller annotation (sets PrivateStrategyType)
+ - hypershift.openshift.io/ingress-controller-load-balancer-scope annotation (sets LoadBalancerScope)
+ 3. Generic LoadBalancer fallback - if the platform is not recognized, defaults to
+ LoadBalancerService with External scope
+
+ Platform-specific defaults when endpointPublishingStrategy is not set:
+ - AWS: LoadBalancerService with External scope (or NLB if configured)
+ - Azure, GCP: LoadBalancerService with External scope
+ - IBMCloud: LoadBalancerService with External scope (or NodePort for UPI)
+ - None: HostNetwork
+ - KubeVirt: NodePortService
+ - OpenStack: LoadBalancerService with External scope and optional FloatingIP
+ - Other platforms: LoadBalancerService with External scope
+
+ See the OpenShift Ingress Operator EndpointPublishingStrategy type for the full specification:
+ https://github.com/openshift/api/blob/master/operator/v1/types_ingress.go
+ properties:
+ hostNetwork:
+ description: |-
+ hostNetwork holds parameters for the HostNetwork endpoint publishing
+ strategy. Present only if type is HostNetwork.
+ properties:
+ httpPort:
+ default: 80
+ description: |-
+ httpPort is the port on the host which should be used to listen for
+ HTTP requests. This field should be set when port 80 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 80.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ httpsPort:
+ default: 443
+ description: |-
+ httpsPort is the port on the host which should be used to listen for
+ HTTPS requests. This field should be set when port 443 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 443.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ statsPort:
+ default: 1936
+ description: |-
+ statsPort is the port on the host where the stats from the router are
+ published. The value should not coincide with the NodePort range of the
+ cluster. If an external load balancer is configured to forward connections
+ to this IngressController, the load balancer should use this port for
+ health checks. The load balancer can send HTTP probes on this port on a
+ given node, with the path /healthz/ready to determine if the ingress
+ controller is ready to receive traffic on the node. For proper operation
+ the load balancer must not forward traffic to a node until the health
+ check reports ready. The load balancer should also stop forwarding requests
+ within a maximum of 45 seconds after /healthz/ready starts reporting
+ not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with
+ a threshold of two successful or failed requests to become healthy or
+ unhealthy respectively, are well-tested values. When the value is 0 or
+ is not specified it defaults to 1936.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ type: object
+ loadBalancer:
+ description: |-
+ loadBalancer holds parameters for the load balancer. Present only if
+ type is LoadBalancerService.
+ properties:
+ allowedSourceRanges:
+ description: |-
+ allowedSourceRanges specifies an allowlist of IP address ranges to which
+ access to the load balancer should be restricted. Each range must be
+ specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is
+ specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default,
+ which allows all source addresses.
+
+ To facilitate migration from earlier versions of OpenShift that did
+ not have the allowedSourceRanges field, you may set the
+ service.beta.kubernetes.io/load-balancer-source-ranges annotation on
+ the "router-" service in the
+ "openshift-ingress" namespace, and this annotation will take
+ effect if allowedSourceRanges is empty on OpenShift 4.12.
+ items:
+ description: |-
+ CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8"
+ or "fd00::/8").
+ pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)
+ type: string
+ nullable: true
+ type: array
+ x-kubernetes-list-type: atomic
+ dnsManagementPolicy:
+ default: Managed
+ description: |-
+ dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record
+ associated with the load balancer service will be managed by
+ the ingress operator. It defaults to Managed.
+ Valid values are: Managed and Unmanaged.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ providerParameters:
+ description: |-
+ providerParameters holds desired load balancer information specific to
+ the underlying infrastructure provider.
+
+ If empty, defaults will be applied. See specific providerParameters
+ fields for details about their defaults.
+ properties:
+ aws:
+ description: |-
+ aws provides configuration settings that are specific to AWS
+ load balancers.
+
+ If empty, defaults will be applied. See specific aws fields for
+ details about their defaults.
+ properties:
+ classicLoadBalancer:
+ description: |-
+ classicLoadBalancerParameters holds configuration parameters for an AWS
+ classic load balancer. Present only if type is Classic.
+ properties:
+ connectionIdleTimeout:
+ description: |-
+ connectionIdleTimeout specifies the maximum time period that a
+ connection may be idle before the load balancer closes the
+ connection. The value must be parseable as a time duration value;
+ see . A nil or zero value
+ means no opinion, in which case a default value is used. The default
+ value for this field is 60s. This default is subject to change.
+ format: duration
+ type: string
+ type: object
+ networkLoadBalancer:
+ description: |-
+ networkLoadBalancerParameters holds configuration parameters for an AWS
+ network load balancer. Present only if type is NLB.
+ type: object
+ type:
+ description: |-
+ type is the type of AWS load balancer to instantiate for an ingresscontroller.
+
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - Classic
+ - NLB
+ type: string
+ required:
+ - type
+ type: object
+ gcp:
+ description: |-
+ gcp provides configuration settings that are specific to GCP
+ load balancers.
+
+ If empty, defaults will be applied. See specific gcp fields for
+ details about their defaults.
+ properties:
+ clientAccess:
+ description: |-
+ clientAccess describes how client access is restricted for internal
+ load balancers.
+
+ Valid values are:
+ * "Global": Specifying an internal load balancer with Global client access
+ allows clients from any region within the VPC to communicate with the load
+ balancer.
+
+ https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access
+
+ * "Local": Specifying an internal load balancer with Local client access
+ means only clients within the same region (and VPC) as the GCP load balancer
+ can communicate with the load balancer. Note that this is the default behavior.
+
+ https://cloud.google.com/load-balancing/docs/internal#client_access
+ enum:
+ - Global
+ - Local
+ type: string
+ type: object
+ ibm:
+ description: |-
+ ibm provides configuration settings that are specific to IBM Cloud
+ load balancers.
+
+ If empty, defaults will be applied. See specific ibm fields for
+ details about their defaults.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the load balancer uses PROXY protocol to forward connections to
+ the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features:
+ "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas"
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ Valid values for protocol are TCP, PROXY and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is TCP, without the proxy protocol enabled.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ openstack:
+ description: |-
+ openstack provides configuration settings that are specific to OpenStack
+ load balancers.
+
+ If empty, defaults will be applied. See specific openstack fields for
+ details about their defaults.
+ properties:
+ floatingIP:
+ description: |-
+ floatingIP specifies the IP address that the load balancer will use.
+ When not specified, an IP address will be assigned randomly by the OpenStack cloud provider.
+ When specified, the floating IP has to be pre-created. If the
+ specified value is not a floating IP or is already claimed, the
+ OpenStack cloud provider won't be able to provision the load
+ balancer.
+ This field may only be used if the IngressController has External scope.
+ This value must be a valid IPv4 or IPv6 address.
+ type: string
+ x-kubernetes-validations:
+ - message: floatingIP must be a valid IPv4
+ or IPv6 address
+ rule: isIP(self)
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the load balancer.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix",
+ "OpenStack", and "VSphere".
+ enum:
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Nutanix
+ - OpenStack
+ - VSphere
+ - IBM
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: openstack is not permitted when type is
+ not OpenStack
+ rule: 'has(self.type) && self.type == ''OpenStack''
+ ? true : !has(self.openstack)'
+ scope:
+ description: |-
+ scope indicates the scope at which the load balancer is exposed.
+ Possible values are "External" and "Internal".
+ enum:
+ - Internal
+ - External
+ type: string
+ required:
+ - dnsManagementPolicy
+ - scope
+ type: object
+ x-kubernetes-validations:
+ - message: cannot specify a floating ip when scope is
+ internal
+ rule: '!has(self.scope) || self.scope != ''Internal''
+ || !has(self.providerParameters) || !has(self.providerParameters.openstack)
+ || !has(self.providerParameters.openstack.floatingIP)
+ || self.providerParameters.openstack.floatingIP ==
+ ""'
+ nodePort:
+ description: |-
+ nodePort holds parameters for the NodePortService endpoint publishing strategy.
+ Present only if type is NodePortService.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ private:
+ description: |-
+ private holds parameters for the Private endpoint publishing
+ strategy. Present only if type is Private.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy to use. Valid values are:
+
+ * LoadBalancerService
+
+ Publishes the ingress controller using a Kubernetes LoadBalancer Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A LoadBalancer Service is created to publish the deployment.
+
+ See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
+
+ If domain is set, a wildcard DNS record will be managed to point at the
+ LoadBalancer Service's external name. DNS records are managed only in DNS
+ zones defined by dns.config.openshift.io/cluster .spec.publicZone and
+ .spec.privateZone.
+
+ Wildcard DNS management is currently supported only on the AWS, Azure,
+ and GCP platforms.
+
+ * HostNetwork
+
+ Publishes the ingress controller on node ports where the ingress controller
+ is deployed.
+
+ In this configuration, the ingress controller deployment uses host
+ networking, bound to node ports 80 and 443. The user is responsible for
+ configuring an external load balancer to publish the ingress controller via
+ the node ports.
+
+ * Private
+
+ Does not publish the ingress controller.
+
+ In this configuration, the ingress controller deployment uses container
+ networking, and is not explicitly published. The user must manually publish
+ the ingress controller.
+
+ * NodePortService
+
+ Publishes the ingress controller using a Kubernetes NodePort Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A NodePort Service is created to publish the deployment. The
+ specific node ports are dynamically allocated by OpenShift; however, to
+ support static port allocations, user changes to the node port
+ field of the managed NodePort Service will preserved.
+ enum:
+ - LoadBalancerService
+ - HostNetwork
+ - Private
+ - NodePortService
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-preserve-unknown-fields: true
+ type: object
+ type: object
+ pausedUntil:
+ description: |-
+ pausedUntil is a field that can be used to pause reconciliation on the HostedCluster controller, resulting in any change to the HostedCluster being ignored.
+ Either a date can be provided in RFC3339 format or a boolean as in 'true', 'false', 'True', 'False'. If a date is
+ provided: reconciliation is paused on the resource until that date. If the boolean true is
+ provided: reconciliation is paused on the resource until the field is removed.
+ maxLength: 35
+ minLength: 4
+ type: string
+ x-kubernetes-validations:
+ - message: PausedUntil must be a date in RFC3339 format or 'True',
+ 'true', 'False' or 'false'
+ rule: self.matches('^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}.*$')
+ || self in ['true', 'false', 'True', 'False']
+ platform:
+ description: |-
+ platform specifies the underlying infrastructure provider for the cluster
+ and is used to configure platform specific behavior.
+ properties:
+ agent:
+ description: agent specifies configuration for agent-based installations.
+ properties:
+ agentNamespace:
+ description: agentNamespace is the namespace where to search
+ for Agents for this cluster
+ maxLength: 63
+ type: string
+ required:
+ - agentNamespace
+ type: object
+ aws:
+ description: aws specifies configuration for clusters running
+ on Amazon Web Services.
+ properties:
+ additionalAllowedPrincipals:
+ description: |-
+ additionalAllowedPrincipals specifies a list of additional allowed principal ARNs
+ to be added to the hosted control plane's VPC Endpoint Service to enable additional
+ VPC Endpoint connection requests to be automatically accepted.
+ See https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html
+ for more details around VPC Endpoint Service allowed principals.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 25
+ type: array
+ cloudProviderConfig:
+ description: |-
+ cloudProviderConfig specifies AWS networking configuration for the control
+ plane.
+ This is mainly used for cloud provider controller config:
+ https://github.com/kubernetes/kubernetes/blob/f5be5052e3d0808abb904aebd3218fe4a5c2dd82/staging/src/k8s.io/legacy-cloud-providers/aws/aws.go#L1347-L1364
+ properties:
+ subnet:
+ description: subnet is the subnet to use for control plane
+ cloud resources.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify
+ an AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for
+ the filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: vpc is the VPC to use for control plane cloud
+ resources.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ maxLength: 255
+ type: string
+ required:
+ - vpc
+ type: object
+ endpointAccess:
+ default: Public
+ description: |-
+ endpointAccess specifies the publishing scope of cluster endpoints. The
+ default is Public.
+ enum:
+ - Public
+ - PublicAndPrivate
+ - Private
+ type: string
+ multiArch:
+ default: false
+ description: |-
+ multiArch specifies whether the Hosted Cluster will be expected to support NodePools with different
+ CPU architectures, i.e., supporting arm64 NodePools and supporting amd64 NodePools on the same Hosted Cluster.
+ Deprecated: This field is no longer used. The HyperShift Operator now performs multi-arch validations
+ automatically despite the platform type. The HyperShift Operator will set HostedCluster.Status.PayloadArch based
+ on the HostedCluster release image. This field is used by the NodePool controller to validate the
+ NodePool.Spec.Arch is supported.
+ type: boolean
+ region:
+ description: |-
+ region is the AWS region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot AMI for a given release.
+ maxLength: 255
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created
+ for the cluster. See
+ https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for
+ information on tagging AWS resources. AWS supports a maximum of 50 tags per
+ resource. OpenShift reserves 25 tags for its use, leaving 25 tags available
+ for the user.
+ Changes to this field will be propagated in-place to AWS resources (VPC Endpoints, EC2 instances, initial EBS volumes and default/endpoint security groups).
+ These tags will be propagated to the infrastructure CR in the guest cluster, where other OCP operators might choose to honor this input to reconcile AWS resources created by them.
+ Please consult the official documentation for a list of all AWS resources that support in-place tag updates.
+ These take precedence over tags defined out of band (i.e., tags added manually or by other tools outside of HyperShift) in AWS in case of conflicts.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ value:
+ description: |-
+ value is the value of the tag.
+
+ Some AWS service do not support empty values. Since tags are added to
+ resources in many services, the length of the tag value must meet the
+ requirements of all services.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ rolesRef:
+ description: |-
+ rolesRef contains references to various AWS IAM roles required to enable
+ integrations such as OIDC.
+ properties:
+ controlPlaneOperatorARN:
+ description: "controlPlaneOperatorARN is an ARN value
+ referencing a role appropriate for the Control Plane
+ Operator.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"arn:aws:route53:::%s\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ imageRegistryARN:
+ description: "imageRegistryARN is an ARN value referencing
+ a role appropriate for the Image Registry Operator.\n\nThe
+ following is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"s3:CreateBucket\",\n\t\t\t\t\"s3:DeleteBucket\",\n\t\t\t\t\"s3:PutBucketTagging\",\n\t\t\t\t\"s3:GetBucketTagging\",\n\t\t\t\t\"s3:PutBucketPublicAccessBlock\",\n\t\t\t\t\"s3:GetBucketPublicAccessBlock\",\n\t\t\t\t\"s3:PutEncryptionConfiguration\",\n\t\t\t\t\"s3:GetEncryptionConfiguration\",\n\t\t\t\t\"s3:PutLifecycleConfiguration\",\n\t\t\t\t\"s3:GetLifecycleConfiguration\",\n\t\t\t\t\"s3:GetBucketLocation\",\n\t\t\t\t\"s3:ListBucket\",\n\t\t\t\t\"s3:GetObject\",\n\t\t\t\t\"s3:PutObject\",\n\t\t\t\t\"s3:DeleteObject\",\n\t\t\t\t\"s3:ListBucketMultipartUploads\",\n\t\t\t\t\"s3:AbortMultipartUpload\",\n\t\t\t\t\"s3:ListMultipartUploadParts\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing a
+ role appropriate for the Ingress Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"elasticloadbalancing:DescribeLoadBalancers\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"route53:ListHostedZones\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ [\n\t\t\t\t\"arn:aws:route53:::PUBLIC_ZONE_ID\",\n\t\t\t\t\"arn:aws:route53:::PRIVATE_ZONE_ID\"\n\t\t\t]\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ kubeCloudControllerARN:
+ description: |-
+ kubeCloudControllerARN is an ARN value referencing a role appropriate for the KCM/KCC.
+ Source: https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies
+
+ The following is an example of a valid policy document:
+
+ {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Action": [
+ "autoscaling:DescribeAutoScalingGroups",
+ "autoscaling:DescribeLaunchConfigurations",
+ "autoscaling:DescribeTags",
+ "ec2:DescribeAvailabilityZones",
+ "ec2:DescribeInstances",
+ "ec2:DescribeImages",
+ "ec2:DescribeRegions",
+ "ec2:DescribeRouteTables",
+ "ec2:DescribeSecurityGroups",
+ "ec2:DescribeSubnets",
+ "ec2:DescribeVolumes",
+ "ec2:CreateSecurityGroup",
+ "ec2:CreateTags",
+ "ec2:CreateVolume",
+ "ec2:ModifyInstanceAttribute",
+ "ec2:ModifyVolume",
+ "ec2:AttachVolume",
+ "ec2:AuthorizeSecurityGroupIngress",
+ "ec2:CreateRoute",
+ "ec2:DeleteRoute",
+ "ec2:DeleteSecurityGroup",
+ "ec2:DeleteVolume",
+ "ec2:DetachVolume",
+ "ec2:RevokeSecurityGroupIngress",
+ "ec2:DescribeVpcs",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:AttachLoadBalancerToSubnets",
+ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancerPolicy",
+ "elasticloadbalancing:CreateLoadBalancerListeners",
+ "elasticloadbalancing:ConfigureHealthCheck",
+ "elasticloadbalancing:DeleteLoadBalancer",
+ "elasticloadbalancing:DeleteLoadBalancerListeners",
+ "elasticloadbalancing:DescribeLoadBalancers",
+ "elasticloadbalancing:DescribeLoadBalancerAttributes",
+ "elasticloadbalancing:DetachLoadBalancerFromSubnets",
+ "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
+ "elasticloadbalancing:ModifyLoadBalancerAttributes",
+ "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
+ "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:CreateListener",
+ "elasticloadbalancing:CreateTargetGroup",
+ "elasticloadbalancing:DeleteListener",
+ "elasticloadbalancing:DeleteTargetGroup",
+ "elasticloadbalancing:DeregisterTargets",
+ "elasticloadbalancing:DescribeListeners",
+ "elasticloadbalancing:DescribeLoadBalancerPolicies",
+ "elasticloadbalancing:DescribeTargetGroups",
+ "elasticloadbalancing:DescribeTargetHealth",
+ "elasticloadbalancing:ModifyListener",
+ "elasticloadbalancing:ModifyTargetGroup",
+ "elasticloadbalancing:RegisterTargets",
+ "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
+ "iam:CreateServiceLinkedRole",
+ "kms:DescribeKey"
+ ],
+ "Resource": [
+ "*"
+ ],
+ "Effect": "Allow"
+ }
+ ]
+ }
+ maxLength: 2048
+ type: string
+ networkARN:
+ description: "networkARN is an ARN value referencing a
+ role appropriate for the Network Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:DescribeInstances\",\n
+ \ \"ec2:DescribeInstanceStatus\",\n \"ec2:DescribeInstanceTypes\",\n
+ \ \"ec2:UnassignPrivateIpAddresses\",\n \"ec2:AssignPrivateIpAddresses\",\n
+ \ \"ec2:UnassignIpv6Addresses\",\n \"ec2:AssignIpv6Addresses\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeNetworkInterfaces\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ nodePoolManagementARN:
+ description: "nodePoolManagementARN is an ARN value referencing
+ a role appropriate for the CAPI Controller.\n\nThe following
+ is an example of a valid policy document:\n\n{\n \"Version\":
+ \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\":
+ [\n \"ec2:AssociateRouteTable\",\n \"ec2:AttachInternetGateway\",\n
+ \ \"ec2:AuthorizeSecurityGroupIngress\",\n \"ec2:CreateInternetGateway\",\n
+ \ \"ec2:CreateNatGateway\",\n \"ec2:CreateRoute\",\n
+ \ \"ec2:CreateRouteTable\",\n \"ec2:CreateSecurityGroup\",\n
+ \ \"ec2:CreateSubnet\",\n \"ec2:CreateTags\",\n
+ \ \"ec2:DeleteInternetGateway\",\n \"ec2:DeleteNatGateway\",\n
+ \ \"ec2:DeleteRouteTable\",\n \"ec2:DeleteSecurityGroup\",\n
+ \ \"ec2:DeleteSubnet\",\n \"ec2:DeleteTags\",\n
+ \ \"ec2:DescribeAccountAttributes\",\n \"ec2:DescribeAddresses\",\n
+ \ \"ec2:DescribeAvailabilityZones\",\n \"ec2:DescribeImages\",\n
+ \ \"ec2:DescribeInstances\",\n \"ec2:DescribeInternetGateways\",\n
+ \ \"ec2:DescribeNatGateways\",\n \"ec2:DescribeNetworkInterfaces\",\n
+ \ \"ec2:DescribeNetworkInterfaceAttribute\",\n
+ \ \"ec2:DescribeRouteTables\",\n \"ec2:DescribeSecurityGroups\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeVpcs\",\n
+ \ \"ec2:DescribeVpcAttribute\",\n \"ec2:DescribeVolumes\",\n
+ \ \"ec2:DetachInternetGateway\",\n \"ec2:DisassociateRouteTable\",\n
+ \ \"ec2:DisassociateAddress\",\n \"ec2:ModifyInstanceAttribute\",\n
+ \ \"ec2:ModifyNetworkInterfaceAttribute\",\n \"ec2:ModifySubnetAttribute\",\n
+ \ \"ec2:RevokeSecurityGroupIngress\",\n \"ec2:RunInstances\",\n
+ \ \"ec2:TerminateInstances\",\n \"tag:GetResources\",\n
+ \ \"ec2:CreateLaunchTemplate\",\n \"ec2:CreateLaunchTemplateVersion\",\n
+ \ \"ec2:DescribeLaunchTemplates\",\n \"ec2:DescribeLaunchTemplateVersions\",\n
+ \ \"ec2:DeleteLaunchTemplate\",\n \"ec2:DeleteLaunchTemplateVersions\"\n
+ \ ],\n \"Resource\": [\n \"*\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n {\n \"Condition\":
+ {\n \"StringLike\": {\n \"iam:AWSServiceName\":
+ \"elasticloadbalancing.amazonaws.com\"\n }\n },\n
+ \ \"Action\": [\n \"iam:CreateServiceLinkedRole\"\n
+ \ ],\n \"Resource\": [\n \"arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing\"\n
+ \ ],\n \"Effect\": \"Allow\"\n },\n {\n \"Action\":
+ [\n \"iam:PassRole\"\n ],\n \"Resource\":
+ [\n \"arn:*:iam::*:role/*-worker-role\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n\t {\n\t \t\"Effect\":
+ \"Allow\",\n\t \t\"Action\": [\n\t \t\t\"kms:Decrypt\",\n\t
+ \ \t\t\"kms:ReEncrypt\",\n\t \t\t\"kms:GenerateDataKeyWithoutPlainText\",\n\t
+ \ \t\t\"kms:DescribeKey\"\n\t \t],\n\t \t\"Resource\":
+ \"*\"\n\t },\n\t {\n\t \t\"Effect\": \"Allow\",\n\t
+ \ \t\"Action\": [\n\t \t\t\"kms:CreateGrant\"\n\t \t],\n\t
+ \ \t\"Resource\": \"*\",\n\t \t\"Condition\": {\n\t
+ \ \t\t\"Bool\": {\n\t \t\t\t\"kms:GrantIsForAWSResource\":
+ true\n\t \t\t}\n\t \t}\n\t }\n ]\n}"
+ maxLength: 2048
+ type: string
+ storageARN:
+ description: "storageARN is an ARN value referencing a
+ role appropriate for the Storage Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:AttachVolume\",\n\t\t\t\t\"ec2:CreateSnapshot\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"ec2:CreateVolume\",\n\t\t\t\t\"ec2:DeleteSnapshot\",\n\t\t\t\t\"ec2:DeleteTags\",\n\t\t\t\t\"ec2:DeleteVolume\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeSnapshots\",\n\t\t\t\t\"ec2:DescribeTags\",\n\t\t\t\t\"ec2:DescribeVolumes\",\n\t\t\t\t\"ec2:DescribeVolumesModifications\",\n\t\t\t\t\"ec2:DetachVolume\",\n\t\t\t\t\"ec2:ModifyVolume\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - controlPlaneOperatorARN
+ - imageRegistryARN
+ - ingressARN
+ - kubeCloudControllerARN
+ - networkARN
+ - nodePoolManagementARN
+ - storageARN
+ type: object
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints specifies optional custom endpoints which will override
+ the default service endpoint of specific AWS Services.
+
+ There must be only one ServiceEndpoint for a given service name.
+ items:
+ description: |-
+ AWSServiceEndpoint stores the configuration for services to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ This must be provided and cannot be empty.
+ maxLength: 255
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 50
+ type: array
+ sharedVPC:
+ description: |-
+ sharedVPC contains fields that must be specified if the HostedCluster must use a VPC that is
+ created in a different AWS account and is shared with the AWS account where the HostedCluster
+ will be created.
+ properties:
+ localZoneID:
+ description: |-
+ localZoneID is the ID of the route53 hosted zone for [cluster-name].hypershift.local that is
+ associated with the HostedCluster's VPC and exists in the VPC owner account.
+ maxLength: 32
+ type: string
+ rolesRef:
+ description: |-
+ rolesRef contains references to roles in the VPC owner account that enable a
+ HostedCluster on a shared VPC.
+ properties:
+ controlPlaneARN:
+ description: "controlPlaneARN is an ARN value referencing
+ the role in the VPC owner account that allows\nthe
+ control plane operator in the cluster account to
+ create and manage a VPC endpoint, its\ncorresponding
+ Security Group, and DNS records in the hypershift
+ local hosted zone.\n\nThe referenced role must have
+ a trust relationship that allows it to be assumed
+ by the\ncontrol plane operator role in the VPC creator
+ account.\nExample:\n{\n\t \"Version\": \"2012-10-17\",\n\t
+ \"Statement\": [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t
+ \t\t\"Effect\": \"Allow\",\n\t \t\t\"Principal\":
+ {\n\t \t\t\t\"AWS\": \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-control-plane-operator\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing
+ the role in the VPC owner account that allows the\ningress
+ operator in the cluster account to create and manage
+ records in the private DNS\nhosted zone.\n\nThe
+ referenced role must have a trust relationship that
+ allows it to be assumed by the\ningress operator
+ role in the VPC creator account.\nExample:\n{\n\t
+ \"Version\": \"2012-10-17\",\n\t \"Statement\":
+ [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t \t\t\"Effect\":
+ \"Allow\",\n\t \t\t\"Principal\": {\n\t \t\t\t\"AWS\":
+ \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-openshift-ingress\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n(Based on https://docs.openshift.com/rosa/rosa_install_access_delete_clusters/rosa-shared-vpc-config.html#rosa-sharing-vpc-dns-and-roles_rosa-shared-vpc-config)\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"route53:ListHostedZonesByName\",\n\t\t\t\t\"route53:ChangeTagsForResource\",\n\t\t\t\t\"route53:GetAccountLimit\",\n\t\t\t\t\"route53:GetChange\",\n\t\t\t\t\"route53:GetHostedZone\",\n\t\t\t\t\"route53:ListTagsForResource\",\n\t\t\t\t\"route53:UpdateHostedZoneComment\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"tag:UntagResources\"\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ required:
+ - controlPlaneARN
+ - ingressARN
+ type: object
+ required:
+ - localZoneID
+ - rolesRef
+ type: object
+ required:
+ - region
+ - rolesRef
+ type: object
+ azure:
+ description: azure defines azure specific settings
+ properties:
+ azureAuthenticationConfig:
+ description: |-
+ azureAuthenticationConfig is the type of Azure authentication configuration to use to authenticate with Azure's
+ Cloud API.
+ properties:
+ azureAuthenticationConfigType:
+ description: |-
+ azureAuthenticationConfigType is the type of identity configuration used in the Hosted Cluster. This field is
+ used to determine which identity configuration is being used. Valid values are "ManagedIdentities" and
+ "WorkloadIdentities".
+ enum:
+ - ManagedIdentities
+ - WorkloadIdentities
+ type: string
+ managedIdentities:
+ description: |-
+ managedIdentities contains the managed identities needed for HCP control plane and data plane components that
+ authenticate with Azure's API.
+
+ These are required for managed Azure, also known as ARO HCP.
+ properties:
+ controlPlane:
+ description: |-
+ controlPlane contains the client IDs of all the managed identities on the HCP control plane needing to
+ authenticate with Azure's API.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is a pre-existing managed identity associated with the azure cloud provider, aka cloud controller
+ manager.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ controlPlaneOperator:
+ description: controlPlaneOperator is a pre-existing
+ managed identity associated with the control
+ plane operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ disk:
+ description: disk is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ file:
+ description: file is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ imageRegistry:
+ description: imageRegistry is a pre-existing managed
+ identity associated with the cluster-image-registry-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ ingress:
+ description: ingress is a pre-existing managed
+ identity associated with the cluster-ingress-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ managedIdentitiesKeyVault:
+ description: |-
+ managedIdentitiesKeyVault contains information on the management cluster's managed identities Azure Key Vault.
+ This Key Vault is where the managed identities certificates are stored. These certificates are pulled out of the
+ Key Vault by the Secrets Store CSI driver and mounted into a volume on control plane pods requiring
+ authentication with Azure API.
+
+ More information on how the Secrets Store CSI driver works to do this can be found here:
+ https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver.
+ properties:
+ name:
+ description: name is the name of the Azure
+ Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ tenantID:
+ description: tenantID is the tenant ID of
+ the Azure Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - tenantID
+ type: object
+ network:
+ description: network is a pre-existing managed
+ identity associated with the cluster-network-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ nodePoolManagement:
+ description: nodePoolManagement is a pre-existing
+ managed identity associated with the operator
+ managing the NodePools.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - cloudProvider
+ - controlPlaneOperator
+ - disk
+ - file
+ - ingress
+ - managedIdentitiesKeyVault
+ - network
+ - nodePoolManagement
+ type: object
+ dataPlane:
+ description: |-
+ dataPlane contains the client IDs of all the managed identities on the data plane needing to authenticate with
+ Azure's API.
+ properties:
+ diskMSIClientID:
+ description: diskMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI Disk driver.
+ maxLength: 255
+ type: string
+ fileMSIClientID:
+ description: fileMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI File driver.
+ maxLength: 255
+ type: string
+ imageRegistryMSIClientID:
+ description: |-
+ imageRegistryMSIClientID is the client ID of a pre-existing managed identity ID associated with the image
+ registry controller.
+ maxLength: 255
+ type: string
+ required:
+ - diskMSIClientID
+ - fileMSIClientID
+ - imageRegistryMSIClientID
+ type: object
+ required:
+ - controlPlane
+ - dataPlane
+ type: object
+ workloadIdentities:
+ description: |-
+ workloadIdentities is a struct of client IDs for each component that needs to authenticate with Azure's API in
+ self-managed Azure. These client IDs are used to authenticate with Azure cloud on both the control plane and data
+ plane.
+
+ This is required for self-managed Azure.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is the client ID of a federated managed identity, associated with azure-cloud-provider, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ disk:
+ description: |-
+ disk is the client ID of a federated managed identity, associated with cluster-storage-operator-disk,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ file:
+ description: |-
+ file is the client ID of a federated managed identity, associated with cluster-storage-operator-file,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ imageRegistry:
+ description: |-
+ imageRegistry is the client ID of a federated managed identity, associated with cluster-image-registry-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ ingress:
+ description: |-
+ ingress is the client ID of a federated managed identity, associated with cluster-ingress-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ network:
+ description: |-
+ network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ nodePoolManagement:
+ description: |-
+ nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
+ in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ required:
+ - cloudProvider
+ - disk
+ - file
+ - imageRegistry
+ - ingress
+ - network
+ - nodePoolManagement
+ type: object
+ required:
+ - azureAuthenticationConfigType
+ type: object
+ x-kubernetes-validations:
+ - message: managedIdentities is required when azureAuthenticationConfigType
+ is ManagedIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''ManagedIdentities''
+ ? has(self.managedIdentities) : !has(self.managedIdentities)'
+ - message: workloadIdentities is required when azureAuthenticationConfigType
+ is WorkloadIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''WorkloadIdentities''
+ ? has(self.workloadIdentities) : !has(self.workloadIdentities)'
+ cloud:
+ default: AzurePublicCloud
+ description: 'cloud is the cloud environment identifier, valid
+ values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33'
+ enum:
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ location:
+ description: |-
+ location is the Azure region in where all the cloud infrastructure resources will be created.
+
+ Example: eastus
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: Location is immutable
+ rule: self == oldSelf
+ resourceGroup:
+ default: default
+ description: |-
+ resourceGroup is the name of an existing resource group where all cloud resources created by the Hosted
+ Cluster are to be placed. The resource group is expected to exist under the same subscription as SubscriptionID.
+
+ In ARO HCP, this will be the managed resource group where customer cloud resources will be created.
+
+ Resource group naming requirements can be found here: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ResourceGroup.Name/.
+
+ Example: if your resource group ID is /subscriptions//resourceGroups/, your
+ ResourceGroupName is .
+ maxLength: 90
+ pattern: ^[a-zA-Z0-9_()\-\.]{1,89}[a-zA-Z0-9_()\-]$
+ type: string
+ x-kubernetes-validations:
+ - message: ResourceGroupName is immutable
+ rule: self == oldSelf
+ securityGroupID:
+ description: |-
+ securityGroupID is the ID of an existing security group on the SubnetID. This field is provided as part of the
+ configuration for the Azure cloud provider, aka Azure cloud controller manager (CCM). This security group is
+ expected to exist under the same subscription as SubscriptionID.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SecurityGroupID is immutable
+ rule: self == oldSelf
+ subnetID:
+ description: |-
+ subnetID is the subnet ID of an existing subnet where the nodes in the nodepool will be created. This can be a
+ different subnet than the one listed in the HostedCluster, HostedCluster.Spec.Platform.Azure.SubnetID, but must
+ exist in the same network, HostedCluster.Spec.Platform.Azure.VnetID, and must exist under the same subscription ID,
+ HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ subnetID is immutable once set.
+ The subnetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The vnetName should be between 2 and 64 characters, consisting only of alphanumeric characters, hyphens, underscores and periods and must not end with either a period (.) or hyphen (-) character.
+ The subnetName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores and must start with an alphanumeric character and must not end with a period (.) or hyphen (-) character.
+ maxLength: 355
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`
+ rule: size(self.split('/')) == 11 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Network/virtualNetworks/.*/subnets/.*$')
+ - message: The resourceGroupName should be between 1 and 90
+ characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the subnetID must not
+ end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The vnetName should be between 2 and 64 characters,
+ consisting only of alphanumeric characters, hyphens, underscores
+ and periods
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_\\.]{2,64}')
+ - message: the vnetName in the subnetID must not end with
+ either a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[8].endsWith(''.'') && !self.split(''/'')[8].endsWith(''-'')'
+ - message: The subnetName should be between 1 and 80 characters,
+ consisting only of alphanumeric characters, hyphens and
+ underscores and must start with an alphanumeric character
+ rule: self.split('/')[10].matches('[a-zA-Z0-9][a-zA-Z0-9-_\\.]{0,79}')
+ - message: the subnetName in the subnetID must not end with
+ a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[10].endsWith(''.'') && !self.split(''/'')[10].endsWith(''-'')'
+ - message: SubnetID is immutable
+ rule: self == oldSelf
+ subscriptionID:
+ description: subscriptionID is a unique identifier for an
+ Azure subscription used to manage resources.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SubscriptionID is immutable
+ rule: self == oldSelf
+ tenantID:
+ description: tenantID is a unique identifier for the tenant
+ where Azure resources will be created and managed in.
+ maxLength: 255
+ type: string
+ vnetID:
+ description: |-
+ vnetID is the ID of an existing VNET to use in creating VMs. The VNET can exist in a different resource group
+ other than the one specified in ResourceGroupName, but it must exist under the same subscription as
+ SubscriptionID.
+
+ In ARO HCP, this will be the ID of the customer provided VNET.
+
+ Example: /subscriptions//resourceGroups//providers/Microsoft.Network/virtualNetworks/
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: VnetID is immutable
+ rule: self == oldSelf
+ required:
+ - azureAuthenticationConfig
+ - location
+ - resourceGroup
+ - securityGroupID
+ - subnetID
+ - subscriptionID
+ - tenantID
+ - vnetID
+ type: object
+ ibmcloud:
+ description: ibmcloud defines IBMCloud specific settings for components
+ properties:
+ providerType:
+ description: providerType is a specific supported infrastructure
+ provider within IBM Cloud.
+ type: string
+ type: object
+ kubevirt:
+ description: kubevirt defines KubeVirt specific settings for cluster
+ components.
+ properties:
+ baseDomainPassthrough:
+ description: |-
+ baseDomainPassthrough toggles whether or not an automatically
+ generated base domain for the guest cluster should be used that
+ is a subdomain of the management cluster's *.apps DNS.
+
+ For the KubeVirt platform, the basedomain can be autogenerated using
+ the *.apps domain of the management/infra hosting cluster
+ This makes the guest cluster's base domain a subdomain of the
+ hypershift infra/mgmt cluster's base domain.
+
+ Example:
+ Infra/Mgmt cluster's DNS
+ Base: example.com
+ Cluster: mgmt-cluster.example.com
+ Apps: *.apps.mgmt-cluster.example.com
+ KubeVirt Guest cluster's DNS
+ Base: apps.mgmt-cluster.example.com
+ Cluster: guest.apps.mgmt-cluster.example.com
+ Apps: *.apps.guest.apps.mgmt-cluster.example.com
+
+ This is possible using OCP wildcard routes
+ type: boolean
+ x-kubernetes-validations:
+ - message: baseDomainPassthrough is immutable
+ rule: self == oldSelf
+ credentials:
+ description: |-
+ credentials defines the client credentials used when creating KubeVirt virtual machines.
+ Defining credentials is only necessary when the KubeVirt virtual machines are being placed
+ on a cluster separate from the one hosting the Hosted Control Plane components.
+
+ The default behavior when Credentials is not defined is for the KubeVirt VMs to be placed on
+ the same cluster and namespace as the Hosted Control Plane.
+ properties:
+ infraKubeConfigSecret:
+ description: |-
+ infraKubeConfigSecret is a reference to the secret containing the kubeconfig
+ of an external infrastructure cluster for kubevirt provider
+ properties:
+ key:
+ description: key is the key in the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: infraKubeConfigSecret is immutable
+ rule: self == oldSelf
+ infraNamespace:
+ description: |-
+ infraNamespace is the namespace in the external infrastructure cluster
+ where kubevirt resources will be created
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: infraNamespace is immutable
+ rule: self == oldSelf
+ required:
+ - infraNamespace
+ type: object
+ generateID:
+ description: |-
+ generateID is used to uniquely apply a name suffix to resources associated with
+ kubevirt infrastructure resources
+ maxLength: 11
+ type: string
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is immutable once set
+ rule: self == oldSelf
+ storageDriver:
+ description: |-
+ storageDriver defines how the KubeVirt CSI driver exposes StorageClasses on
+ the infra cluster (hosting the VMs) to the guest cluster.
+ properties:
+ manual:
+ description: |-
+ manual is used to explicitly define how the infra storageclasses are
+ mapped to guest storageclasses
+ properties:
+ storageClassMapping:
+ description: |-
+ storageClassMapping maps StorageClasses on the infra cluster hosting
+ the KubeVirt VMs to StorageClasses that are made available within the
+ Guest Cluster.
+
+ NOTE: It is possible that not all capabilities of an infra cluster's
+ storageclass will be present for the corresponding guest clusters storageclass.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestStorageClassName:
+ description: |-
+ guestStorageClassName is the name that the corresponding storageclass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraStorageClassName:
+ description: |-
+ infraStorageClassName is the name of the infra cluster storage class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestStorageClassName
+ - infraStorageClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: storageClassMapping is immutable
+ rule: self == oldSelf
+ volumeSnapshotClassMapping:
+ description: |-
+ volumeSnapshotClassMapping maps VolumeSnapshotClasses on the infra cluster hosting
+ the KubeVirt VMs to VolumeSnapshotClasses that are made available within the
+ Guest Cluster.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestVolumeSnapshotClassName:
+ description: |-
+ guestVolumeSnapshotClassName is the name that the corresponding volumeSnapshotClass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraVolumeSnapshotClassName:
+ description: |-
+ infraVolumeSnapshotClassName is the name of the infra cluster volume snapshot class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestVolumeSnapshotClassName
+ - infraVolumeSnapshotClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: volumeSnapshotClassMapping is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver.Manual is immutable
+ rule: self == oldSelf
+ type:
+ default: Default
+ description: type represents the type of kubevirt csi
+ driver configuration to use
+ enum:
+ - None
+ - Default
+ - Manual
+ type: string
+ x-kubernetes-validations:
+ - message: storageDriver.Type is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is required once set
+ rule: '!has(oldSelf.generateID) || has(self.generateID)'
+ powervs:
+ description: |-
+ powervs specifies configuration for clusters running on IBMCloud Power VS Service.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ accountID:
+ description: |-
+ accountID is the IBMCloud account id.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the IBMCloud CIS Service Instance's Cloud Resource Name
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ pattern: '^crn:'
+ type: string
+ imageRegistryOperatorCloudCreds:
+ description: |-
+ imageRegistryOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for image registry operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ ingressOperatorCloudCreds:
+ description: |-
+ ingressOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for ingress operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ kubeCloudControllerCreds:
+ description: |
+ kubeCloudControllerCreds is a reference to a secret containing cloud
+ credentials with permissions matching the cloud controller policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ nodePoolManagementCreds:
+ description: |
+ nodePoolManagementCreds is a reference to a secret containing cloud
+ credentials with permissions matching the node pool management policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ region:
+ description: |-
+ region is the IBMCloud region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot image for a given release.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the IBMCloud Resource Group in which the cluster resides.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ serviceInstanceID:
+ description: |-
+ serviceInstanceID is the reference to the Power VS service on which the server instance(VM) will be created.
+ Power VS service is a container for all Power VS instances at a specific geographic region.
+ serviceInstance can be created via IBM Cloud catalog or CLI.
+ ServiceInstanceID is the unique identifier that can be obtained from IBM Cloud UI or IBM Cloud cli.
+
+ More detail about Power VS service instance.
+ https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-creating-power-virtual-server
+
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ storageOperatorCloudCreds:
+ description: |-
+ storageOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for storage operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ subnet:
+ description: |-
+ subnet is the subnet to use for control plane cloud resources.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ name:
+ description: name of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: |-
+ vpc specifies IBM Cloud PowerVS Load Balancing configuration for the control
+ plane.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ description: |-
+ name for VPC to used for all the service load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ region:
+ description: |-
+ region is the IBMCloud region in which VPC gets created, this VPC used for all the ingress traffic
+ into the OCP cluster.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ subnet:
+ description: |-
+ subnet is the subnet to use for load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where load balancer cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - region
+ type: object
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - accountID
+ - cisInstanceCRN
+ - imageRegistryOperatorCloudCreds
+ - ingressOperatorCloudCreds
+ - kubeCloudControllerCreds
+ - nodePoolManagementCreds
+ - region
+ - resourceGroup
+ - serviceInstanceID
+ - storageOperatorCloudCreds
+ - subnet
+ - vpc
+ - zone
+ type: object
+ type:
+ description: type is the type of infrastructure provider for the
+ cluster.
+ enum:
+ - AWS
+ - Azure
+ - IBMCloud
+ - KubeVirt
+ - Agent
+ - PowerVS
+ - None
+ maxLength: 100
+ type: string
+ x-kubernetes-validations:
+ - message: Type is immutable
+ rule: self == oldSelf
+ required:
+ - type
+ type: object
+ pullSecret:
+ description: |-
+ pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
+ and it will be injected into the container runtime of all NodePools.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ release:
+ description: |-
+ release specifies the desired OCP release payload for all the hosted cluster components.
+ This includes those components running management side like the Kube API Server and the CVO but also the operands which land in the hosted cluster data plane like the ingress controller, ovn agents, etc.
+ The maximum and minimum supported release versions are determined by the running Hypersfhit Operator.
+ Attempting to use an unsupported version will result in the HostedCluster being degraded and the validateReleaseImage condition being false.
+ Attempting to use a release with a skew against a NodePool release bigger than N-2 for the y-stream will result in leaving the NodePool in an unsupported state.
+ Changing this field will trigger a rollout of the control plane components.
+ The behavior of the rollout will be driven by the ControllerAvailabilityPolicy and InfrastructureAvailabilityPolicy for PDBs and maxUnavailable and surce policies.
+ properties:
+ image:
+ description: |-
+ image is the image pullspec of an OCP release payload image.
+ See https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags for a list of available images.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: Image must start with a word character (letters, digits,
+ or underscores) and contain no white spaces
+ rule: self.matches('^(\\w+\\S+)$')
+ required:
+ - image
+ type: object
+ secretEncryption:
+ description: |-
+ secretEncryption specifies a Kubernetes secret encryption strategy for the
+ control plane.
+ properties:
+ aescbc:
+ description: aescbc defines metadata about the AESCBC secret encryption
+ strategy
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to encrypt
+ new secrets
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - activeKey
+ type: object
+ kms:
+ description: kms defines metadata about the kms secret encryption
+ strategy
+ properties:
+ aws:
+ description: aws defines metadata about the configuration
+ of the AWS KMS Secret Encryption provider
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ auth:
+ description: auth defines metadata about the management
+ of credentials used to interact with AWS KMS
+ properties:
+ awsKms:
+ description: "awsKms is an ARN value referencing a
+ role appropriate for managing the auth via the AWS
+ KMS key.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n \t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"kms:Encrypt\",\n\t\t\t\t\"kms:Decrypt\",\n\t\t\t\t\"kms:ReEncrypt*\",\n\t\t\t\t\"kms:GenerateDataKey*\",\n\t\t\t\t\"kms:DescribeKey\"\n\t\t\t],\n\t\t\t\"Resource\":
+ %q\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - awsKms
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ region:
+ description: region contains the AWS region
+ maxLength: 255
+ type: string
+ required:
+ - activeKey
+ - auth
+ - region
+ type: object
+ azure:
+ description: azure defines metadata about the configuration
+ of the Azure KMS Secret Encryption provider using Azure
+ key vault
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ kms:
+ description: kms is a pre-existing managed identity used
+ to authenticate with Azure KMS.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity must
+ be a valid UUID. It should be 5 groups of hyphen
+ separated hexadecimal characters in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - activeKey
+ - kms
+ type: object
+ ibmcloud:
+ description: ibmcloud defines metadata for the IBM Cloud KMS
+ encryption strategy
+ properties:
+ auth:
+ description: auth defines metadata for how authentication
+ is done with IBM Cloud KMS
+ properties:
+ managed:
+ description: |-
+ managed defines metadata around the service to service authentication strategy for the IBM Cloud
+ KMS system (all provider managed).
+ type: object
+ type:
+ description: type defines the IBM Cloud KMS authentication
+ strategy
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ unmanaged:
+ description: unmanaged defines the auth metadata the
+ customer provides to interact with IBM Cloud KMS
+ properties:
+ credentials:
+ description: |-
+ credentials should reference a secret with a key field of IBMCloudIAMAPIKeySecretKey that contains a apikey to
+ call IBM Cloud KMS APIs
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - credentials
+ type: object
+ required:
+ - type
+ type: object
+ keyList:
+ description: keyList defines the list of keys used for
+ data encryption
+ items:
+ description: IBMCloudKMSKeyEntry defines metadata for
+ an IBM Cloud KMS encryption key
+ properties:
+ correlationID:
+ description: correlationID is an identifier used
+ to track all api call usage from hypershift
+ maxLength: 255
+ type: string
+ crkID:
+ description: crkID is the customer rook key id
+ maxLength: 255
+ type: string
+ instanceID:
+ description: instanceID is the id for the key protect
+ instance
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: |-
+ keyVersion is a unique number associated with the key. The number increments whenever a new
+ key is enabled for data encryption.
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ url:
+ description: url is the url to call key protect
+ apis over
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - correlationID
+ - crkID
+ - instanceID
+ - keyVersion
+ - url
+ type: object
+ maxItems: 100
+ type: array
+ region:
+ description: region is the IBM Cloud region
+ maxLength: 255
+ type: string
+ required:
+ - auth
+ - keyList
+ - region
+ type: object
+ provider:
+ description: provider defines the KMS provider
+ enum:
+ - IBMCloud
+ - AWS
+ - Azure
+ type: string
+ required:
+ - provider
+ type: object
+ type:
+ description: type defines the type of kube secret encryption being
+ used
+ enum:
+ - kms
+ - aescbc
+ type: string
+ required:
+ - type
+ type: object
+ serviceAccountSigningKey:
+ description: |-
+ serviceAccountSigningKey is a local reference to a secret that must have a "key" key whose content must be the private key
+ used by the service account token issuer.
+ If not specified, a service account signing key will
+ be generated automatically for the cluster.
+ When specifying a service account signing key, an IssuerURL must also be specified.
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ services:
+ description: |-
+ services specifies how individual control plane services endpoints are published for consumption.
+ This requires APIServer;OAuthServer;Konnectivity;Ignition.
+ This field is immutable for all platforms but IBMCloud.
+ Max is 6 to account for OIDC;OVNSbDb for backward compatibility though they are no-op.
+
+ -kubebuilder:validation:XValidation:rule="self.all(s, !(s.service == 'APIServer' && s.servicePublishingStrategy.type == 'Route') || has(s.servicePublishingStrategy.route.hostname))",message="If serviceType is 'APIServer' and publishing strategy is 'Route', then hostname must be set"
+ -kubebuilder:validation:XValidation:rule="self.platform.type == 'IBMCloud' ? ['APIServer', 'OAuthServer', 'Konnectivity'].all(requiredType, self.exists(s, s.service == requiredType))",message="Services list must contain at least 'APIServer', 'OAuthServer', and 'Konnectivity' service types" : ['APIServer', 'OAuthServer', 'Konnectivity', 'Ignition'].all(requiredType, self.exists(s, s.service == requiredType))",message="Services list must contain at least 'APIServer', 'OAuthServer', 'Konnectivity', and 'Ignition' service types"
+ -kubebuilder:validation:XValidation:rule="self.filter(s, s.servicePublishingStrategy.type == 'Route' && has(s.servicePublishingStrategy.route) && has(s.servicePublishingStrategy.route.hostname)).all(x, self.filter(y, y.servicePublishingStrategy.type == 'Route' && (has(y.servicePublishingStrategy.route) && has(y.servicePublishingStrategy.route.hostname) && y.servicePublishingStrategy.route.hostname == x.servicePublishingStrategy.route.hostname)).size() <= 1)",message="Each route publishingStrategy 'hostname' must be unique within the Services list."
+ -kubebuilder:validation:XValidation:rule="self.filter(s, s.servicePublishingStrategy.type == 'NodePort' && has(s.servicePublishingStrategy.nodePort) && has(s.servicePublishingStrategy.nodePort.address) && has(s.servicePublishingStrategy.nodePort.port)).all(x, self.filter(y, y.servicePublishingStrategy.type == 'NodePort' && (has(y.servicePublishingStrategy.nodePort) && has(y.servicePublishingStrategy.nodePort.address) && y.servicePublishingStrategy.nodePort.address == x.servicePublishingStrategy.nodePort.address && has(y.servicePublishingStrategy.nodePort.port) && y.servicePublishingStrategy.nodePort.port == x.servicePublishingStrategy.nodePort.port )).size() <= 1)",message="Each nodePort publishingStrategy 'nodePort' and 'hostname' must be unique within the Services list."
+ items:
+ description: |-
+ ServicePublishingStrategyMapping specifies how individual control plane services endpoints are published for consumption.
+ This includes APIServer;OAuthServer;Konnectivity;Ignition.
+ If a given service is not present in this list, it will be exposed publicly by default.
+ properties:
+ service:
+ description: |-
+ service identifies the type of service being published.
+ It can be APIServer;OAuthServer;Konnectivity;Ignition
+ OVNSbDb;OIDC are no-op and kept for backward compatibility.
+ This field is immutable.
+ enum:
+ - APIServer
+ - OAuthServer
+ - OIDC
+ - Konnectivity
+ - Ignition
+ - OVNSbDb
+ type: string
+ servicePublishingStrategy:
+ description: servicePublishingStrategy specifies how to publish
+ a service endpoint.
+ properties:
+ loadBalancer:
+ description: loadBalancer configures exposing a service
+ using a dedicated LoadBalancer.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the LoadBalancer and passed through to consumers of the service.
+ If omitted, the value will be inferred from the corev1.Service Load balancer type .status.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ nodePort:
+ description: nodePort configures exposing a service using
+ a NodePort.
+ properties:
+ address:
+ description: address is the host/ip that the NodePort
+ service is exposed over.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: address must be a valid hostname, IPv4, or
+ IPv6 address
+ rule: self.matches('^(([a-zA-Z0-9][-a-zA-Z0-9]*\\.)+[a-zA-Z]{2,}|localhost)$')
+ || self.matches('^((\\d{1,3}\\.){3}\\d{1,3})$')
+ || self.matches('^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$')
+ port:
+ description: |-
+ port is the port of the NodePort service. If <=0, the port is dynamically
+ assigned when the service is created.
+ format: int32
+ type: integer
+ required:
+ - address
+ type: object
+ route:
+ description: |-
+ route configures exposing a service using a Route through and an ingress controller behind a cloud Load Balancer.
+ The specifics of the setup are platform dependent.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the Route and passed through to consumers of the service.
+ If omitted, the value will be inferred from management ingress.Spec.Domain.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy used for the service.
+ It can be LoadBalancer;NodePort;Route;None;S3
+ enum:
+ - LoadBalancer
+ - NodePort
+ - Route
+ - None
+ - S3
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: nodePort is required when type is NodePort, and forbidden
+ otherwise
+ rule: 'self.type == ''NodePort'' ? has(self.nodePort) : !has(self.nodePort)'
+ - message: only route is allowed when type is Route, and forbidden
+ otherwise
+ rule: 'self.type == ''Route'' ? !has(self.nodePort) && !has(self.loadBalancer)
+ : !has(self.route)'
+ - message: only loadBalancer is required when type is LoadBalancer,
+ and forbidden otherwise
+ rule: 'self.type == ''LoadBalancer'' ? !has(self.nodePort)
+ && !has(self.route) : !has(self.loadBalancer)'
+ - message: None does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''None'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ - message: S3 does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''S3'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ required:
+ - service
+ - servicePublishingStrategy
+ type: object
+ maxItems: 6
+ type: array
+ sshKey:
+ description: |-
+ sshKey is a local reference to a Secret that must have a "id_rsa.pub" key whose content must be the public part of 1..N SSH keys.
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ When sshKey is set, the controllers will generate a machineConfig with the sshAuthorizedKeys https://coreos.github.io/ignition/configuration-v3_2/ populated with this value.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ tolerations:
+ description: tolerations when specified, define what custom tolerations
+ are added to the hcp pods.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ maxItems: 25
+ type: array
+ updateService:
+ description: |-
+ updateService may be used to specify the preferred upstream update service.
+ If omitted we will use the appropriate update service for the cluster and region.
+ This is used by the control plane operator to determine and signal the appropriate available upgrades in the hostedCluster.status.
+ type: string
+ x-kubernetes-validations:
+ - message: updateService must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - etcd
+ - networking
+ - platform
+ - pullSecret
+ - release
+ - services
+ type: object
+ x-kubernetes-validations:
+ - message: spec.services in body should have at least 4 items or 3 for
+ IBMCloud
+ rule: 'self.platform.type == ''IBMCloud'' ? size(self.services) >= 3
+ : size(self.services) >= 4'
+ - message: Services is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: 'self.platform.type != "IBMCloud" ? self.services == oldSelf.services
+ : true'
+ - message: Azure platform requires OAuthServer to use Route service publishing
+ strategy
+ rule: 'self.platform.type == "Azure" ? self.services.exists(s, s.service
+ == "OAuthServer" && s.servicePublishingStrategy.type == "Route") :
+ true'
+ - message: Azure platform requires Konnectivity to use Route service publishing
+ strategy
+ rule: 'self.platform.type == "Azure" ? self.services.exists(s, s.service
+ == "Konnectivity" && s.servicePublishingStrategy.type == "Route")
+ : true'
+ - message: Azure platform requires Ignition to use Route service publishing
+ strategy
+ rule: 'self.platform.type == "Azure" ? self.services.exists(s, s.service
+ == "Ignition" && s.servicePublishingStrategy.type == "Route") : true'
+ - message: If serviceAccountSigningKey is set, issuerURL must be set
+ rule: has(self.issuerURL) || !has(self.serviceAccountSigningKey)
+ - message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
+ rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
+ && s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
+ && has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
+ cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
+ - message: disableMultiNetwork can only be set to true when networkType
+ is 'Other'
+ rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)
+ || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork)
+ || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork
+ || self.networking.networkType == ''Other'''
+ - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
+ rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
+ || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
+ status:
+ description: status is the latest observed status of the HostedCluster.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the latest available observations of a control
+ plane's current state.
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ configuration:
+ description: configuration contains the cluster configuration status
+ of the HostedCluster
+ properties:
+ authentication:
+ description: |-
+ authentication contains the observed authentication configuration status from the hosted cluster.
+ This field reflects the current state of the cluster authentication including OAuth metadata,
+ OIDC client status, and other authentication-related configurations.
+ properties:
+ integratedOAuthMetadata:
+ description: |-
+ integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for the in-cluster integrated OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ This contains the observed value based on cluster state.
+ An explicitly set value in spec.oauthMetadata has precedence over this field.
+ This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
+ The key "oauthMetadata" is used to locate the data.
+ If the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config-managed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcClients:
+ description: |-
+ oidcClients is where participating operators place the current OIDC client status
+ for OIDC clients that can be customized by the cluster-admin.
+ items:
+ description: |-
+ OIDCClientStatus represents the current state
+ of platform components and how they interact with
+ the configured identity providers.
+ properties:
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component using the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component using the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ conditions:
+ description: |-
+ conditions are used to communicate the state of the `oidcClients` entry.
+
+ Supported conditions include Available, Degraded and Progressing.
+
+ If Available is true, the component is successfully using the configured client.
+ If Degraded is true, that means something has gone wrong trying to handle the client configuration.
+ If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or
+ in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ consumingUsers:
+ description: |-
+ consumingUsers is an optional list of ServiceAccounts requiring
+ read permissions on the `clientSecret` secret.
+
+ consumingUsers must not exceed 5 entries.
+ items:
+ description: ConsumingUser is an alias for string
+ which we add validation to. Currently only service
+ accounts are supported.
+ maxLength: 512
+ minLength: 1
+ pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ maxItems: 5
+ type: array
+ x-kubernetes-list-type: set
+ currentOIDCClients:
+ description: |-
+ currentOIDCClients is an optional list of clients that the component is currently using.
+ Entries must have unique issuerURL/clientID pairs.
+ items:
+ description: |-
+ OIDCClientReference is a reference to a platform component
+ client configuration.
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that specifies the client identifier, from
+ the identity provider, that the platform component is using for authentication
+ requests made to the identity provider.
+
+ clientID must not be empty.
+ minLength: 1
+ type: string
+ issuerURL:
+ description: |-
+ issuerURL is a required field that specifies the URL of the identity
+ provider that this client is configured to make requests against.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ oidcProviderName:
+ description: |-
+ oidcProviderName is a required reference to the 'name' of the identity provider
+ configured in 'oidcProviders' that this client is associated with.
+
+ oidcProviderName must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - clientID
+ - issuerURL
+ - oidcProviderName
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - issuerURL
+ - clientID
+ x-kubernetes-list-type: map
+ required:
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ type: object
+ type: object
+ controlPlaneEndpoint:
+ description: |-
+ controlPlaneEndpoint contains the endpoint information by which
+ external clients can access the control plane. This is populated
+ after the infrastructure is ready.
+ properties:
+ host:
+ description: host is the hostname on which the API server is serving.
+ maxLength: 255
+ type: string
+ port:
+ description: port is the port on which the API server is serving.
+ format: int32
+ type: integer
+ required:
+ - host
+ - port
+ type: object
+ customKubeconfig:
+ description: |-
+ customKubeconfig is a local secret reference to the external custom kubeconfig.
+ Once the hypershift operator sets this status field, it will generate a secret with the specified name containing a kubeconfig within the `HostedCluster` namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ ignitionEndpoint:
+ description: |-
+ ignitionEndpoint is the endpoint injected in the ign config userdata.
+ It exposes the config for instances to become kubernetes nodes.
+ maxLength: 1024
+ type: string
+ kubeadminPassword:
+ description: |-
+ kubeadminPassword is a reference to the secret that contains the initial
+ kubeadmin user password for the guest cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ kubeconfig:
+ description: |-
+ kubeconfig is a reference to the secret containing the default kubeconfig
+ for the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ oauthCallbackURLTemplate:
+ description: |-
+ oauthCallbackURLTemplate contains a template for the URL to use as a callback
+ for identity providers. The [identity-provider-name] placeholder must be replaced
+ with the name of an identity provider defined on the HostedCluster.
+ This is populated after the infrastructure is ready.
+ maxLength: 1024
+ type: string
+ payloadArch:
+ description: |-
+ payloadArch represents the CPU architecture type of the HostedCluster.Spec.Release.Image. The valid values are:
+ Multi, ARM64, AMD64, S390X, or PPC64LE.
+ enum:
+ - Multi
+ - ARM64
+ - AMD64
+ - PPC64LE
+ - S390X
+ type: string
+ platform:
+ description: platform contains platform-specific status of the HostedCluster
+ properties:
+ aws:
+ description: aws contains platform-specific status for AWS
+ properties:
+ defaultWorkerSecurityGroupID:
+ description: |-
+ defaultWorkerSecurityGroupID is the ID of a security group created by
+ the control plane operator. It is always added to worker machines in
+ addition to any security groups specified in the NodePool.
+ maxLength: 255
+ type: string
+ type: object
+ type: object
+ version:
+ description: |-
+ version is the status of the release version applied to the
+ HostedCluster.
+ properties:
+ availableUpdates:
+ description: |-
+ availableUpdates contains updates recommended for this
+ cluster. Updates which appear in conditionalUpdates but not in
+ availableUpdates may expose this cluster to known issues. This list
+ may be empty if no updates are recommended, if the update service
+ is unavailable, or if an invalid channel has been specified.
+ items:
+ description: Release represents an OpenShift release image and
+ associated metadata.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ maxItems: 100
+ nullable: true
+ type: array
+ conditionalUpdates:
+ description: |-
+ conditionalUpdates contains the list of updates that may be
+ recommended for this cluster if it meets specific required
+ conditions. Consumers interested in the set of updates that are
+ actually recommended for this cluster should use
+ availableUpdates. This list may be empty if no updates are
+ recommended, if the update service is unavailable, or if an empty
+ or invalid channel has been specified.
+ items:
+ description: |-
+ ConditionalUpdate represents an update which is recommended to some
+ clusters on the version the current cluster is reconciling, but which
+ may not be recommended for the current cluster.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the observations of the conditional update's
+ current status. Known types are:
+ * Recommended, for whether the update is recommended for the current cluster.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in
+ foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ release:
+ description: release is the target of the update.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ risks:
+ description: |-
+ risks represents the range of issues associated with
+ updating to the target release. The cluster-version
+ operator will evaluate all entries, and only recommend the
+ update if there is at least one entry and all entries
+ recommend the update.
+ items:
+ description: |-
+ ConditionalUpdateRisk represents a reason and cluster-state
+ for not recommending a conditional update.
+ properties:
+ matchingRules:
+ description: |-
+ matchingRules is a slice of conditions for deciding which
+ clusters match the risk and which do not. The slice is
+ ordered by decreasing precedence. The cluster-version
+ operator will walk the slice in order, and stop after the
+ first it can successfully evaluate. If no condition can be
+ successfully evaluated, the update will not be recommended.
+ items:
+ description: |-
+ ClusterCondition is a union of typed cluster conditions. The 'type'
+ property determines which of the type-specific properties are relevant.
+ When evaluated on a cluster, the condition may match, not match, or
+ fail to evaluate.
+ properties:
+ promql:
+ description: promql represents a cluster condition
+ based on PromQL.
+ properties:
+ promql:
+ description: |-
+ promql is a PromQL query classifying clusters. This query
+ query should return a 1 in the match case and a 0 in the
+ does-not-match case. Queries which return no time
+ series, or which return values besides 0 or 1, are
+ evaluation failures.
+ type: string
+ required:
+ - promql
+ type: object
+ type:
+ description: |-
+ type represents the cluster-condition type. This defines
+ the members and semantics of any additional properties.
+ enum:
+ - Always
+ - PromQL
+ type: string
+ required:
+ - type
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ message:
+ description: |-
+ message provides additional information about the risk of
+ updating, in the event that matchingRules match the cluster
+ state. This is only to be consumed by humans. It may
+ contain Line Feed characters (U+000A), which should be
+ rendered as new lines.
+ minLength: 1
+ type: string
+ name:
+ description: |-
+ name is the CamelCase reason for not recommending a
+ conditional update, in the event that matchingRules match the
+ cluster state.
+ minLength: 1
+ type: string
+ url:
+ description: url contains information about this risk.
+ format: uri
+ minLength: 1
+ type: string
+ required:
+ - matchingRules
+ - message
+ - name
+ - url
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - release
+ - risks
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-type: atomic
+ desired:
+ description: |-
+ desired is the version that the cluster is reconciling towards.
+ If the cluster is not yet fully initialized desired will be set
+ with the information available, which may be an image or a tag.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ history:
+ description: |-
+ history contains a list of the most recent versions applied to the cluster.
+ This value may be empty during cluster startup, and then will be updated
+ when a new update is being applied. The newest update is first in the
+ list and it is ordered by recency. Updates in the history have state
+ Completed if the rollout completed - if an update was failing or halfway
+ applied the state will be Partial. Only a limited amount of update history
+ is preserved.
+ items:
+ description: UpdateHistory is a single attempted update to the
+ cluster.
+ properties:
+ acceptedRisks:
+ description: |-
+ acceptedRisks records risks which were accepted to initiate the update.
+ For example, it may menition an Upgradeable=False or missing signature
+ that was overriden via desiredUpdate.force, or an update that was
+ initiated despite not being in the availableUpdates set of recommended
+ update targets.
+ type: string
+ completionTime:
+ description: |-
+ completionTime, if set, is when the update was fully applied. The update
+ that is currently being applied will have a null completion time.
+ Completion time will always be set for entries that are not the current
+ update (usually to the started time of the next update).
+ format: date-time
+ nullable: true
+ type: string
+ image:
+ description: |-
+ image is a container image location that contains the update. This value
+ is always populated.
+ type: string
+ startedTime:
+ description: startedTime is the time at which the update
+ was started.
+ format: date-time
+ type: string
+ state:
+ description: |-
+ state reflects whether the update was fully applied. The Partial state
+ indicates the update is not fully applied, while the Completed state
+ indicates the update was successfully rolled out at least once (all
+ parts of the update successfully applied).
+ type: string
+ verified:
+ description: |-
+ verified indicates whether the provided update was properly verified
+ before it was installed. If this is false the cluster may not be trusted.
+ Verified does not cover upgradeable checks that depend on the cluster
+ state at the time when the update target was accepted.
+ type: boolean
+ version:
+ description: |-
+ version is a semantic version identifying the update version. If the
+ requested image does not define a version, or if a failure occurs
+ retrieving the image, this value may be empty.
+ type: string
+ required:
+ - completionTime
+ - image
+ - startedTime
+ - state
+ - verified
+ type: object
+ type: array
+ observedGeneration:
+ description: |-
+ observedGeneration reports which version of the spec is being synced.
+ If this value is not equal to metadata.generation, then the desired
+ and conditions fields may represent a previous version.
+ format: int64
+ type: integer
+ required:
+ - availableUpdates
+ - desired
+ - observedGeneration
+ type: object
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/hostedclusters-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/hostedclusters-TechPreviewNoUpgrade.crd.yaml
new file mode 100644
index 00000000000..f99717db8f1
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/hostedclusters-TechPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,7908 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: TechPreviewNoUpgrade
+ name: hostedclusters.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ kind: HostedCluster
+ listKind: HostedClusterList
+ plural: hostedclusters
+ shortNames:
+ - hc
+ - hcs
+ singular: hostedcluster
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: Version
+ jsonPath: .status.version.history[?(@.state=="Completed")].version
+ name: Version
+ type: string
+ - description: KubeConfig Secret
+ jsonPath: .status.kubeconfig.name
+ name: KubeConfig
+ type: string
+ - description: Progress
+ jsonPath: .status.version.history[?(@.state!="")].state
+ name: Progress
+ type: string
+ - description: Available
+ jsonPath: .status.conditions[?(@.type=="Available")].status
+ name: Available
+ type: string
+ - description: Progressing
+ jsonPath: .status.conditions[?(@.type=="Progressing")].status
+ name: Progressing
+ type: string
+ - description: Message
+ jsonPath: .status.conditions[?(@.type=="Available")].message
+ name: Message
+ type: string
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ HostedCluster is the primary representation of a HyperShift cluster and encapsulates
+ the control plane and common data plane configuration. Creating a HostedCluster
+ results in a fully functional OpenShift control plane with no attached nodes.
+ To support workloads (e.g. pods), a HostedCluster may have one or more associated
+ NodePool resources.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the desired behavior of the HostedCluster.
+ properties:
+ additionalTrustBundle:
+ description: |-
+ additionalTrustBundle is a local reference to a ConfigMap that must have a "ca-bundle.crt" key
+ whose content must be a PEM-encoded X.509 certificate bundle that will be added to the hosted controlplane and nodes
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ This will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ auditWebhook:
+ description: |-
+ auditWebhook contains metadata for configuring an audit webhook endpoint
+ for a cluster to process cluster audit events. It references a secret that
+ contains the webhook information for the audit webhook endpoint. It is a
+ secret because if the endpoint has mTLS the kubeconfig will contain client
+ keys. The kubeconfig needs to be stored in the secret with a secret key
+ name that corresponds to the constant AuditWebhookKubeconfigKey.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ autoNode:
+ description: autoNode specifies the configuration for the autoNode
+ feature.
+ properties:
+ provisionerConfig:
+ description: provisionerConfig is the implementation used for
+ Node auto provisioning.
+ properties:
+ karpenter:
+ description: karpenter specifies the configuration for the
+ Karpenter provisioner.
+ properties:
+ aws:
+ description: aws specifies the AWS-specific configuration
+ for Karpenter.
+ properties:
+ roleARN:
+ description: roleARN specifies the ARN of the Karpenter
+ provisioner.
+ maxLength: 255
+ type: string
+ required:
+ - roleARN
+ type: object
+ platform:
+ description: platform specifies the platform-specific
+ configuration for Karpenter.
+ maxLength: 100
+ type: string
+ required:
+ - platform
+ type: object
+ name:
+ allOf:
+ - enum:
+ - Karpenter
+ - enum:
+ - Karpenter
+ description: name specifies the name of the provisioner to
+ use.
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - provisionerConfig
+ type: object
+ autoscaling:
+ description: |-
+ autoscaling specifies auto-scaling behavior that applies to all NodePools
+ associated with this HostedCluster.
+ properties:
+ balancingIgnoredLabels:
+ description: |-
+ balancingIgnoredLabels sets "--balancing-ignore-label " flag on cluster-autoscaler for each listed label.
+ This option specifies labels that cluster autoscaler should ignore when considering node group similarity.
+ For example, if you have nodes with "topology.ebs.csi.aws.com/zone" label, you can add name of this label here
+ to prevent cluster autoscaler from splitting nodes into different node groups based on its value.
+
+ HyperShift automatically appends platform-specific balancing ignore labels:
+ - AWS: "lifecycle", "k8s.amazonaws.com/eniConfig", "topology.k8s.aws/zone-id"
+ - Azure: "agentpool", "kubernetes.azure.com/agentpool"
+ - Common:
+ - "hypershift.openshift.io/nodePool"
+ - "topology.ebs.csi.aws.com/zone"
+ - "topology.disk.csi.azure.com/zone"
+ - "ibm-cloud.kubernetes.io/worker-id"
+ - "vpc-block-csi-driver-labels"
+ These labels are added by default and do not need to be manually specified.
+ items:
+ maxLength: 317
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-validations:
+ - message: Each balancingIgnoredLabels item must be a valid label
+ key
+ rule: self.all(l, l.matches('^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?[a-zA-Z0-9]([a-zA-Z0-9_.-]{0,61}[a-zA-Z0-9])?$'))
+ expanders:
+ description: |-
+ expanders guide the autoscaler in choosing node groups during scale-out.
+ Sets the order of expanders for scaling out node groups.
+ Options include:
+ * LeastWaste - selects the group with minimal idle CPU and memory after scaling.
+ * Priority - selects the group with the highest user-defined priority.
+ * Random - selects a group randomly.
+ If not specified, `[Priority, LeastWaste]` is the default.
+ Maximum of 3 expanders can be specified.
+ items:
+ description: ExpanderString contains the name of an expander
+ to be used by the cluster autoscaler.
+ enum:
+ - LeastWaste
+ - Priority
+ - Random
+ type: string
+ maxItems: 3
+ minItems: 1
+ type: array
+ maxFreeDifferenceRatioPercent:
+ description: |-
+ maxFreeDifferenceRatioPercent sets the maximum difference ratio for free resources between similar node groups. This parameter controls how strict the similarity check is when comparing node groups for load balancing.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means node groups must have exactly the same free resources to be considered similar (no difference allowed).
+ When set to 100, this means node groups will be considered similar regardless of their free resource differences (any difference allowed).
+ A value between 0 and 100 represents the maximum allowed difference ratio for free resources between node groups to be considered similar.
+ When omitted, the autoscaler defaults to 10%.
+ This affects the "--max-free-difference-ratio" flag on cluster-autoscaler.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ maxNodeProvisionTime:
+ description: |-
+ maxNodeProvisionTime is the maximum time to wait for node provisioning
+ before considering the provisioning to be unsuccessful, expressed as a Go
+ duration string. The default is 15 minutes.
+ maxLength: 100
+ pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
+ type: string
+ maxNodesTotal:
+ description: |-
+ maxNodesTotal is the maximum allowable number of nodes for the Autoscaler scale out to be operational.
+ The autoscaler will not grow the cluster beyond this number.
+ If omitted, the autoscaler will not have a maximum limit.
+ number.
+ format: int32
+ minimum: 0
+ type: integer
+ maxPodGracePeriod:
+ description: |-
+ maxPodGracePeriod is the maximum seconds to wait for graceful pod
+ termination before scaling down a NodePool. The default is 600 seconds.
+ format: int32
+ minimum: 0
+ type: integer
+ podPriorityThreshold:
+ description: |-
+ podPriorityThreshold enables users to schedule "best-effort" pods, which
+ shouldn't trigger autoscaler actions, but only run when there are spare
+ resources available. The default is -10.
+
+ See the following for more details:
+ https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#how-does-cluster-autoscaler-work-with-pod-priority-and-preemption
+ format: int32
+ type: integer
+ scaleDown:
+ description: |-
+ scaleDown configures the behavior of the Cluster Autoscaler scale down operation.
+ This field is only valid when scaling is set to ScaleUpAndScaleDown.
+ properties:
+ delayAfterAddSeconds:
+ description: |-
+ delayAfterAddSeconds sets how long after scale up the scale down evaluation resumes in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after scale up, without any delay.
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterDeleteSeconds:
+ description: |-
+ delayAfterDeleteSeconds sets how long after node deletion, scale down evaluation resumes, defaults to scan-interval.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after node deletion, without any delay.
+ When omitted, the autoscaler defaults to 0s.
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterFailureSeconds:
+ description: |-
+ delayAfterFailureSeconds sets how long after a scale down failure, scale down evaluation resumes.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after a scale down failure, without any delay.
+ When omitted, the autoscaler defaults to 180s (3 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ unneededDurationSeconds:
+ description: |-
+ unneededDurationSeconds establishes how long a node should be unneeded before it is eligible for scale down in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ utilizationThresholdPercent:
+ description: |-
+ utilizationThresholdPercent determines the node utilization level, defined as sum of requested resources divided by capacity, below which a node can be considered for scale down.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means nodes will only be considered for scale down if they are completely idle (0% utilization).
+ When set to 100, this means nodes will be considered for scale down regardless of their utilization level.
+ A value between 0 and 100 represents the utilization threshold below which a node can be considered for scale down.
+ When omitted, the autoscaler defaults to 50%.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ type: object
+ scaling:
+ default: ScaleUpAndScaleDown
+ description: |-
+ scaling defines the scaling behavior for the cluster autoscaler.
+ ScaleUpOnly means the autoscaler will only scale up nodes, never scale down.
+ ScaleUpAndScaleDown means the autoscaler will both scale up and scale down nodes.
+ When set to ScaleUpAndScaleDown, the scaleDown field can be used to configure scale down behavior.
+
+ Note: This field is only supported in OpenShift versions 4.19 and above.
+ enum:
+ - ScaleUpOnly
+ - ScaleUpAndScaleDown
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: scaleDown can only be set when scaling is ScaleUpAndScaleDown
+ rule: 'self.scaling == ''ScaleUpAndScaleDown'' ? true : !has(self.scaleDown)'
+ capabilities:
+ default: {}
+ description: |-
+ capabilities allows for disabling optional components at cluster install time.
+ This field is optional and once set cannot be changed.
+ properties:
+ disabled:
+ description: |-
+ disabled when specified, explicitly disables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+
+ Note: Disabling 'openshift-samples','Insights', 'Console', 'NodeTuning', 'Ingress' are only supported in OpenShift versions 4.20 and above.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Disabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Ingress capability can only be disabled if Console
+ capability is also disabled
+ rule: '!self.exists(cap, cap == ''Ingress'') || self.exists(cap,
+ cap == ''Console'')'
+ enabled:
+ description: |-
+ enabled when specified, explicitly enables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Enabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Capabilities is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Capabilities can not be both enabled and disabled at once.
+ rule: 'has(self.enabled) && has(self.disabled) ? self.enabled.all(e,
+ !(e in self.disabled)) : true'
+ channel:
+ description: |-
+ channel is an identifier for explicitly requesting that a non-default set of updates be applied to this cluster.
+ If omitted no particular upgrades are suggested.
+ maxLength: 100
+ minLength: 1
+ type: string
+ clusterID:
+ description: |-
+ clusterID uniquely identifies this cluster. This is expected to be an RFC4122 UUID value (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx in hexadecimal digits).
+ As with a Kubernetes metadata.uid, this ID uniquely identifies this cluster in space and time.
+ This value identifies the cluster in metrics pushed to telemetry and metrics produced by the control plane operators.
+ If a value is not specified, a random clusterID will be generated and set by the controller.
+ Once set, this value is immutable.
+ maxLength: 36
+ minLength: 36
+ type: string
+ x-kubernetes-validations:
+ - message: clusterID must be an RFC4122 UUID value (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+ in hexadecimal digits)
+ rule: self.matches('[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}')
+ - message: clusterID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ configuration:
+ description: |-
+ configuration specifies configuration for individual OCP components in the
+ cluster, represented as embedded resources that correspond to the openshift
+ configuration API.
+ properties:
+ apiServer:
+ description: |-
+ apiServer holds configuration (like serving certificates, client CA and CORS domains)
+ shared by all API servers in the system, among them especially kube-apiserver
+ and openshift-apiserver.
+ properties:
+ additionalCORSAllowedOrigins:
+ description: |-
+ additionalCORSAllowedOrigins lists additional, user-defined regular expressions describing hosts for which the
+ API server allows access using the CORS headers. This may be needed to access the API and the integrated OAuth
+ server from JavaScript applications.
+ The values are regular expressions that correspond to the Golang regular expression language.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ audit:
+ default:
+ profile: Default
+ description: |-
+ audit specifies the settings for audit configuration to be applied to all OpenShift-provided
+ API servers in the cluster.
+ properties:
+ customRules:
+ description: |-
+ customRules specify profiles per group. These profile take precedence over the
+ top-level profile field if they apply. They are evaluation from top to bottom and
+ the first one that matches, applies.
+ items:
+ description: |-
+ AuditCustomRule describes a custom rule for an audit profile that takes precedence over
+ the top-level profile.
+ properties:
+ group:
+ description: group is a name of group a request
+ user must be member of in order to this profile
+ to apply.
+ minLength: 1
+ type: string
+ profile:
+ description: |-
+ profile specifies the name of the desired audit policy configuration to be deployed to
+ all OpenShift-provided API servers in the cluster.
+
+ The following profiles are provided:
+ - Default: the existing default policy.
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ required:
+ - group
+ - profile
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - group
+ x-kubernetes-list-type: map
+ profile:
+ default: Default
+ description: |-
+ profile specifies the name of the desired top-level audit profile to be applied to all requests
+ sent to any of the OpenShift-provided API servers in the cluster (kube-apiserver,
+ openshift-apiserver and oauth-apiserver), with the exception of those requests that match
+ one or more of the customRules.
+
+ The following profiles are provided:
+ - Default: default policy which means MetaData level logging with the exception of events
+ (not logged at all), oauthaccesstokens and oauthauthorizetokens (both logged at RequestBody
+ level).
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ Warning: It is not recommended to disable audit logging by using the `None` profile unless you
+ are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues.
+ If you disable audit logging and a support situation arises, you might need to enable audit logging
+ and reproduce the issue in order to troubleshoot properly.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ type: object
+ clientCA:
+ description: |-
+ clientCA references a ConfigMap containing a certificate bundle for the signers that will be recognized for
+ incoming client certificates in addition to the operator managed signers. If this is empty, then only operator managed signers are valid.
+ You usually only have to set this if you have your own PKI you wish to honor client certificates from.
+ The ConfigMap must exist in the openshift-config namespace and contain the following required fields:
+ - ConfigMap.Data["ca-bundle.crt"] - CA bundle.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ encryption:
+ description: encryption allows the configuration of encryption
+ of resources at the datastore layer.
+ properties:
+ type:
+ description: |-
+ type defines what encryption type should be used to encrypt resources at the datastore layer.
+ When this field is unset (i.e. when it is set to the empty string), identity is implied.
+ The behavior of unset can and will change over time. Even if encryption is enabled by default,
+ the meaning of unset may change to a different encryption type based on changes in best practices.
+
+ When encryption is enabled, all sensitive resources shipped with the platform are encrypted.
+ This list of sensitive resources can and will change over time. The current authoritative list is:
+
+ 1. secrets
+ 2. configmaps
+ 3. routes.route.openshift.io
+ 4. oauthaccesstokens.oauth.openshift.io
+ 5. oauthauthorizetokens.oauth.openshift.io
+ enum:
+ - ""
+ - identity
+ - aescbc
+ - aesgcm
+ type: string
+ type: object
+ servingCerts:
+ description: |-
+ servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates
+ will be used for serving secure traffic.
+ properties:
+ namedCertificates:
+ description: |-
+ namedCertificates references secrets containing the TLS cert info for serving secure traffic to specific hostnames.
+ If no named certificates are provided, or no named certificates match the server name as understood by a client,
+ the defaultServingCertificate will be used.
+ items:
+ description: APIServerNamedServingCert maps a server
+ DNS name, as understood by a client, to a certificate.
+ properties:
+ names:
+ description: |-
+ names is a optional list of explicit DNS names (leading wildcards allowed) that should use this certificate to
+ serve secure traffic. If no names are provided, the implicit names will be extracted from the certificates.
+ Exact names trump over wildcard names. Explicit names defined here trump over extracted implicit names.
+ items:
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-list-type: atomic
+ servingCertificate:
+ description: |-
+ servingCertificate references a kubernetes.io/tls type secret containing the TLS cert info for serving secure traffic.
+ The secret must exist in the openshift-config namespace and contain the following required fields:
+ - Secret.Data["tls.key"] - TLS private key.
+ - Secret.Data["tls.crt"] - TLS certificate.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ tlsSecurityProfile:
+ description: |-
+ tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
+
+ If unset, a default (which may change between releases) is chosen. Note that only Old,
+ Intermediate and Custom profiles are currently supported, and the maximum available
+ minTLSVersion is VersionTLS12.
+ properties:
+ custom:
+ description: |-
+ custom is a user-defined TLS security profile. Be extremely careful using a custom
+ profile as invalid configurations can be catastrophic. An example custom profile
+ looks like this:
+
+ ciphers:
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ minTLSVersion: VersionTLS11
+ nullable: true
+ properties:
+ ciphers:
+ description: |-
+ ciphers is used to specify the cipher algorithms that are negotiated
+ during the TLS handshake. Operators may remove entries their operands
+ do not support. For example, to use DES-CBC3-SHA (yaml):
+
+ ciphers:
+ - DES-CBC3-SHA
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ minTLSVersion:
+ description: |-
+ minTLSVersion is used to specify the minimal version of the TLS protocol
+ that is negotiated during the TLS handshake. For example, to use TLS
+ versions 1.1, 1.2 and 1.3 (yaml):
+
+ minTLSVersion: VersionTLS11
+
+ NOTE: currently the highest minTLSVersion allowed is VersionTLS12
+ enum:
+ - VersionTLS10
+ - VersionTLS11
+ - VersionTLS12
+ - VersionTLS13
+ type: string
+ type: object
+ intermediate:
+ description: |-
+ intermediate is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ minTLSVersion: VersionTLS12
+ nullable: true
+ type: object
+ modern:
+ description: |-
+ modern is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ minTLSVersion: VersionTLS13
+ nullable: true
+ type: object
+ old:
+ description: |-
+ old is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ - DHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-ECDSA-AES128-SHA256
+
+ - ECDHE-RSA-AES128-SHA256
+
+ - ECDHE-ECDSA-AES128-SHA
+
+ - ECDHE-RSA-AES128-SHA
+
+ - ECDHE-ECDSA-AES256-SHA384
+
+ - ECDHE-RSA-AES256-SHA384
+
+ - ECDHE-ECDSA-AES256-SHA
+
+ - ECDHE-RSA-AES256-SHA
+
+ - DHE-RSA-AES128-SHA256
+
+ - DHE-RSA-AES256-SHA256
+
+ - AES128-GCM-SHA256
+
+ - AES256-GCM-SHA384
+
+ - AES128-SHA256
+
+ - AES256-SHA256
+
+ - AES128-SHA
+
+ - AES256-SHA
+
+ - DES-CBC3-SHA
+
+ minTLSVersion: VersionTLS10
+ nullable: true
+ type: object
+ type:
+ description: |-
+ type is one of Old, Intermediate, Modern or Custom. Custom provides
+ the ability to specify individual TLS security profile parameters.
+ Old, Intermediate and Modern are TLS security profiles based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
+
+ The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers
+ are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be
+ reduced.
+
+ Note that the Modern profile is currently not supported because it is not
+ yet well adopted by common software libraries.
+ enum:
+ - Old
+ - Intermediate
+ - Modern
+ - Custom
+ type: string
+ type: object
+ type: object
+ authentication:
+ description: |-
+ authentication specifies cluster-wide settings for authentication (like OAuth and
+ webhook token authenticators).
+ properties:
+ oauthMetadata:
+ description: |-
+ oauthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for an external OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ If oauthMetadata.name is non-empty, this value has precedence
+ over any metadata reference stored in status.
+ The key "oauthMetadata" is used to locate the data.
+ If specified and the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcProviders:
+ description: |-
+ oidcProviders are OIDC identity providers that can issue tokens
+ for this cluster
+ Can only be set if "Type" is set to "OIDC".
+
+ At most one provider can be configured.
+ items:
+ properties:
+ claimMappings:
+ description: |-
+ claimMappings is an optional field that configures the rules to be used by
+ the Kubernetes API server for translating claims in a JWT token, issued
+ by the identity provider, to a cluster identity.
+ properties:
+ extra:
+ description: |-
+ extra is an optional field for configuring the mappings
+ used to construct the extra attribute for the cluster identity.
+ When omitted, no extra attributes will be present on the cluster identity.
+ key values for extra mappings must be unique.
+ A maximum of 64 extra attribute mappings may be provided.
+ items:
+ description: |-
+ ExtraMapping allows specifying a key and CEL expression
+ to evaluate the keys' value. It is used to create additional
+ mappings and attributes added to a cluster identity from
+ a provided authentication token.
+ properties:
+ key:
+ description: |-
+ key is a required field that specifies the string
+ to use as the extra attribute key.
+
+ key must be a domain-prefix path (e.g 'example.org/foo').
+ key must not exceed 510 characters in length.
+ key must contain the '/' character, separating the domain and path characters.
+ key must not be empty.
+
+ The domain portion of the key (string of characters prior to the '/') must be a valid RFC1123 subdomain.
+ It must not exceed 253 characters in length.
+ It must start and end with an alphanumeric character.
+ It must only contain lower case alphanumeric characters and '-' or '.'.
+ It must not use the reserved domains, or be subdomains of, "kubernetes.io", "k8s.io", and "openshift.io".
+
+ The path portion of the key (string of characters after the '/') must not be empty and must consist of at least one
+ alphanumeric character, percent-encoded octets, '-', '.', '_', '~', '!', '$', '&', ''', '(', ')', '*', '+', ',', ';', '=', and ':'.
+ It must not exceed 256 characters in length.
+ maxLength: 510
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: key must contain the '/' character
+ rule: self.contains('/')
+ - message: the domain of the key must consist
+ of only lower case alphanumeric characters,
+ '-' or '.', and must start and end with
+ an alphanumeric character
+ rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
+ - message: the domain of the key must not
+ exceed 253 characters in length
+ rule: self.split('/', 2)[0].size() <= 253
+ - message: the domain 'kubernetes.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'kubernetes.io'
+ - message: the subdomains '*.kubernetes.io'
+ are reserved for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
+ - message: the domain 'k8s.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'k8s.io'
+ - message: the subdomains '*.k8s.io' are reserved
+ for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
+ - message: the domain 'openshift.io' is reserved
+ for OpenShift use
+ rule: self.split('/', 2)[0] != 'openshift.io'
+ - message: the subdomains '*.openshift.io'
+ are reserved for OpenShift use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
+ - message: the path of the key must not be
+ empty and must consist of at least one
+ alphanumeric character, percent-encoded
+ octets, apostrophe, '-', '.', '_', '~',
+ '!', '$', '&', '(', ')', '*', '+', ',',
+ ';', '=', and ':'
+ rule: self.split('/', 2)[1].matches('[A-Za-z0-9/\\-._~%!$&\'()*+;=:]+')
+ - message: the path of the key must not exceed
+ 256 characters in length
+ rule: self.split('/', 2)[1].size() <= 256
+ valueExpression:
+ description: |-
+ valueExpression is a required field to specify the CEL expression to extract
+ the extra attribute value from a JWT token's claims.
+ valueExpression must produce a string or string array value.
+ "", [], and null are treated as the extra mapping not being present.
+ Empty string values within an array are filtered out.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ valueExpression must not exceed 4096 characters in length.
+ valueExpression must not be empty.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ required:
+ - key
+ - valueExpression
+ type: object
+ maxItems: 64
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ groups:
+ description: |-
+ groups is an optional field that configures how the groups of a cluster identity
+ should be constructed from the claims in a JWT token issued
+ by the identity provider.
+ When referencing a claim, if the claim is present in the JWT
+ token, its value must be a list of groups separated by a comma (',').
+ For example - '"example"' and '"exampleOne", "exampleTwo", "exampleThree"' are valid claim values.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix is an optional field that configures the prefix that will be
+ applied to the cluster identity attribute during the process of mapping
+ JWT claims to cluster identity attributes.
+
+ When omitted (""), no prefix is applied to the cluster identity attribute.
+
+ Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains
+ an array of strings "a", "b" and "c", the mapping will result in an
+ array of string "myoidc:a", "myoidc:b" and "myoidc:c".
+ type: string
+ required:
+ - claim
+ type: object
+ uid:
+ description: |-
+ uid is an optional field for configuring the claim mapping
+ used to construct the uid for the cluster identity.
+
+ When using uid.claim to specify the claim it must be a single string value.
+ When using uid.expression the expression must result in a single string value.
+
+ When omitted, this means the user has no opinion and the platform
+ is left to choose a default, which is subject to change over time.
+ The current default is to use the 'sub' claim.
+ properties:
+ claim:
+ description: |-
+ claim is an optional field for specifying the
+ JWT token claim that is used in the mapping.
+ The value of this claim will be assigned to
+ the field in which this mapping is associated.
+
+ Precisely one of claim or expression must be set.
+ claim must not be specified when expression is set.
+ When specified, claim must be at least 1 character in length
+ and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ expression:
+ description: |-
+ expression is an optional field for specifying a
+ CEL expression that produces a string value from
+ JWT token claims.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ Precisely one of claim or expression must be set.
+ expression must not be specified when claim is set.
+ When specified, expression must be at least 1 character in length
+ and must not exceed 4096 characters in length.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: precisely one of claim or expression
+ must be set
+ rule: 'has(self.claim) ? !has(self.expression)
+ : has(self.expression)'
+ username:
+ description: |-
+ username is an optional field that configures how the username of a cluster identity
+ should be constructed from the claims in a JWT token issued by the identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix configures the prefix that should be prepended to the value
+ of the JWT claim.
+
+ prefix must be set when prefixPolicy is set to 'Prefix' and must be unset otherwise.
+ properties:
+ prefixString:
+ description: |-
+ prefixString is a required field that configures the prefix that will
+ be applied to cluster identity username attribute
+ during the process of mapping JWT claims to cluster identity attributes.
+
+ prefixString must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - prefixString
+ type: object
+ prefixPolicy:
+ description: |-
+ prefixPolicy is an optional field that configures how a prefix should be
+ applied to the value of the JWT claim specified in the 'claim' field.
+
+ Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
+
+ When set to 'Prefix', the value specified in the prefix field will be
+ prepended to the value of the JWT claim.
+ The prefix field must be set when prefixPolicy is 'Prefix'.
+
+ When set to 'NoPrefix', no prefix will be prepended to the value
+ of the JWT claim.
+
+ When omitted, this means no opinion and the platform is left to choose
+ any prefixes that are applied which is subject to change over time.
+ Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim
+ when the claim is not 'email'.
+ As an example, consider the following scenario:
+ `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
+ the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
+ and `claim` is set to:
+ - "username": the mapped value will be "https://myoidc.tld#userA"
+ - "email": the mapped value will be "userA@myoidc.tld"
+ enum:
+ - ""
+ - NoPrefix
+ - Prefix
+ type: string
+ required:
+ - claim
+ type: object
+ x-kubernetes-validations:
+ - message: prefix must be set if prefixPolicy is
+ 'Prefix', but must remain unset otherwise
+ rule: 'has(self.prefixPolicy) && self.prefixPolicy
+ == ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
+ > 0) : !has(self.prefix)'
+ type: object
+ claimValidationRules:
+ description: |-
+ claimValidationRules is an optional field that configures the rules to
+ be used by the Kubernetes API server for validating the claims in a JWT
+ token issued by the identity provider.
+
+ Validation rules are joined via an AND operation.
+ items:
+ properties:
+ requiredClaim:
+ description: |-
+ requiredClaim is an optional field that configures the required claim
+ and value that the Kubernetes API server will use to validate if an incoming
+ JWT is valid for this identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the name of the required claim.
+ When taken from the JWT claims, claim must be a string value.
+
+ claim must not be an empty string ("").
+ minLength: 1
+ type: string
+ requiredValue:
+ description: |-
+ requiredValue is a required field that configures the value that 'claim' must
+ have when taken from the incoming JWT claims.
+ If the value in the JWT claims does not match, the token
+ will be rejected for authentication.
+
+ requiredValue must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - claim
+ - requiredValue
+ type: object
+ type:
+ default: RequiredClaim
+ description: |-
+ type is an optional field that configures the type of the validation rule.
+
+ Allowed values are 'RequiredClaim' and omitted (not provided or an empty string).
+
+ When set to 'RequiredClaim', the Kubernetes API server
+ will be configured to validate that the incoming JWT
+ contains the required claim and that its value matches
+ the required value.
+
+ Defaults to 'RequiredClaim'.
+ enum:
+ - RequiredClaim
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ issuer:
+ description: |-
+ issuer is a required field that configures how the platform interacts
+ with the identity provider and how tokens issued from the identity provider
+ are evaluated by the Kubernetes API server.
+ properties:
+ audiences:
+ description: |-
+ audiences is a required field that configures the acceptable audiences
+ the JWT token, issued by the identity provider, must be issued to.
+ At least one of the entries must match the 'aud' claim in the JWT token.
+
+ audiences must contain at least one entry and must not exceed ten entries.
+ items:
+ minLength: 1
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ issuerCertificateAuthority:
+ description: |-
+ issuerCertificateAuthority is an optional field that configures the
+ certificate authority, used by the Kubernetes API server, to validate
+ the connection to the identity provider when fetching discovery information.
+
+ When not specified, the system trust is used.
+
+ When specified, it must reference a ConfigMap in the openshift-config
+ namespace containing the PEM-encoded CA certificates under the 'ca-bundle.crt'
+ key in the data field of the ConfigMap.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ issuerURL:
+ description: |-
+ issuerURL is a required field that configures the URL used to issue tokens
+ by the identity provider.
+ The Kubernetes API server determines how authentication tokens should be handled
+ by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ required:
+ - audiences
+ - issuerURL
+ type: object
+ name:
+ description: |-
+ name is a required field that configures the unique human-readable identifier
+ associated with the identity provider.
+ It is used to distinguish between multiple identity providers
+ and has no impact on token validation or authentication mechanics.
+
+ name must not be an empty string ("").
+ minLength: 1
+ type: string
+ oidcClients:
+ description: |-
+ oidcClients is an optional field that configures how on-cluster,
+ platform clients should request tokens from the identity provider.
+ oidcClients must not exceed 20 entries and entries must have unique namespace/name pairs.
+ items:
+ description: |-
+ OIDCClientConfig configures how platform clients
+ interact with identity providers as an authentication
+ method
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that configures the client identifier, from
+ the identity provider, that the platform component uses for authentication
+ requests made to the identity provider.
+ The identity provider must accept this identifier for platform components
+ to be able to use the identity provider as an authentication mode.
+
+ clientID must not be an empty string ("").
+ minLength: 1
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is an optional field that configures the client secret used
+ by the platform component when making authentication requests to the identity provider.
+
+ When not specified, no client secret will be used when making authentication requests
+ to the identity provider.
+
+ When specified, clientSecret references a Secret in the 'openshift-config'
+ namespace that contains the client secret in the 'clientSecret' key of the '.data' field.
+ The client secret will be used when making authentication requests to the identity provider.
+
+ Public clients do not require a client secret but private
+ clients do require a client secret to work with the identity provider.
+ properties:
+ name:
+ description: name is the metadata.name of
+ the referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component being configured to use the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component being configured to use the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ extraScopes:
+ description: |-
+ extraScopes is an optional field that configures the extra scopes that should
+ be requested by the platform component when making authentication requests to the
+ identity provider.
+ This is useful if you have configured claim mappings that requires specific
+ scopes to be requested beyond the standard OIDC scopes.
+
+ When omitted, no additional scopes are requested.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - clientID
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ required:
+ - issuer
+ - name
+ type: object
+ maxItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ serviceAccountIssuer:
+ description: |-
+ serviceAccountIssuer is the identifier of the bound service account token
+ issuer.
+ The default is https://kubernetes.default.svc
+ WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
+ previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
+ be trusted for a time period chosen by the platform (currently set to 24h).
+ This time period is subject to change over time.
+ This allows internal components to transition to use new service account issuer without service distruption.
+ type: string
+ type:
+ description: |-
+ type identifies the cluster managed, user facing authentication mode in use.
+ Specifically, it manages the component that responds to login attempts.
+ The default is IntegratedOAuth.
+ enum:
+ - ""
+ - None
+ - IntegratedOAuth
+ - OIDC
+ type: string
+ webhookTokenAuthenticator:
+ description: |-
+ webhookTokenAuthenticator configures a remote token reviewer.
+ These remote authentication webhooks can be used to verify bearer tokens
+ via the tokenreviews.authentication.k8s.io REST API. This is required to
+ honor bearer tokens that are provisioned by an external authentication service.
+
+ Can only be set if "Type" is set to "None".
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig references a secret that contains kube config file data which
+ describes how to access the remote webhook service.
+ The namespace for the referenced secret is openshift-config.
+
+ For further details, see:
+
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - kubeConfig
+ type: object
+ webhookTokenAuthenticators:
+ description: webhookTokenAuthenticators is DEPRECATED, setting
+ it has no effect.
+ items:
+ description: |-
+ deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
+ It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig contains kube config file data which describes how to access the remote webhook service.
+ For further details, see:
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ The namespace for this secret is determined by the point of use.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ featureGate:
+ description: featureGate holds cluster-wide information about
+ feature gates.
+ properties:
+ customNoUpgrade:
+ description: |-
+ customNoUpgrade allows the enabling or disabling of any feature. Turning this feature set on IS NOT SUPPORTED, CANNOT BE UNDONE, and PREVENTS UPGRADES.
+ Because of its nature, this setting cannot be validated. If you have any typos or accidentally apply invalid combinations
+ your cluster may fail in an unrecoverable way. featureSet must equal "CustomNoUpgrade" must be set to use this field.
+ nullable: true
+ properties:
+ disabled:
+ description: disabled is a list of all feature gates that
+ you want to force off
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ enabled:
+ description: enabled is a list of all feature gates that
+ you want to force on
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ type: object
+ featureSet:
+ description: |-
+ featureSet changes the list of features in the cluster. The default is empty. Be very careful adjusting this setting.
+ Turning on or off features may cause irreversible changes in your cluster which cannot be undone.
+ enum:
+ - CustomNoUpgrade
+ - DevPreviewNoUpgrade
+ - TechPreviewNoUpgrade
+ - ""
+ type: string
+ x-kubernetes-validations:
+ - message: CustomNoUpgrade may not be changed
+ rule: 'oldSelf == ''CustomNoUpgrade'' ? self == ''CustomNoUpgrade''
+ : true'
+ - message: TechPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''TechPreviewNoUpgrade'' ? self == ''TechPreviewNoUpgrade''
+ : true'
+ - message: DevPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''DevPreviewNoUpgrade'' ? self == ''DevPreviewNoUpgrade''
+ : true'
+ type: object
+ image:
+ description: |-
+ image governs policies related to imagestream imports and runtime configuration
+ for external registries. It allows cluster admins to configure which registries
+ OpenShift is allowed to import images from, extra CA trust bundles for external
+ registries, and policies to block or allow registry hostnames.
+ When exposing OpenShift's image registry to the public, this also lets cluster
+ admins specify the external hostname.
+ This input will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ additionalTrustedCA:
+ description: |-
+ additionalTrustedCA is a reference to a ConfigMap containing additional CAs that
+ should be trusted during imagestream import, pod image pull, build image pull, and
+ imageregistry pullthrough.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ allowedRegistriesForImport:
+ description: |-
+ allowedRegistriesForImport limits the container image registries that normal users may import
+ images from. Set this list to the registries that you trust to contain valid Docker
+ images and that you want applications to be able to import from. Users with
+ permission to create Images or ImageStreamMappings via the API are not affected by
+ this policy - typically only administrators or system integrations will have those
+ permissions.
+ items:
+ description: |-
+ RegistryLocation contains a location of the registry specified by the registry domain
+ name. The domain name might include wildcards, like '*' or '??'.
+ properties:
+ domainName:
+ description: |-
+ domainName specifies a domain name for the registry
+ In case the registry use non-standard (80 or 443) port, the port should be included
+ in the domain name as well.
+ type: string
+ insecure:
+ description: |-
+ insecure indicates whether the registry is secure (https) or insecure (http)
+ By default (if not specified) the registry is assumed as secure.
+ type: boolean
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalRegistryHostnames:
+ description: |-
+ externalRegistryHostnames provides the hostnames for the default external image
+ registry. The external hostname should be set only when the image registry
+ is exposed externally. The first value is used in 'publicDockerImageRepository'
+ field in ImageStreams. The value must be in "hostname[:port]" format.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ registrySources:
+ description: |-
+ registrySources contains configuration that determines how the container runtime
+ should treat individual registries when accessing images for builds+pods. (e.g.
+ whether or not to allow insecure access). It does not contain configuration for the
+ internal cluster registry.
+ properties:
+ allowedRegistries:
+ description: |-
+ allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ blockedRegistries:
+ description: |-
+ blockedRegistries cannot be used for image pull and push actions. All other registries are permitted.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ containerRuntimeSearchRegistries:
+ description: |-
+ containerRuntimeSearchRegistries are registries that will be searched when pulling images that do not have fully qualified
+ domains in their pull specs. Registries will be searched in the order provided in the list.
+ Note: this search list only works with the container runtime, i.e CRI-O. Will NOT work with builds or imagestream imports.
+ format: hostname
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ insecureRegistries:
+ description: insecureRegistries are registries which do
+ not have a valid TLS certificates or only support HTTP
+ connections.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-validations:
+ - message: Only one of blockedRegistries or allowedRegistries
+ may be set
+ rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
+ : true'
+ type: object
+ ingress:
+ description: |-
+ ingress holds cluster-wide information about ingress, including the default ingress domain
+ used for routes.
+ properties:
+ appsDomain:
+ description: |-
+ appsDomain is an optional domain to use instead of the one specified
+ in the domain field when a Route is created without specifying an explicit
+ host. If appsDomain is nonempty, this value is used to generate default
+ host values for Route. Unlike domain, appsDomain may be modified after
+ installation.
+ This assumes a new ingresscontroller has been setup with a wildcard
+ certificate.
+ type: string
+ componentRoutes:
+ description: |-
+ componentRoutes is an optional list of routes that are managed by OpenShift components
+ that a cluster-admin is able to configure the hostname and serving certificate for.
+ The namespace and name of each route in this list should match an existing entry in the
+ status.componentRoutes list.
+
+ To determine the set of configurable Routes, look at namespace and name of entries in the
+ .status.componentRoutes list, where participating operators write the status of
+ configurable routes.
+ items:
+ description: ComponentRouteSpec allows for configuration
+ of a route's hostname and serving certificate.
+ properties:
+ hostname:
+ description: hostname is the hostname that should be
+ used by the route.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ servingCertKeyPairSecret:
+ description: |-
+ servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
+ The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
+ If the custom hostname uses the default routing suffix of the cluster,
+ the Secret specification for a serving certificate will not be needed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - hostname
+ - name
+ - namespace
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ domain:
+ description: |-
+ domain is used to generate a default host name for a route when the
+ route's host name is empty. The generated host name will follow this
+ pattern: "..".
+
+ It is also used as the default wildcard domain suffix for ingress. The
+ default ingresscontroller domain will follow this pattern: "*.".
+
+ Once set, changing domain is not currently supported.
+ type: string
+ loadBalancer:
+ description: |-
+ loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
+ provider of the current cluster and are required for Ingress Controller to work on OpenShift.
+ properties:
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for the ingress load balancers.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains settings specific to the
+ Amazon Web Services infrastructure provider.
+ properties:
+ type:
+ description: |-
+ type allows user to set a load balancer type.
+ When this field is set the default ingresscontroller will get created using the specified LBType.
+ If this field is not set then the default ingress controller of LBType Classic will be created.
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - NLB
+ - Classic
+ type: string
+ required:
+ - type
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
+ "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
+ and must handle unrecognized platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ type: object
+ type: object
+ requiredHSTSPolicies:
+ description: |-
+ requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
+ matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
+ Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
+ annotation, and affect route admission.
+
+ A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
+ "haproxy.router.openshift.io/hsts_header"
+ E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
+
+ - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
+ is rejected.
+ - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
+ determines the route's admission status.
+ - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then it may use any HSTS Policy annotation.
+
+ The HSTS policy configuration may be changed after routes have already been created. An update to a previously
+ admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
+ However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
+
+ Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
+ items:
+ properties:
+ domainPatterns:
+ description: |-
+ domainPatterns is a list of domains for which the desired HSTS annotations are required.
+ If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
+ the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
+
+ The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
+ foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ includeSubDomainsPolicy:
+ description: |-
+ includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
+ domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
+ - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ enum:
+ - RequireIncludeSubDomains
+ - RequireNoIncludeSubDomains
+ - NoOpinion
+ type: string
+ maxAge:
+ description: |-
+ maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
+ If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
+ If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
+ maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
+ policy will eventually expire on that client.
+ properties:
+ largestMaxAge:
+ description: |-
+ The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ This value can be left unspecified, in which case no upper limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ smallestMaxAge:
+ description: |-
+ The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
+ tool for administrators to quickly correct mistakes.
+ This value can be left unspecified, in which case no lower limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ type: object
+ namespaceSelector:
+ description: |-
+ namespaceSelector specifies a label selector such that the policy applies only to those routes that
+ are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
+ Defaults to the empty LabelSelector, which matches everything.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label
+ selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the
+ selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ preloadPolicy:
+ description: |-
+ preloadPolicy directs the client to include hosts in its host preload list so that
+ it never needs to do an initial load to get the HSTS header (note that this is not defined
+ in RFC 6797 and is therefore client implementation-dependent).
+ enum:
+ - RequirePreload
+ - RequireNoPreload
+ - NoOpinion
+ type: string
+ required:
+ - domainPatterns
+ type: object
+ type: array
+ type: object
+ network:
+ description: |-
+ network holds cluster-wide information about the network. It is used to configure the desired network configuration, such as: IP address pools for services/pod IPs, network plugin, etc.
+ Please view network.spec for an explanation on what applies when configuring this resource.
+ properties:
+ clusterNetwork:
+ description: |-
+ IP address pool to use for pod IPs.
+ This field is immutable after installation.
+ items:
+ description: |-
+ ClusterNetworkEntry is a contiguous block of IP addresses from which pod IPs
+ are allocated.
+ properties:
+ cidr:
+ description: The complete block for pod IPs.
+ type: string
+ hostPrefix:
+ description: |-
+ The size (prefix) of block to allocate to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalIP:
+ description: |-
+ externalIP defines configuration for controllers that
+ affect Service.ExternalIP. If nil, then ExternalIP is
+ not allowed to be set.
+ properties:
+ autoAssignCIDRs:
+ description: |-
+ autoAssignCIDRs is a list of CIDRs from which to automatically assign
+ Service.ExternalIP. These are assigned when the service is of type
+ LoadBalancer. In general, this is only useful for bare-metal clusters.
+ In Openshift 3.x, this was misleadingly called "IngressIPs".
+ Automatically assigned External IPs are not affected by any
+ ExternalIPPolicy rules.
+ Currently, only one entry may be provided.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ policy:
+ description: |-
+ policy is a set of restrictions applied to the ExternalIP field.
+ If nil or empty, then ExternalIP is not allowed to be set.
+ properties:
+ allowedCIDRs:
+ description: allowedCIDRs is the list of allowed CIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ rejectedCIDRs:
+ description: |-
+ rejectedCIDRs is the list of disallowed CIDRs. These take precedence
+ over allowedCIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkDiagnostics:
+ description: |-
+ networkDiagnostics defines network diagnostics configuration.
+
+ Takes precedence over spec.disableNetworkDiagnostics in network.operator.openshift.io.
+ If networkDiagnostics is not specified or is empty,
+ and the spec.disableNetworkDiagnostics flag in network.operator.openshift.io is set to true,
+ the network diagnostics feature will be disabled.
+ properties:
+ mode:
+ description: |-
+ mode controls the network diagnostics mode
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is All.
+ enum:
+ - ""
+ - All
+ - Disabled
+ type: string
+ sourcePlacement:
+ description: |-
+ sourcePlacement controls the scheduling of network diagnostics source deployment
+
+ See NetworkDiagnosticsSourcePlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is an empty list.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ targetPlacement:
+ description: |-
+ targetPlacement controls the scheduling of network diagnostics target daemonset
+
+ See NetworkDiagnosticsTargetPlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `- operator: "Exists"` which means that all taints are tolerated.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkType:
+ description: |-
+ networkType is the plugin that is to be deployed (e.g. OVNKubernetes).
+ This should match a value that the cluster-network-operator understands,
+ or else no networking will be installed.
+ Currently supported values are:
+ - OVNKubernetes
+ This field is immutable after installation.
+ type: string
+ serviceNetwork:
+ description: |-
+ IP address pool for services.
+ Currently, we only support a single entry here.
+ This field is immutable after installation.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceNodePortRange:
+ description: |-
+ The port range allowed for Services of type NodePort.
+ If not specified, the default of 30000-32767 will be used.
+ Such Services without a NodePort specified will have one
+ automatically allocated from this range.
+ This parameter can be updated after the cluster is
+ installed.
+ pattern: ^([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])-([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot set networkDiagnostics.sourcePlacement and networkDiagnostics.targetPlacement
+ when networkDiagnostics.mode is Disabled
+ rule: '!has(self.networkDiagnostics) || !has(self.networkDiagnostics.mode)
+ || self.networkDiagnostics.mode!=''Disabled'' || !has(self.networkDiagnostics.sourcePlacement)
+ && !has(self.networkDiagnostics.targetPlacement)'
+ oauth:
+ description: |-
+ oauth holds cluster-wide information about OAuth.
+ It is used to configure the integrated OAuth server.
+ This configuration is only honored when the top level Authentication config has type set to IntegratedOAuth.
+ properties:
+ identityProviders:
+ description: |-
+ identityProviders is an ordered list of ways for a user to identify themselves.
+ When this list is empty, no identities are provisioned for users.
+ items:
+ description: IdentityProvider provides identities for users
+ authenticating using credentials
+ properties:
+ basicAuth:
+ description: basicAuth contains configuration options
+ for the BasicAuth IdP
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ github:
+ description: github enables user authentication using
+ GitHub credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ This can only be configured when hostname is set to a non-empty value.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostname:
+ description: |-
+ hostname is the optional domain (e.g. "mycompany.com") for use with a hosted instance of
+ GitHub Enterprise.
+ It must match the GitHub Enterprise settings value configured at /setup/settings#hostname.
+ type: string
+ organizations:
+ description: organizations optionally restricts
+ which organizations are allowed to log in
+ items:
+ type: string
+ type: array
+ teams:
+ description: teams optionally restricts which teams
+ are allowed to log in. Format is /.
+ items:
+ type: string
+ type: array
+ type: object
+ gitlab:
+ description: gitlab enables user authentication using
+ GitLab credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the oauth server base URL
+ type: string
+ type: object
+ google:
+ description: google enables user authentication using
+ Google credentials
+ properties:
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostedDomain:
+ description: hostedDomain is the optional Google
+ App domain (e.g. "mycompany.com") to restrict
+ logins to
+ type: string
+ type: object
+ htpasswd:
+ description: htpasswd enables user authentication using
+ an HTPasswd file to validate credentials
+ properties:
+ fileData:
+ description: |-
+ fileData is a required reference to a secret by name containing the data to use as the htpasswd file.
+ The key "htpasswd" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ If the specified htpasswd data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ keystone:
+ description: keystone enables user authentication using
+ keystone password credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ domainName:
+ description: domainName is required for keystone
+ v3
+ type: string
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ ldap:
+ description: ldap enables user authentication using
+ LDAP credentials
+ properties:
+ attributes:
+ description: attributes maps LDAP attributes to
+ identities
+ properties:
+ email:
+ description: |-
+ email is the list of attributes whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ id:
+ description: |-
+ id is the list of attributes whose values should be used as the user ID. Required.
+ First non-empty attribute is used. At least one attribute is required. If none of the listed
+ attribute have a value, authentication fails.
+ LDAP standard identity attribute is "dn"
+ items:
+ type: string
+ type: array
+ name:
+ description: |-
+ name is the list of attributes whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ LDAP standard display name attribute is "cn"
+ items:
+ type: string
+ type: array
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of attributes whose values should be used as the preferred username.
+ LDAP standard login attribute is "uid"
+ items:
+ type: string
+ type: array
+ type: object
+ bindDN:
+ description: bindDN is an optional DN to bind with
+ during the search phase.
+ type: string
+ bindPassword:
+ description: |-
+ bindPassword is an optional reference to a secret by name
+ containing a password to bind with during the search phase.
+ The key "bindPassword" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ insecure:
+ description: |-
+ insecure, if true, indicates the connection should not use TLS
+ WARNING: Should not be set to `true` with the URL scheme "ldaps://" as "ldaps://" URLs always
+ attempt to connect using TLS, even when `insecure` is set to `true`
+ When `true`, "ldap://" URLS connect insecurely. When `false`, "ldap://" URLs are upgraded to
+ a TLS connection using StartTLS as specified in https://tools.ietf.org/html/rfc2830.
+ type: boolean
+ url:
+ description: |-
+ url is an RFC 2255 URL which specifies the LDAP search parameters to use.
+ The syntax of the URL is:
+ ldap://host:port/basedn?attribute?scope?filter
+ type: string
+ type: object
+ mappingMethod:
+ description: |-
+ mappingMethod determines how identities from this provider are mapped to users
+ Defaults to "claim"
+ type: string
+ name:
+ description: |-
+ name is used to qualify the identities returned by this provider.
+ - It MUST be unique and not shared by any other identity provider used
+ - It MUST be a valid path segment: name cannot equal "." or ".." or contain "/" or "%" or ":"
+ Ref: https://godoc.org/github.com/openshift/origin/pkg/user/apis/user/validation#ValidateIdentityProviderName
+ type: string
+ openID:
+ description: openID enables user authentication using
+ OpenID credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ claims:
+ description: claims mappings
+ properties:
+ email:
+ description: |-
+ email is the list of claims whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ groups:
+ description: |-
+ groups is the list of claims value of which should be used to synchronize groups
+ from the OIDC provider to OpenShift for the user.
+ If multiple claims are specified, the first one with a non-empty value is used.
+ items:
+ description: |-
+ OpenIDClaim represents a claim retrieved from an OpenID provider's tokens or userInfo
+ responses
+ minLength: 1
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: |-
+ name is the list of claims whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of claims whose values should be used as the preferred username.
+ If unspecified, the preferred username is determined from the value of the sub claim
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ extraAuthorizeParameters:
+ additionalProperties:
+ type: string
+ description: extraAuthorizeParameters are any custom
+ parameters to add to the authorize request.
+ type: object
+ extraScopes:
+ description: extraScopes are any scopes to request
+ in addition to the standard "openid" scope.
+ items:
+ type: string
+ type: array
+ issuer:
+ description: |-
+ issuer is the URL that the OpenID Provider asserts as its Issuer Identifier.
+ It must use the https scheme with no query or fragment component.
+ type: string
+ type: object
+ requestHeader:
+ description: requestHeader enables user authentication
+ using request header credentials
+ properties:
+ ca:
+ description: |-
+ ca is a required reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ Specifically, it allows verification of incoming requests to prevent header spoofing.
+ The key "ca.crt" is used to locate the data.
+ If the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ challengeURL:
+ description: |-
+ challengeURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect WWW-Authenticate challenges will be
+ redirected here.
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when challenge is set to true.
+ type: string
+ clientCommonNames:
+ description: |-
+ clientCommonNames is an optional list of common names to require a match from. If empty, any
+ client certificate validated against the clientCA bundle is considered authoritative.
+ items:
+ type: string
+ type: array
+ emailHeaders:
+ description: emailHeaders is the set of headers
+ to check for the email address
+ items:
+ type: string
+ type: array
+ headers:
+ description: headers is the set of headers to check
+ for identity information
+ items:
+ type: string
+ type: array
+ loginURL:
+ description: |-
+ loginURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect interactive logins will be redirected here
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when login is set to true.
+ type: string
+ nameHeaders:
+ description: nameHeaders is the set of headers to
+ check for the display name
+ items:
+ type: string
+ type: array
+ preferredUsernameHeaders:
+ description: preferredUsernameHeaders is the set
+ of headers to check for the preferred username
+ items:
+ type: string
+ type: array
+ type: object
+ type:
+ description: type identifies the identity provider type
+ for this entry.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ templates:
+ description: templates allow you to customize pages like the
+ login page.
+ properties:
+ error:
+ description: |-
+ error is the name of a secret that specifies a go template to use to render error pages
+ during the authentication or grant flow.
+ The key "errors.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default error page is used.
+ If the specified template is not valid, the default error page is used.
+ If unspecified, the default error page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ login:
+ description: |-
+ login is the name of a secret that specifies a go template to use to render the login page.
+ The key "login.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default login page is used.
+ If the specified template is not valid, the default login page is used.
+ If unspecified, the default login page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ providerSelection:
+ description: |-
+ providerSelection is the name of a secret that specifies a go template to use to render
+ the provider selection page.
+ The key "providers.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default provider selection page is used.
+ If the specified template is not valid, the default provider selection page is used.
+ If unspecified, the default provider selection page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ tokenConfig:
+ description: tokenConfig contains options for authorization
+ and access tokens
+ properties:
+ accessTokenInactivityTimeout:
+ description: |-
+ accessTokenInactivityTimeout defines the token inactivity timeout
+ for tokens granted by any client.
+ The value represents the maximum amount of time that can occur between
+ consecutive uses of the token. Tokens become invalid if they are not
+ used within this temporal window. The user will need to acquire a new
+ token to regain access once a token times out. Takes valid time
+ duration string such as "5m", "1.5h" or "2h45m". The minimum allowed
+ value for duration is 300s (5 minutes). If the timeout is configured
+ per client, then that value takes precedence. If the timeout value is
+ not specified and the client does not override the value, then tokens
+ are valid until their lifetime.
+
+ WARNING: existing tokens' timeout will not be affected (lowered) by changing this value
+ type: string
+ accessTokenInactivityTimeoutSeconds:
+ description: 'accessTokenInactivityTimeoutSeconds - DEPRECATED:
+ setting this field has no effect.'
+ format: int32
+ type: integer
+ accessTokenMaxAgeSeconds:
+ description: accessTokenMaxAgeSeconds defines the maximum
+ age of access tokens
+ format: int32
+ type: integer
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: spec.configuration.oauth.tokenConfig.accessTokenInactivityTimeout
+ minimum acceptable token timeout value is 300 seconds
+ rule: '!has(self.tokenConfig) || !has(self.tokenConfig.accessTokenInactivityTimeout)
+ || duration(self.tokenConfig.accessTokenInactivityTimeout).getSeconds()
+ >= 300'
+ operatorhub:
+ description: |-
+ operatorhub specifies the configuration for the Operator Lifecycle Manager in the HostedCluster. This is only configured at deployment time but the controller are not reconcilling over it.
+ The OperatorHub configuration will be constantly reconciled if catalog placement is management, but only on cluster creation otherwise.
+ properties:
+ disableAllDefaultSources:
+ description: |-
+ disableAllDefaultSources allows you to disable all the default hub
+ sources. If this is true, a specific entry in sources can be used to
+ enable a default source. If this is false, a specific entry in
+ sources can be used to disable or enable a default source.
+ type: boolean
+ sources:
+ description: |-
+ sources is the list of default hub sources and their configuration.
+ If the list is empty, it implies that the default hub sources are
+ enabled on the cluster unless disableAllDefaultSources is true.
+ If disableAllDefaultSources is true and sources is not empty,
+ the configuration present in sources will take precedence. The list of
+ default hub sources and their current state will always be reflected in
+ the status block.
+ items:
+ description: HubSource is used to specify the hub source
+ and its configuration
+ properties:
+ disabled:
+ description: disabled is used to disable a default hub
+ source on cluster
+ type: boolean
+ name:
+ description: name is the name of one of the default
+ hub sources
+ maxLength: 253
+ minLength: 1
+ type: string
+ type: object
+ type: array
+ type: object
+ proxy:
+ description: |-
+ proxy holds cluster-wide information on how to configure default proxies for the cluster.
+ This affects traffic flowing from the hosted cluster data plane.
+ The controllers will generate a machineConfig with the proxy config for the cluster.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ httpProxy:
+ description: httpProxy is the URL of the proxy for HTTP requests. Empty
+ means unset and will not result in an env var.
+ type: string
+ httpsProxy:
+ description: httpsProxy is the URL of the proxy for HTTPS
+ requests. Empty means unset and will not result in an env
+ var.
+ type: string
+ noProxy:
+ description: |-
+ noProxy is a comma-separated list of hostnames and/or CIDRs and/or IPs for which the proxy should not be used.
+ Empty means unset and will not result in an env var.
+ type: string
+ readinessEndpoints:
+ description: readinessEndpoints is a list of endpoints used
+ to verify readiness of the proxy.
+ items:
+ type: string
+ type: array
+ trustedCA:
+ description: |-
+ trustedCA is a reference to a ConfigMap containing a CA certificate bundle.
+ The trustedCA field should only be consumed by a proxy validator. The
+ validator is responsible for reading the certificate bundle from the required
+ key "ca-bundle.crt", merging it with the system default trust bundle,
+ and writing the merged trust bundle to a ConfigMap named "trusted-ca-bundle"
+ in the "openshift-config-managed" namespace. Clients that expect to make
+ proxy connections must use the trusted-ca-bundle for all HTTPS requests to
+ the proxy, and may use the trusted-ca-bundle for non-proxy HTTPS requests as
+ well.
+
+ The namespace for the ConfigMap referenced by trustedCA is
+ "openshift-config". Here is an example ConfigMap (in yaml):
+
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: user-ca-bundle
+ namespace: openshift-config
+ data:
+ ca-bundle.crt: |
+ -----BEGIN CERTIFICATE-----
+ Custom CA certificate bundle.
+ -----END CERTIFICATE-----
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ scheduler:
+ description: |-
+ scheduler holds cluster-wide config information to run the Kubernetes Scheduler
+ and influence its placement decisions. The canonical name for this config is `cluster`.
+ properties:
+ defaultNodeSelector:
+ description: |-
+ defaultNodeSelector helps set the cluster-wide default node selector to
+ restrict pod placement to specific nodes. This is applied to the pods
+ created in all namespaces and creates an intersection with any existing
+ nodeSelectors already set on a pod, additionally constraining that pod's selector.
+ For example,
+ defaultNodeSelector: "type=user-node,region=east" would set nodeSelector
+ field in pod spec to "type=user-node,region=east" to all pods created
+ in all namespaces. Namespaces having project-wide node selectors won't be
+ impacted even if this field is set. This adds an annotation section to
+ the namespace.
+ For example, if a new namespace is created with
+ node-selector='type=user-node,region=east',
+ the annotation openshift.io/node-selector: type=user-node,region=east
+ gets added to the project. When the openshift.io/node-selector annotation
+ is set on the project the value is used in preference to the value we are setting
+ for defaultNodeSelector field.
+ For instance,
+ openshift.io/node-selector: "type=user-node,region=west" means
+ that the default of "type=user-node,region=east" set in defaultNodeSelector
+ would not be applied.
+ type: string
+ mastersSchedulable:
+ description: |-
+ mastersSchedulable allows masters nodes to be schedulable. When this flag is
+ turned on, all the master nodes in the cluster will be made schedulable,
+ so that workload pods can run on them. The default value for this field is false,
+ meaning none of the master nodes are schedulable.
+ Important Note: Once the workload pods start running on the master nodes,
+ extreme care must be taken to ensure that cluster-critical control plane components
+ are not impacted.
+ Please turn on this field after doing due diligence.
+ type: boolean
+ policy:
+ description: |-
+ DEPRECATED: the scheduler Policy API has been deprecated and will be removed in a future release.
+ policy is a reference to a ConfigMap containing scheduler policy which has
+ user specified predicates and priorities. If this ConfigMap is not available
+ scheduler will default to use DefaultAlgorithmProvider.
+ The namespace for this configmap is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ profile:
+ description: |-
+ profile sets which scheduling profile should be set in order to configure scheduling
+ decisions for new pods.
+
+ Valid values are "LowNodeUtilization", "HighNodeUtilization", "NoScoring"
+ Defaults to "LowNodeUtilization"
+ enum:
+ - ""
+ - LowNodeUtilization
+ - HighNodeUtilization
+ - NoScoring
+ type: string
+ profileCustomizations:
+ description: profileCustomizations contains configuration
+ for modifying the default behavior of existing scheduler
+ profiles.
+ properties:
+ dynamicResourceAllocation:
+ description: |-
+ dynamicResourceAllocation allows to enable or disable dynamic resource allocation within the scheduler.
+ Dynamic resource allocation is an API for requesting and sharing resources between pods and containers inside a pod.
+ Third-party resource drivers are responsible for tracking and allocating resources.
+ Different kinds of resources support arbitrary parameters for defining requirements and initialization.
+ Valid values are Enabled, Disabled and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default,
+ which is subject to change over time.
+ The current default is Disabled.
+ enum:
+ - ""
+ - Enabled
+ - Disabled
+ type: string
+ type: object
+ type: object
+ type: object
+ controlPlaneRelease:
+ description: |-
+ controlPlaneRelease is like spec.release but only for the components running on the management cluster.
+ This excludes any operand which will land in the hosted cluster data plane.
+ It is useful when you need to apply patch management side like a CVE, transparently for the hosted cluster.
+ Version input for this field is free, no validation is performed against spec.release or maximum and minimum is performed.
+ If defined, it will dicate the version of the components running management side, while spec.release will dictate the version of the components landing in the hosted cluster data plane.
+ If not defined, spec.release is used for both.
+ Changing this field will trigger a rollout of the control plane.
+ The behavior of the rollout will be driven by the ControllerAvailabilityPolicy and InfrastructureAvailabilityPolicy for PDBs and maxUnavailable and surce policies.
+ properties:
+ image:
+ description: |-
+ image is the image pullspec of an OCP release payload image.
+ See https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags for a list of available images.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: Image must start with a word character (letters, digits,
+ or underscores) and contain no white spaces
+ rule: self.matches('^(\\w+\\S+)$')
+ required:
+ - image
+ type: object
+ controllerAvailabilityPolicy:
+ default: HighlyAvailable
+ description: |-
+ controllerAvailabilityPolicy specifies the availability policy applied to critical control plane components like the Kube API Server.
+ Possible values are HighlyAvailable and SingleReplica. The default value is HighlyAvailable.
+ This field is immutable.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ x-kubernetes-validations:
+ - message: ControllerAvailabilityPolicy is immutable
+ rule: self == oldSelf
+ dns:
+ description: dns specifies the DNS configuration for the hosted cluster
+ ingress.
+ properties:
+ baseDomain:
+ description: |-
+ baseDomain is the base domain of the hosted cluster.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Once set, this field is immutable.
+ When the value is the empty string "", the controller might default to a value depending on the platform.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomain must be a valid domain name (e.g., example,
+ example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomain is immutable
+ rule: oldSelf == "" || self == oldSelf
+ baseDomainPrefix:
+ description: |-
+ baseDomainPrefix is the base domain prefix for the hosted cluster ingress.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Set baseDomainPrefix to an empty string "", if you don't want a prefix at all (not even hostedCluster.name) to be prepended to baseDomain.
+ This field is immutable.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomainPrefix must be a valid domain name (e.g.,
+ example, example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomainPrefix is immutable
+ rule: self == oldSelf
+ privateZoneID:
+ description: |-
+ privateZoneID is the Hosted Zone ID where all the DNS records that are only available internally to the cluster exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: privateZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ publicZoneID:
+ description: |-
+ publicZoneID is the Hosted Zone ID where all the DNS records that are publicly accessible to the internet exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: publicZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ required:
+ - baseDomain
+ type: object
+ etcd:
+ default:
+ managed:
+ storage:
+ persistentVolume:
+ size: 8Gi
+ type: PersistentVolume
+ managementType: Managed
+ description: |-
+ etcd specifies configuration for the control plane etcd cluster. The
+ default managementType is Managed. Once set, the managementType cannot be
+ changed.
+ properties:
+ managed:
+ description: managed specifies the behavior of an etcd cluster
+ managed by HyperShift.
+ properties:
+ storage:
+ description: storage specifies how etcd data is persisted.
+ properties:
+ persistentVolume:
+ description: |-
+ persistentVolume is the configuration for PersistentVolume etcd storage.
+ With this implementation, a PersistentVolume will be allocated for every
+ etcd member (either 1 or 3 depending on the HostedCluster control plane
+ availability configuration).
+ properties:
+ size:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 8Gi
+ description: |-
+ size is the minimum size of the data volume for each etcd member.
+ Default is 8Gi.
+ This field is immutable
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ x-kubernetes-validations:
+ - message: Etcd PV storage size is immutable
+ rule: self == oldSelf
+ storageClassName:
+ description: |-
+ storageClassName is the StorageClass of the data volume for each etcd member.
+ See https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: storageClassName is immutable
+ rule: self == oldSelf
+ type: object
+ restoreSnapshotURL:
+ description: |-
+ restoreSnapshotURL allows an optional URL to be provided where
+ an etcd snapshot can be downloaded, for example a pre-signed URL
+ referencing a storage service.
+ This snapshot will be restored on initial startup, only when the etcd PV
+ is empty.
+ items:
+ maxLength: 1024
+ type: string
+ maxItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: RestoreSnapshotURL shouldn't contain more than
+ 1 entry
+ rule: self.size() <= 1
+ type:
+ description: |-
+ type is the kind of persistent storage implementation to use for etcd.
+ Only PersistentVolume is supported at the moment.
+ enum:
+ - PersistentVolume
+ type: string
+ required:
+ - type
+ type: object
+ required:
+ - storage
+ type: object
+ managementType:
+ description: |-
+ managementType defines how the etcd cluster is managed.
+ This can be either Managed or Unmanaged.
+ This field is immutable.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ x-kubernetes-validations:
+ - message: managementType is immutable
+ rule: self == oldSelf
+ unmanaged:
+ description: |-
+ unmanaged specifies configuration which enables the control plane to
+ integrate with an externally managed etcd cluster.
+ properties:
+ endpoint:
+ description: |-
+ endpoint is the full etcd cluster client endpoint URL. For example:
+
+ https://etcd-client:2379
+
+ If the URL uses an HTTPS scheme, the TLS field is required.
+ maxLength: 255
+ pattern: ^https://
+ type: string
+ tls:
+ description: tls specifies TLS configuration for HTTPS etcd
+ client endpoints.
+ properties:
+ clientSecret:
+ description: |-
+ clientSecret refers to a secret for client mTLS authentication with the etcd cluster. It
+ may have the following key/value pairs:
+
+ etcd-client-ca.crt: Certificate Authority value
+ etcd-client.crt: Client certificate value
+ etcd-client.key: Client certificate key value
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - clientSecret
+ type: object
+ required:
+ - endpoint
+ - tls
+ type: object
+ required:
+ - managementType
+ type: object
+ x-kubernetes-validations:
+ - message: Only managed configuration must be set when managementType
+ is Managed
+ rule: 'self.managementType == ''Managed'' ? has(self.managed) :
+ !has(self.managed)'
+ - message: Only unmanaged configuration must be set when managementType
+ is Unmanaged
+ rule: 'self.managementType == ''Unmanaged'' ? has(self.unmanaged)
+ : !has(self.unmanaged)'
+ fips:
+ description: |-
+ fips indicates whether this cluster's nodes will be running in FIPS mode.
+ If set to true, the control plane's ignition server will be configured to
+ expect that nodes joining the cluster will be FIPS-enabled.
+ type: boolean
+ x-kubernetes-validations:
+ - message: fips is immutable
+ rule: self == oldSelf
+ imageContentSources:
+ description: |-
+ imageContentSources specifies image mirrors that can be used by cluster
+ nodes to pull content.
+ When imageContentSources is set, the controllers will generate a machineConfig.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ items:
+ description: |-
+ ImageContentSource specifies image mirrors that can be used by cluster nodes
+ to pull content. For cluster workloads, if a container image registry host of
+ the pullspec matches Source then one of the Mirrors are substituted as hosts
+ in the pullspec and tried in order to fetch the image.
+ properties:
+ mirrors:
+ description: mirrors are one or more repositories that may also
+ contain the same images.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 255
+ type: array
+ x-kubernetes-list-type: set
+ source:
+ description: |-
+ source is the repository that users refer to, e.g. in image pull
+ specifications.
+ maxLength: 255
+ type: string
+ required:
+ - source
+ type: object
+ maxItems: 255
+ type: array
+ infraID:
+ description: |-
+ infraID is a globally unique identifier for the cluster.
+ It must consist of lowercase alphanumeric characters and hyphens ('-') only, and start and end with an alphanumeric character.
+ It must be no more than 253 characters in length.
+ This identifier will be used to associate various cloud resources with the HostedCluster and its associated NodePools.
+ infraID is used to compute and tag created resources with "kubernetes.io/cluster/"+hcluster.Spec.InfraID which has contractual meaning for the cloud provider implementations.
+ If a value is not specified, a random infraID will be generated and set by the controller.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: infraID must consist of lowercase alphanumeric characters
+ or '-', start and end with an alphanumeric character, and be between
+ 1 and 253 characters
+ rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?$')
+ - message: infraID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ infrastructureAvailabilityPolicy:
+ default: SingleReplica
+ description: |-
+ infrastructureAvailabilityPolicy specifies the availability policy applied to infrastructure services which run on the hosted cluster data plane like the ingress controller and image registry controller.
+ Possible values are HighlyAvailable and SingleReplica. The default value is SingleReplica.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ issuerURL:
+ default: https://kubernetes.default.svc
+ description: |-
+ issuerURL is an OIDC issuer URL which will be used as the issuer in all
+ ServiceAccount tokens generated by the control plane API server via --service-account-issuer kube api server flag.
+ https://k8s-docs.netlify.app/en/docs/reference/command-line-tools-reference/kube-apiserver/
+ https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection
+ The default value is kubernetes.default.svc, which only works for in-cluster
+ validation.
+ If the platform is AWS and this value is set, the controller will update an s3 object with the appropriate OIDC documents (using the serviceAccountSigningKey info) into that issuerURL.
+ The expectation is for this s3 url to be backed by an OIDC provider in the AWS IAM.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: issuerURL is immutable
+ rule: self == oldSelf
+ - message: issuerURL must be a valid absolute URL
+ rule: isURL(self)
+ kubeAPIServerDNSName:
+ description: |-
+ kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
+ When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
+ If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
+ The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
+ This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
+ access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
+ for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
+ This API endpoint only works in OCP version 4.19 or later. Older versions will result in a no-op.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ labels:
+ additionalProperties:
+ type: string
+ description: |-
+ labels when specified, define what custom labels are added to the hcp pods.
+ Changing this day 2 will cause a rollout of all hcp pods.
+ Duplicate keys are not supported. If duplicate keys are defined, only the last key/value pair is preserved.
+ Valid values are those in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
+
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(key) <= 317 && key.matches('^(([A-Za-z0-9]+(\\.[A-Za-z0-9]+)?)*[A-Za-z0-9]\\/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$'))`, message="label key must have two segments: an optional prefix and name, separated by a slash (/). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (_), dots (.), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (.), not longer than 253 characters in total, followed by a slash (/)"
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(self[key]) <= 63 && self[key].matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$'))`, message="label value must be 63 characters or less (can be empty), consist of alphanumeric characters, dashes (-), underscores (_) or dots (.), and begin and end with an alphanumeric character"
+ maxProperties: 20
+ type: object
+ networking:
+ default:
+ clusterNetwork:
+ - cidr: 10.132.0.0/14
+ networkType: OVNKubernetes
+ serviceNetwork:
+ - cidr: 172.31.0.0/16
+ description: |-
+ networking specifies network configuration for the hosted cluster.
+ Defaults to OVNKubernetes with a cluster network of cidr: "10.132.0.0/14" and a service network of cidr: "172.31.0.0/16".
+ properties:
+ apiServer:
+ description: |-
+ apiServer contains advanced network settings for the API server that affect
+ how the APIServer is exposed inside a hosted cluster node.
+ properties:
+ advertiseAddress:
+ description: |-
+ advertiseAddress is the address that pods within the nodes will use to talk to the API
+ server. This is an address associated with the loopback adapter of each
+ node. If not specified, the controller will take default values.
+ The default values will be set as 172.20.0.1 or fd00::1.
+ This value is immutable.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: advertiseAddress is immutable
+ rule: self == oldSelf
+ allowedCIDRBlocks:
+ description: |-
+ allowedCIDRBlocks is an allow list of CIDR blocks that can access the APIServer.
+ If not specified, traffic is allowed from all addresses.
+ This field is enforced for ARO (Azure Red Hat OpenShift) via the shared-ingress HAProxy.
+ For platforms other than ARO, the enforcement depends on whether the underlying cloud provider supports the Service LoadBalancerSourceRanges field.
+ If the platform does not support LoadBalancerSourceRanges, this field may have no effect.
+ items:
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ maxItems: 500
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the port at which the APIServer is exposed inside a node. Other
+ pods using host networking cannot listen on this port.
+ If omitted 6443 is used.
+ This is useful to choose a port other than the default one which might interfere with customer environments e.g. https://github.com/openshift/hypershift/pull/356.
+ Setting this to 443 is possible only for backward compatibility reasons and it's discouraged.
+ Doing so, it would result in the controller overriding the KAS endpoint in the guest cluster having a discrepancy with the KAS Pod and potentially causing temporarily network failures.
+ This value is immutable.
+ format: int32
+ type: integer
+ x-kubernetes-validations:
+ - message: port is immutable
+ rule: self == oldSelf
+ type: object
+ clusterNetwork:
+ default:
+ - cidr: 10.132.0.0/14
+ description: |-
+ clusterNetwork is the list of IP address pools for pods.
+ Defaults to cidr: "10.132.0.0/14".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: |-
+ ClusterNetworkEntry is a single IP address block for pod IP blocks. IP blocks
+ are allocated with size 2^HostSubnetLength.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ hostPrefix:
+ description: |-
+ hostPrefix is the prefix size to allocate to each node from the CIDR.
+ For example, 24 would allocate 2^(32-24)=2^8=256 addresses to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ type: integer
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: clusterNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ machineNetwork:
+ description: |-
+ machineNetwork is the list of IP address pools for machines.
+ This might be used among other things to generate appropriate networking security groups in some clouds providers.
+ Currently only one entry or two for dual stack is supported.
+ This field is immutable.
+ items:
+ description: MachineNetworkEntry is a single IP address block
+ for node IP blocks.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for machines
+ within the cluster.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: machineNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ networkType:
+ default: OVNKubernetes
+ description: |-
+ networkType specifies the SDN provider used for cluster networking.
+ Defaults to OVNKubernetes.
+ This field is required and immutable.
+ kubebuilder:validation:XValidation:rule="self == oldSelf", message="networkType is immutable"
+ enum:
+ - OpenShiftSDN
+ - Calico
+ - OVNKubernetes
+ - Other
+ type: string
+ serviceNetwork:
+ default:
+ - cidr: 172.31.0.0/16
+ description: |-
+ serviceNetwork is the list of IP address pools for services.
+ Defaults to cidr: "172.31.0.0/16".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: ServiceNetworkEntry is a single IP address block
+ for the service network.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for services
+ within the cluster in CIDR format (e.g., 192.168.1.0/24
+ or 2001:0db8::/64)
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: serviceNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+ must be unique and non-overlapping
+ rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
+ c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
+ self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
+ self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
+ self.serviceNetwork.all(s, c.cidr != s.cidr)))))
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector when specified, is propagated to all control plane Deployments and Stateful sets running management side.
+ It must be satisfied by the management Nodes for the pods to be scheduled. Otherwise the HostedCluster will enter a degraded state.
+ Changes to this field will propagate to existing Deployments and StatefulSets.
+ type: object
+ x-kubernetes-validations:
+ - message: nodeSelector map can have at most 20 entries
+ rule: size(self) <= 20
+ olmCatalogPlacement:
+ default: management
+ description: |-
+ olmCatalogPlacement specifies the placement of OLM catalog components. By default,
+ this is set to management and OLM catalog components are deployed onto the management
+ cluster. If set to guest, the OLM catalog components will be deployed onto the guest
+ cluster.
+ enum:
+ - management
+ - guest
+ type: string
+ x-kubernetes-validations:
+ - message: OLMCatalogPlacement is immutable
+ rule: self == oldSelf
+ operatorConfiguration:
+ description: operatorConfiguration specifies configuration for individual
+ OCP operators in the cluster.
+ properties:
+ clusterNetworkOperator:
+ description: clusterNetworkOperator specifies the configuration
+ for the Cluster Network Operator in the hosted cluster.
+ properties:
+ disableMultiNetwork:
+ default: false
+ description: |-
+ disableMultiNetwork when set to true disables the Multus CNI plugin and related components
+ in the hosted cluster. This prevents the installation of multus daemon sets in the
+ guest cluster and the multus-admission-controller in the management cluster.
+ Default is false (Multus is enabled).
+ This field is immutable.
+ This field can only be set to true when NetworkType is "Other". Setting it to true
+ with any other NetworkType will result in a validation error during cluster creation.
+ type: boolean
+ x-kubernetes-validations:
+ - message: disableMultiNetwork is immutable
+ rule: self == oldSelf
+ ovnKubernetesConfig:
+ description: |-
+ ovnKubernetesConfig holds OVN-Kubernetes specific configuration.
+ This is only consumed when NetworkType is OVNKubernetes.
+ minProperties: 1
+ properties:
+ ipv4:
+ description: |-
+ ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
+ this means no opinions and the default configuration is used. Check individual
+ fields within ipv4 for details of default values.
+ minProperties: 1
+ properties:
+ internalJoinSubnet:
+ description: |-
+ internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the
+ default one is being already used by something else. It must not overlap with
+ any other subnet being used by OpenShift or by the node network. The size of the
+ subnet must be larger than the number of nodes.
+ The current default value is 100.64.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ (e.g., 192.168.1.1/24)
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ internalTransitSwitchSubnet:
+ description: |-
+ internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally
+ by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect
+ architecture that connects the cluster routers on each node together to enable
+ east west traffic. The subnet chosen should not overlap with other networks
+ specified for OVN-Kubernetes as well as other networks used on the host.
+ When omitted, this means no opinion and the platform is left to choose a reasonable
+ default which is subject to change over time.
+ The current default subnet is 100.88.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: internalJoinSubnet and internalTransitSwitchSubnet
+ must not be the same
+ rule: '!has(self.ipv4) || !has(self.ipv4.internalJoinSubnet)
+ || !has(self.ipv4.internalTransitSwitchSubnet) || self.ipv4.internalJoinSubnet
+ != self.ipv4.internalTransitSwitchSubnet'
+ type: object
+ clusterVersionOperator:
+ description: clusterVersionOperator specifies the configuration
+ for the Cluster Version Operator in the hosted cluster.
+ properties:
+ operatorLogLevel:
+ default: Normal
+ description: |-
+ operatorLogLevel is an intent based logging for the operator itself. It does not give fine-grained control,
+ but it is a simple way to manage coarse grained logging choices that operators have to interpret for themselves.
+
+ Valid values are: "Normal", "Debug", "Trace", "TraceAll".
+ Defaults to "Normal".
+ enum:
+ - ""
+ - Normal
+ - Debug
+ - Trace
+ - TraceAll
+ type: string
+ type: object
+ ingressOperator:
+ description: |-
+ ingressOperator specifies the configuration for the Ingress Operator in the hosted cluster.
+ This allows configuring how the default ingress controller endpoints are published.
+ properties:
+ endpointPublishingStrategy:
+ description: |-
+ endpointPublishingStrategy is used to publish the default ingress controller endpoints.
+
+ The endpoint publishing strategy is determined by the following precedence order:
+ 1. User-specified endpointPublishingStrategy (highest priority) - if this field is set,
+ it takes precedence over all other configuration methods
+ 2. Platform-specific defaults with annotation overrides - if no user strategy is set,
+ the platform type determines the default strategy, which can be further modified by:
+ - hypershift.openshift.io/private-ingress-controller annotation (sets PrivateStrategyType)
+ - hypershift.openshift.io/ingress-controller-load-balancer-scope annotation (sets LoadBalancerScope)
+ 3. Generic LoadBalancer fallback - if the platform is not recognized, defaults to
+ LoadBalancerService with External scope
+
+ Platform-specific defaults when endpointPublishingStrategy is not set:
+ - AWS: LoadBalancerService with External scope (or NLB if configured)
+ - Azure, GCP: LoadBalancerService with External scope
+ - IBMCloud: LoadBalancerService with External scope (or NodePort for UPI)
+ - None: HostNetwork
+ - KubeVirt: NodePortService
+ - OpenStack: LoadBalancerService with External scope and optional FloatingIP
+ - Other platforms: LoadBalancerService with External scope
+
+ See the OpenShift Ingress Operator EndpointPublishingStrategy type for the full specification:
+ https://github.com/openshift/api/blob/master/operator/v1/types_ingress.go
+ properties:
+ hostNetwork:
+ description: |-
+ hostNetwork holds parameters for the HostNetwork endpoint publishing
+ strategy. Present only if type is HostNetwork.
+ properties:
+ httpPort:
+ default: 80
+ description: |-
+ httpPort is the port on the host which should be used to listen for
+ HTTP requests. This field should be set when port 80 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 80.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ httpsPort:
+ default: 443
+ description: |-
+ httpsPort is the port on the host which should be used to listen for
+ HTTPS requests. This field should be set when port 443 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 443.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ statsPort:
+ default: 1936
+ description: |-
+ statsPort is the port on the host where the stats from the router are
+ published. The value should not coincide with the NodePort range of the
+ cluster. If an external load balancer is configured to forward connections
+ to this IngressController, the load balancer should use this port for
+ health checks. The load balancer can send HTTP probes on this port on a
+ given node, with the path /healthz/ready to determine if the ingress
+ controller is ready to receive traffic on the node. For proper operation
+ the load balancer must not forward traffic to a node until the health
+ check reports ready. The load balancer should also stop forwarding requests
+ within a maximum of 45 seconds after /healthz/ready starts reporting
+ not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with
+ a threshold of two successful or failed requests to become healthy or
+ unhealthy respectively, are well-tested values. When the value is 0 or
+ is not specified it defaults to 1936.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ type: object
+ loadBalancer:
+ description: |-
+ loadBalancer holds parameters for the load balancer. Present only if
+ type is LoadBalancerService.
+ properties:
+ allowedSourceRanges:
+ description: |-
+ allowedSourceRanges specifies an allowlist of IP address ranges to which
+ access to the load balancer should be restricted. Each range must be
+ specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is
+ specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default,
+ which allows all source addresses.
+
+ To facilitate migration from earlier versions of OpenShift that did
+ not have the allowedSourceRanges field, you may set the
+ service.beta.kubernetes.io/load-balancer-source-ranges annotation on
+ the "router-" service in the
+ "openshift-ingress" namespace, and this annotation will take
+ effect if allowedSourceRanges is empty on OpenShift 4.12.
+ items:
+ description: |-
+ CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8"
+ or "fd00::/8").
+ pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)
+ type: string
+ nullable: true
+ type: array
+ x-kubernetes-list-type: atomic
+ dnsManagementPolicy:
+ default: Managed
+ description: |-
+ dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record
+ associated with the load balancer service will be managed by
+ the ingress operator. It defaults to Managed.
+ Valid values are: Managed and Unmanaged.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ providerParameters:
+ description: |-
+ providerParameters holds desired load balancer information specific to
+ the underlying infrastructure provider.
+
+ If empty, defaults will be applied. See specific providerParameters
+ fields for details about their defaults.
+ properties:
+ aws:
+ description: |-
+ aws provides configuration settings that are specific to AWS
+ load balancers.
+
+ If empty, defaults will be applied. See specific aws fields for
+ details about their defaults.
+ properties:
+ classicLoadBalancer:
+ description: |-
+ classicLoadBalancerParameters holds configuration parameters for an AWS
+ classic load balancer. Present only if type is Classic.
+ properties:
+ connectionIdleTimeout:
+ description: |-
+ connectionIdleTimeout specifies the maximum time period that a
+ connection may be idle before the load balancer closes the
+ connection. The value must be parseable as a time duration value;
+ see . A nil or zero value
+ means no opinion, in which case a default value is used. The default
+ value for this field is 60s. This default is subject to change.
+ format: duration
+ type: string
+ type: object
+ networkLoadBalancer:
+ description: |-
+ networkLoadBalancerParameters holds configuration parameters for an AWS
+ network load balancer. Present only if type is NLB.
+ type: object
+ type:
+ description: |-
+ type is the type of AWS load balancer to instantiate for an ingresscontroller.
+
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - Classic
+ - NLB
+ type: string
+ required:
+ - type
+ type: object
+ gcp:
+ description: |-
+ gcp provides configuration settings that are specific to GCP
+ load balancers.
+
+ If empty, defaults will be applied. See specific gcp fields for
+ details about their defaults.
+ properties:
+ clientAccess:
+ description: |-
+ clientAccess describes how client access is restricted for internal
+ load balancers.
+
+ Valid values are:
+ * "Global": Specifying an internal load balancer with Global client access
+ allows clients from any region within the VPC to communicate with the load
+ balancer.
+
+ https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access
+
+ * "Local": Specifying an internal load balancer with Local client access
+ means only clients within the same region (and VPC) as the GCP load balancer
+ can communicate with the load balancer. Note that this is the default behavior.
+
+ https://cloud.google.com/load-balancing/docs/internal#client_access
+ enum:
+ - Global
+ - Local
+ type: string
+ type: object
+ ibm:
+ description: |-
+ ibm provides configuration settings that are specific to IBM Cloud
+ load balancers.
+
+ If empty, defaults will be applied. See specific ibm fields for
+ details about their defaults.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the load balancer uses PROXY protocol to forward connections to
+ the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features:
+ "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas"
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ Valid values for protocol are TCP, PROXY and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is TCP, without the proxy protocol enabled.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ openstack:
+ description: |-
+ openstack provides configuration settings that are specific to OpenStack
+ load balancers.
+
+ If empty, defaults will be applied. See specific openstack fields for
+ details about their defaults.
+ properties:
+ floatingIP:
+ description: |-
+ floatingIP specifies the IP address that the load balancer will use.
+ When not specified, an IP address will be assigned randomly by the OpenStack cloud provider.
+ When specified, the floating IP has to be pre-created. If the
+ specified value is not a floating IP or is already claimed, the
+ OpenStack cloud provider won't be able to provision the load
+ balancer.
+ This field may only be used if the IngressController has External scope.
+ This value must be a valid IPv4 or IPv6 address.
+ type: string
+ x-kubernetes-validations:
+ - message: floatingIP must be a valid IPv4
+ or IPv6 address
+ rule: isIP(self)
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the load balancer.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix",
+ "OpenStack", and "VSphere".
+ enum:
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Nutanix
+ - OpenStack
+ - VSphere
+ - IBM
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: openstack is not permitted when type is
+ not OpenStack
+ rule: 'has(self.type) && self.type == ''OpenStack''
+ ? true : !has(self.openstack)'
+ scope:
+ description: |-
+ scope indicates the scope at which the load balancer is exposed.
+ Possible values are "External" and "Internal".
+ enum:
+ - Internal
+ - External
+ type: string
+ required:
+ - dnsManagementPolicy
+ - scope
+ type: object
+ x-kubernetes-validations:
+ - message: cannot specify a floating ip when scope is
+ internal
+ rule: '!has(self.scope) || self.scope != ''Internal''
+ || !has(self.providerParameters) || !has(self.providerParameters.openstack)
+ || !has(self.providerParameters.openstack.floatingIP)
+ || self.providerParameters.openstack.floatingIP ==
+ ""'
+ nodePort:
+ description: |-
+ nodePort holds parameters for the NodePortService endpoint publishing strategy.
+ Present only if type is NodePortService.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ private:
+ description: |-
+ private holds parameters for the Private endpoint publishing
+ strategy. Present only if type is Private.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy to use. Valid values are:
+
+ * LoadBalancerService
+
+ Publishes the ingress controller using a Kubernetes LoadBalancer Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A LoadBalancer Service is created to publish the deployment.
+
+ See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
+
+ If domain is set, a wildcard DNS record will be managed to point at the
+ LoadBalancer Service's external name. DNS records are managed only in DNS
+ zones defined by dns.config.openshift.io/cluster .spec.publicZone and
+ .spec.privateZone.
+
+ Wildcard DNS management is currently supported only on the AWS, Azure,
+ and GCP platforms.
+
+ * HostNetwork
+
+ Publishes the ingress controller on node ports where the ingress controller
+ is deployed.
+
+ In this configuration, the ingress controller deployment uses host
+ networking, bound to node ports 80 and 443. The user is responsible for
+ configuring an external load balancer to publish the ingress controller via
+ the node ports.
+
+ * Private
+
+ Does not publish the ingress controller.
+
+ In this configuration, the ingress controller deployment uses container
+ networking, and is not explicitly published. The user must manually publish
+ the ingress controller.
+
+ * NodePortService
+
+ Publishes the ingress controller using a Kubernetes NodePort Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A NodePort Service is created to publish the deployment. The
+ specific node ports are dynamically allocated by OpenShift; however, to
+ support static port allocations, user changes to the node port
+ field of the managed NodePort Service will preserved.
+ enum:
+ - LoadBalancerService
+ - HostNetwork
+ - Private
+ - NodePortService
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-preserve-unknown-fields: true
+ type: object
+ type: object
+ pausedUntil:
+ description: |-
+ pausedUntil is a field that can be used to pause reconciliation on the HostedCluster controller, resulting in any change to the HostedCluster being ignored.
+ Either a date can be provided in RFC3339 format or a boolean as in 'true', 'false', 'True', 'False'. If a date is
+ provided: reconciliation is paused on the resource until that date. If the boolean true is
+ provided: reconciliation is paused on the resource until the field is removed.
+ maxLength: 35
+ minLength: 4
+ type: string
+ x-kubernetes-validations:
+ - message: PausedUntil must be a date in RFC3339 format or 'True',
+ 'true', 'False' or 'false'
+ rule: self.matches('^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}.*$')
+ || self in ['true', 'false', 'True', 'False']
+ platform:
+ description: |-
+ platform specifies the underlying infrastructure provider for the cluster
+ and is used to configure platform specific behavior.
+ properties:
+ agent:
+ description: agent specifies configuration for agent-based installations.
+ properties:
+ agentNamespace:
+ description: agentNamespace is the namespace where to search
+ for Agents for this cluster
+ maxLength: 63
+ type: string
+ required:
+ - agentNamespace
+ type: object
+ aws:
+ description: aws specifies configuration for clusters running
+ on Amazon Web Services.
+ properties:
+ additionalAllowedPrincipals:
+ description: |-
+ additionalAllowedPrincipals specifies a list of additional allowed principal ARNs
+ to be added to the hosted control plane's VPC Endpoint Service to enable additional
+ VPC Endpoint connection requests to be automatically accepted.
+ See https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html
+ for more details around VPC Endpoint Service allowed principals.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 25
+ type: array
+ cloudProviderConfig:
+ description: |-
+ cloudProviderConfig specifies AWS networking configuration for the control
+ plane.
+ This is mainly used for cloud provider controller config:
+ https://github.com/kubernetes/kubernetes/blob/f5be5052e3d0808abb904aebd3218fe4a5c2dd82/staging/src/k8s.io/legacy-cloud-providers/aws/aws.go#L1347-L1364
+ properties:
+ subnet:
+ description: subnet is the subnet to use for control plane
+ cloud resources.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify
+ an AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for
+ the filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: vpc is the VPC to use for control plane cloud
+ resources.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ maxLength: 255
+ type: string
+ required:
+ - vpc
+ type: object
+ endpointAccess:
+ default: Public
+ description: |-
+ endpointAccess specifies the publishing scope of cluster endpoints. The
+ default is Public.
+ enum:
+ - Public
+ - PublicAndPrivate
+ - Private
+ type: string
+ multiArch:
+ default: false
+ description: |-
+ multiArch specifies whether the Hosted Cluster will be expected to support NodePools with different
+ CPU architectures, i.e., supporting arm64 NodePools and supporting amd64 NodePools on the same Hosted Cluster.
+ Deprecated: This field is no longer used. The HyperShift Operator now performs multi-arch validations
+ automatically despite the platform type. The HyperShift Operator will set HostedCluster.Status.PayloadArch based
+ on the HostedCluster release image. This field is used by the NodePool controller to validate the
+ NodePool.Spec.Arch is supported.
+ type: boolean
+ region:
+ description: |-
+ region is the AWS region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot AMI for a given release.
+ maxLength: 255
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created
+ for the cluster. See
+ https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for
+ information on tagging AWS resources. AWS supports a maximum of 50 tags per
+ resource. OpenShift reserves 25 tags for its use, leaving 25 tags available
+ for the user.
+ Changes to this field will be propagated in-place to AWS resources (VPC Endpoints, EC2 instances, initial EBS volumes and default/endpoint security groups).
+ These tags will be propagated to the infrastructure CR in the guest cluster, where other OCP operators might choose to honor this input to reconcile AWS resources created by them.
+ Please consult the official documentation for a list of all AWS resources that support in-place tag updates.
+ These take precedence over tags defined out of band (i.e., tags added manually or by other tools outside of HyperShift) in AWS in case of conflicts.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ value:
+ description: |-
+ value is the value of the tag.
+
+ Some AWS service do not support empty values. Since tags are added to
+ resources in many services, the length of the tag value must meet the
+ requirements of all services.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ rolesRef:
+ description: |-
+ rolesRef contains references to various AWS IAM roles required to enable
+ integrations such as OIDC.
+ properties:
+ controlPlaneOperatorARN:
+ description: "controlPlaneOperatorARN is an ARN value
+ referencing a role appropriate for the Control Plane
+ Operator.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"arn:aws:route53:::%s\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ imageRegistryARN:
+ description: "imageRegistryARN is an ARN value referencing
+ a role appropriate for the Image Registry Operator.\n\nThe
+ following is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"s3:CreateBucket\",\n\t\t\t\t\"s3:DeleteBucket\",\n\t\t\t\t\"s3:PutBucketTagging\",\n\t\t\t\t\"s3:GetBucketTagging\",\n\t\t\t\t\"s3:PutBucketPublicAccessBlock\",\n\t\t\t\t\"s3:GetBucketPublicAccessBlock\",\n\t\t\t\t\"s3:PutEncryptionConfiguration\",\n\t\t\t\t\"s3:GetEncryptionConfiguration\",\n\t\t\t\t\"s3:PutLifecycleConfiguration\",\n\t\t\t\t\"s3:GetLifecycleConfiguration\",\n\t\t\t\t\"s3:GetBucketLocation\",\n\t\t\t\t\"s3:ListBucket\",\n\t\t\t\t\"s3:GetObject\",\n\t\t\t\t\"s3:PutObject\",\n\t\t\t\t\"s3:DeleteObject\",\n\t\t\t\t\"s3:ListBucketMultipartUploads\",\n\t\t\t\t\"s3:AbortMultipartUpload\",\n\t\t\t\t\"s3:ListMultipartUploadParts\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing a
+ role appropriate for the Ingress Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"elasticloadbalancing:DescribeLoadBalancers\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"route53:ListHostedZones\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ [\n\t\t\t\t\"arn:aws:route53:::PUBLIC_ZONE_ID\",\n\t\t\t\t\"arn:aws:route53:::PRIVATE_ZONE_ID\"\n\t\t\t]\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ kubeCloudControllerARN:
+ description: |-
+ kubeCloudControllerARN is an ARN value referencing a role appropriate for the KCM/KCC.
+ Source: https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies
+
+ The following is an example of a valid policy document:
+
+ {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Action": [
+ "autoscaling:DescribeAutoScalingGroups",
+ "autoscaling:DescribeLaunchConfigurations",
+ "autoscaling:DescribeTags",
+ "ec2:DescribeAvailabilityZones",
+ "ec2:DescribeInstances",
+ "ec2:DescribeImages",
+ "ec2:DescribeRegions",
+ "ec2:DescribeRouteTables",
+ "ec2:DescribeSecurityGroups",
+ "ec2:DescribeSubnets",
+ "ec2:DescribeVolumes",
+ "ec2:CreateSecurityGroup",
+ "ec2:CreateTags",
+ "ec2:CreateVolume",
+ "ec2:ModifyInstanceAttribute",
+ "ec2:ModifyVolume",
+ "ec2:AttachVolume",
+ "ec2:AuthorizeSecurityGroupIngress",
+ "ec2:CreateRoute",
+ "ec2:DeleteRoute",
+ "ec2:DeleteSecurityGroup",
+ "ec2:DeleteVolume",
+ "ec2:DetachVolume",
+ "ec2:RevokeSecurityGroupIngress",
+ "ec2:DescribeVpcs",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:AttachLoadBalancerToSubnets",
+ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancerPolicy",
+ "elasticloadbalancing:CreateLoadBalancerListeners",
+ "elasticloadbalancing:ConfigureHealthCheck",
+ "elasticloadbalancing:DeleteLoadBalancer",
+ "elasticloadbalancing:DeleteLoadBalancerListeners",
+ "elasticloadbalancing:DescribeLoadBalancers",
+ "elasticloadbalancing:DescribeLoadBalancerAttributes",
+ "elasticloadbalancing:DetachLoadBalancerFromSubnets",
+ "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
+ "elasticloadbalancing:ModifyLoadBalancerAttributes",
+ "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
+ "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:CreateListener",
+ "elasticloadbalancing:CreateTargetGroup",
+ "elasticloadbalancing:DeleteListener",
+ "elasticloadbalancing:DeleteTargetGroup",
+ "elasticloadbalancing:DeregisterTargets",
+ "elasticloadbalancing:DescribeListeners",
+ "elasticloadbalancing:DescribeLoadBalancerPolicies",
+ "elasticloadbalancing:DescribeTargetGroups",
+ "elasticloadbalancing:DescribeTargetHealth",
+ "elasticloadbalancing:ModifyListener",
+ "elasticloadbalancing:ModifyTargetGroup",
+ "elasticloadbalancing:RegisterTargets",
+ "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
+ "iam:CreateServiceLinkedRole",
+ "kms:DescribeKey"
+ ],
+ "Resource": [
+ "*"
+ ],
+ "Effect": "Allow"
+ }
+ ]
+ }
+ maxLength: 2048
+ type: string
+ networkARN:
+ description: "networkARN is an ARN value referencing a
+ role appropriate for the Network Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:DescribeInstances\",\n
+ \ \"ec2:DescribeInstanceStatus\",\n \"ec2:DescribeInstanceTypes\",\n
+ \ \"ec2:UnassignPrivateIpAddresses\",\n \"ec2:AssignPrivateIpAddresses\",\n
+ \ \"ec2:UnassignIpv6Addresses\",\n \"ec2:AssignIpv6Addresses\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeNetworkInterfaces\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ nodePoolManagementARN:
+ description: "nodePoolManagementARN is an ARN value referencing
+ a role appropriate for the CAPI Controller.\n\nThe following
+ is an example of a valid policy document:\n\n{\n \"Version\":
+ \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\":
+ [\n \"ec2:AssociateRouteTable\",\n \"ec2:AttachInternetGateway\",\n
+ \ \"ec2:AuthorizeSecurityGroupIngress\",\n \"ec2:CreateInternetGateway\",\n
+ \ \"ec2:CreateNatGateway\",\n \"ec2:CreateRoute\",\n
+ \ \"ec2:CreateRouteTable\",\n \"ec2:CreateSecurityGroup\",\n
+ \ \"ec2:CreateSubnet\",\n \"ec2:CreateTags\",\n
+ \ \"ec2:DeleteInternetGateway\",\n \"ec2:DeleteNatGateway\",\n
+ \ \"ec2:DeleteRouteTable\",\n \"ec2:DeleteSecurityGroup\",\n
+ \ \"ec2:DeleteSubnet\",\n \"ec2:DeleteTags\",\n
+ \ \"ec2:DescribeAccountAttributes\",\n \"ec2:DescribeAddresses\",\n
+ \ \"ec2:DescribeAvailabilityZones\",\n \"ec2:DescribeImages\",\n
+ \ \"ec2:DescribeInstances\",\n \"ec2:DescribeInternetGateways\",\n
+ \ \"ec2:DescribeNatGateways\",\n \"ec2:DescribeNetworkInterfaces\",\n
+ \ \"ec2:DescribeNetworkInterfaceAttribute\",\n
+ \ \"ec2:DescribeRouteTables\",\n \"ec2:DescribeSecurityGroups\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeVpcs\",\n
+ \ \"ec2:DescribeVpcAttribute\",\n \"ec2:DescribeVolumes\",\n
+ \ \"ec2:DetachInternetGateway\",\n \"ec2:DisassociateRouteTable\",\n
+ \ \"ec2:DisassociateAddress\",\n \"ec2:ModifyInstanceAttribute\",\n
+ \ \"ec2:ModifyNetworkInterfaceAttribute\",\n \"ec2:ModifySubnetAttribute\",\n
+ \ \"ec2:RevokeSecurityGroupIngress\",\n \"ec2:RunInstances\",\n
+ \ \"ec2:TerminateInstances\",\n \"tag:GetResources\",\n
+ \ \"ec2:CreateLaunchTemplate\",\n \"ec2:CreateLaunchTemplateVersion\",\n
+ \ \"ec2:DescribeLaunchTemplates\",\n \"ec2:DescribeLaunchTemplateVersions\",\n
+ \ \"ec2:DeleteLaunchTemplate\",\n \"ec2:DeleteLaunchTemplateVersions\"\n
+ \ ],\n \"Resource\": [\n \"*\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n {\n \"Condition\":
+ {\n \"StringLike\": {\n \"iam:AWSServiceName\":
+ \"elasticloadbalancing.amazonaws.com\"\n }\n },\n
+ \ \"Action\": [\n \"iam:CreateServiceLinkedRole\"\n
+ \ ],\n \"Resource\": [\n \"arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing\"\n
+ \ ],\n \"Effect\": \"Allow\"\n },\n {\n \"Action\":
+ [\n \"iam:PassRole\"\n ],\n \"Resource\":
+ [\n \"arn:*:iam::*:role/*-worker-role\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n\t {\n\t \t\"Effect\":
+ \"Allow\",\n\t \t\"Action\": [\n\t \t\t\"kms:Decrypt\",\n\t
+ \ \t\t\"kms:ReEncrypt\",\n\t \t\t\"kms:GenerateDataKeyWithoutPlainText\",\n\t
+ \ \t\t\"kms:DescribeKey\"\n\t \t],\n\t \t\"Resource\":
+ \"*\"\n\t },\n\t {\n\t \t\"Effect\": \"Allow\",\n\t
+ \ \t\"Action\": [\n\t \t\t\"kms:CreateGrant\"\n\t \t],\n\t
+ \ \t\"Resource\": \"*\",\n\t \t\"Condition\": {\n\t
+ \ \t\t\"Bool\": {\n\t \t\t\t\"kms:GrantIsForAWSResource\":
+ true\n\t \t\t}\n\t \t}\n\t }\n ]\n}"
+ maxLength: 2048
+ type: string
+ storageARN:
+ description: "storageARN is an ARN value referencing a
+ role appropriate for the Storage Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:AttachVolume\",\n\t\t\t\t\"ec2:CreateSnapshot\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"ec2:CreateVolume\",\n\t\t\t\t\"ec2:DeleteSnapshot\",\n\t\t\t\t\"ec2:DeleteTags\",\n\t\t\t\t\"ec2:DeleteVolume\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeSnapshots\",\n\t\t\t\t\"ec2:DescribeTags\",\n\t\t\t\t\"ec2:DescribeVolumes\",\n\t\t\t\t\"ec2:DescribeVolumesModifications\",\n\t\t\t\t\"ec2:DetachVolume\",\n\t\t\t\t\"ec2:ModifyVolume\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - controlPlaneOperatorARN
+ - imageRegistryARN
+ - ingressARN
+ - kubeCloudControllerARN
+ - networkARN
+ - nodePoolManagementARN
+ - storageARN
+ type: object
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints specifies optional custom endpoints which will override
+ the default service endpoint of specific AWS Services.
+
+ There must be only one ServiceEndpoint for a given service name.
+ items:
+ description: |-
+ AWSServiceEndpoint stores the configuration for services to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ This must be provided and cannot be empty.
+ maxLength: 255
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 50
+ type: array
+ sharedVPC:
+ description: |-
+ sharedVPC contains fields that must be specified if the HostedCluster must use a VPC that is
+ created in a different AWS account and is shared with the AWS account where the HostedCluster
+ will be created.
+ properties:
+ localZoneID:
+ description: |-
+ localZoneID is the ID of the route53 hosted zone for [cluster-name].hypershift.local that is
+ associated with the HostedCluster's VPC and exists in the VPC owner account.
+ maxLength: 32
+ type: string
+ rolesRef:
+ description: |-
+ rolesRef contains references to roles in the VPC owner account that enable a
+ HostedCluster on a shared VPC.
+ properties:
+ controlPlaneARN:
+ description: "controlPlaneARN is an ARN value referencing
+ the role in the VPC owner account that allows\nthe
+ control plane operator in the cluster account to
+ create and manage a VPC endpoint, its\ncorresponding
+ Security Group, and DNS records in the hypershift
+ local hosted zone.\n\nThe referenced role must have
+ a trust relationship that allows it to be assumed
+ by the\ncontrol plane operator role in the VPC creator
+ account.\nExample:\n{\n\t \"Version\": \"2012-10-17\",\n\t
+ \"Statement\": [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t
+ \t\t\"Effect\": \"Allow\",\n\t \t\t\"Principal\":
+ {\n\t \t\t\t\"AWS\": \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-control-plane-operator\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing
+ the role in the VPC owner account that allows the\ningress
+ operator in the cluster account to create and manage
+ records in the private DNS\nhosted zone.\n\nThe
+ referenced role must have a trust relationship that
+ allows it to be assumed by the\ningress operator
+ role in the VPC creator account.\nExample:\n{\n\t
+ \"Version\": \"2012-10-17\",\n\t \"Statement\":
+ [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t \t\t\"Effect\":
+ \"Allow\",\n\t \t\t\"Principal\": {\n\t \t\t\t\"AWS\":
+ \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-openshift-ingress\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n(Based on https://docs.openshift.com/rosa/rosa_install_access_delete_clusters/rosa-shared-vpc-config.html#rosa-sharing-vpc-dns-and-roles_rosa-shared-vpc-config)\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"route53:ListHostedZonesByName\",\n\t\t\t\t\"route53:ChangeTagsForResource\",\n\t\t\t\t\"route53:GetAccountLimit\",\n\t\t\t\t\"route53:GetChange\",\n\t\t\t\t\"route53:GetHostedZone\",\n\t\t\t\t\"route53:ListTagsForResource\",\n\t\t\t\t\"route53:UpdateHostedZoneComment\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"tag:UntagResources\"\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ required:
+ - controlPlaneARN
+ - ingressARN
+ type: object
+ required:
+ - localZoneID
+ - rolesRef
+ type: object
+ required:
+ - region
+ - rolesRef
+ type: object
+ azure:
+ description: azure defines azure specific settings
+ properties:
+ azureAuthenticationConfig:
+ description: |-
+ azureAuthenticationConfig is the type of Azure authentication configuration to use to authenticate with Azure's
+ Cloud API.
+ properties:
+ azureAuthenticationConfigType:
+ description: |-
+ azureAuthenticationConfigType is the type of identity configuration used in the Hosted Cluster. This field is
+ used to determine which identity configuration is being used. Valid values are "ManagedIdentities" and
+ "WorkloadIdentities".
+ enum:
+ - ManagedIdentities
+ - WorkloadIdentities
+ type: string
+ managedIdentities:
+ description: |-
+ managedIdentities contains the managed identities needed for HCP control plane and data plane components that
+ authenticate with Azure's API.
+
+ These are required for managed Azure, also known as ARO HCP.
+ properties:
+ controlPlane:
+ description: |-
+ controlPlane contains the client IDs of all the managed identities on the HCP control plane needing to
+ authenticate with Azure's API.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is a pre-existing managed identity associated with the azure cloud provider, aka cloud controller
+ manager.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ controlPlaneOperator:
+ description: controlPlaneOperator is a pre-existing
+ managed identity associated with the control
+ plane operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ disk:
+ description: disk is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ file:
+ description: file is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ imageRegistry:
+ description: imageRegistry is a pre-existing managed
+ identity associated with the cluster-image-registry-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ ingress:
+ description: ingress is a pre-existing managed
+ identity associated with the cluster-ingress-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ managedIdentitiesKeyVault:
+ description: |-
+ managedIdentitiesKeyVault contains information on the management cluster's managed identities Azure Key Vault.
+ This Key Vault is where the managed identities certificates are stored. These certificates are pulled out of the
+ Key Vault by the Secrets Store CSI driver and mounted into a volume on control plane pods requiring
+ authentication with Azure API.
+
+ More information on how the Secrets Store CSI driver works to do this can be found here:
+ https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver.
+ properties:
+ name:
+ description: name is the name of the Azure
+ Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ tenantID:
+ description: tenantID is the tenant ID of
+ the Azure Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - tenantID
+ type: object
+ network:
+ description: network is a pre-existing managed
+ identity associated with the cluster-network-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ nodePoolManagement:
+ description: nodePoolManagement is a pre-existing
+ managed identity associated with the operator
+ managing the NodePools.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - cloudProvider
+ - controlPlaneOperator
+ - disk
+ - file
+ - ingress
+ - managedIdentitiesKeyVault
+ - network
+ - nodePoolManagement
+ type: object
+ dataPlane:
+ description: |-
+ dataPlane contains the client IDs of all the managed identities on the data plane needing to authenticate with
+ Azure's API.
+ properties:
+ diskMSIClientID:
+ description: diskMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI Disk driver.
+ maxLength: 255
+ type: string
+ fileMSIClientID:
+ description: fileMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI File driver.
+ maxLength: 255
+ type: string
+ imageRegistryMSIClientID:
+ description: |-
+ imageRegistryMSIClientID is the client ID of a pre-existing managed identity ID associated with the image
+ registry controller.
+ maxLength: 255
+ type: string
+ required:
+ - diskMSIClientID
+ - fileMSIClientID
+ - imageRegistryMSIClientID
+ type: object
+ required:
+ - controlPlane
+ - dataPlane
+ type: object
+ workloadIdentities:
+ description: |-
+ workloadIdentities is a struct of client IDs for each component that needs to authenticate with Azure's API in
+ self-managed Azure. These client IDs are used to authenticate with Azure cloud on both the control plane and data
+ plane.
+
+ This is required for self-managed Azure.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is the client ID of a federated managed identity, associated with azure-cloud-provider, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ disk:
+ description: |-
+ disk is the client ID of a federated managed identity, associated with cluster-storage-operator-disk,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ file:
+ description: |-
+ file is the client ID of a federated managed identity, associated with cluster-storage-operator-file,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ imageRegistry:
+ description: |-
+ imageRegistry is the client ID of a federated managed identity, associated with cluster-image-registry-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ ingress:
+ description: |-
+ ingress is the client ID of a federated managed identity, associated with cluster-ingress-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ network:
+ description: |-
+ network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ nodePoolManagement:
+ description: |-
+ nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
+ in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ required:
+ - cloudProvider
+ - disk
+ - file
+ - imageRegistry
+ - ingress
+ - network
+ - nodePoolManagement
+ type: object
+ required:
+ - azureAuthenticationConfigType
+ type: object
+ x-kubernetes-validations:
+ - message: managedIdentities is required when azureAuthenticationConfigType
+ is ManagedIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''ManagedIdentities''
+ ? has(self.managedIdentities) : !has(self.managedIdentities)'
+ - message: workloadIdentities is required when azureAuthenticationConfigType
+ is WorkloadIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''WorkloadIdentities''
+ ? has(self.workloadIdentities) : !has(self.workloadIdentities)'
+ cloud:
+ default: AzurePublicCloud
+ description: 'cloud is the cloud environment identifier, valid
+ values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33'
+ enum:
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ location:
+ description: |-
+ location is the Azure region in where all the cloud infrastructure resources will be created.
+
+ Example: eastus
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: Location is immutable
+ rule: self == oldSelf
+ resourceGroup:
+ default: default
+ description: |-
+ resourceGroup is the name of an existing resource group where all cloud resources created by the Hosted
+ Cluster are to be placed. The resource group is expected to exist under the same subscription as SubscriptionID.
+
+ In ARO HCP, this will be the managed resource group where customer cloud resources will be created.
+
+ Resource group naming requirements can be found here: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ResourceGroup.Name/.
+
+ Example: if your resource group ID is /subscriptions//resourceGroups/, your
+ ResourceGroupName is .
+ maxLength: 90
+ pattern: ^[a-zA-Z0-9_()\-\.]{1,89}[a-zA-Z0-9_()\-]$
+ type: string
+ x-kubernetes-validations:
+ - message: ResourceGroupName is immutable
+ rule: self == oldSelf
+ securityGroupID:
+ description: |-
+ securityGroupID is the ID of an existing security group on the SubnetID. This field is provided as part of the
+ configuration for the Azure cloud provider, aka Azure cloud controller manager (CCM). This security group is
+ expected to exist under the same subscription as SubscriptionID.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SecurityGroupID is immutable
+ rule: self == oldSelf
+ subnetID:
+ description: |-
+ subnetID is the subnet ID of an existing subnet where the nodes in the nodepool will be created. This can be a
+ different subnet than the one listed in the HostedCluster, HostedCluster.Spec.Platform.Azure.SubnetID, but must
+ exist in the same network, HostedCluster.Spec.Platform.Azure.VnetID, and must exist under the same subscription ID,
+ HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ subnetID is immutable once set.
+ The subnetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The vnetName should be between 2 and 64 characters, consisting only of alphanumeric characters, hyphens, underscores and periods and must not end with either a period (.) or hyphen (-) character.
+ The subnetName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores and must start with an alphanumeric character and must not end with a period (.) or hyphen (-) character.
+ maxLength: 355
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`
+ rule: size(self.split('/')) == 11 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Network/virtualNetworks/.*/subnets/.*$')
+ - message: The resourceGroupName should be between 1 and 90
+ characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the subnetID must not
+ end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The vnetName should be between 2 and 64 characters,
+ consisting only of alphanumeric characters, hyphens, underscores
+ and periods
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_\\.]{2,64}')
+ - message: the vnetName in the subnetID must not end with
+ either a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[8].endsWith(''.'') && !self.split(''/'')[8].endsWith(''-'')'
+ - message: The subnetName should be between 1 and 80 characters,
+ consisting only of alphanumeric characters, hyphens and
+ underscores and must start with an alphanumeric character
+ rule: self.split('/')[10].matches('[a-zA-Z0-9][a-zA-Z0-9-_\\.]{0,79}')
+ - message: the subnetName in the subnetID must not end with
+ a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[10].endsWith(''.'') && !self.split(''/'')[10].endsWith(''-'')'
+ - message: SubnetID is immutable
+ rule: self == oldSelf
+ subscriptionID:
+ description: subscriptionID is a unique identifier for an
+ Azure subscription used to manage resources.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SubscriptionID is immutable
+ rule: self == oldSelf
+ tenantID:
+ description: tenantID is a unique identifier for the tenant
+ where Azure resources will be created and managed in.
+ maxLength: 255
+ type: string
+ vnetID:
+ description: |-
+ vnetID is the ID of an existing VNET to use in creating VMs. The VNET can exist in a different resource group
+ other than the one specified in ResourceGroupName, but it must exist under the same subscription as
+ SubscriptionID.
+
+ In ARO HCP, this will be the ID of the customer provided VNET.
+
+ Example: /subscriptions//resourceGroups//providers/Microsoft.Network/virtualNetworks/
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: VnetID is immutable
+ rule: self == oldSelf
+ required:
+ - azureAuthenticationConfig
+ - location
+ - resourceGroup
+ - securityGroupID
+ - subnetID
+ - subscriptionID
+ - tenantID
+ - vnetID
+ type: object
+ gcp:
+ description: gcp specifies configuration for clusters running
+ on Google Cloud Platform.
+ properties:
+ endpointAccess:
+ default: Private
+ description: |-
+ endpointAccess controls API endpoint accessibility for the HostedControlPlane on GCP.
+ Allowed values: "Private", "PublicAndPrivate". Defaults to "Private".
+ enum:
+ - PublicAndPrivate
+ - Private
+ type: string
+ networkConfig:
+ description: |-
+ networkConfig specifies VPC configuration for Private Service Connect.
+ Required for VPC configuration in Private Service Connect deployments.
+ properties:
+ network:
+ description: network is the VPC network name
+ properties:
+ name:
+ description: name is the name of the GCP resource
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ required:
+ - name
+ type: object
+ privateServiceConnectSubnet:
+ description: privateServiceConnectSubnet is the subnet
+ for Private Service Connect endpoints
+ properties:
+ name:
+ description: name is the name of the GCP resource
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - network
+ - privateServiceConnectSubnet
+ type: object
+ project:
+ description: |-
+ project is the GCP project ID.
+ A valid project ID must satisfy the following rules:
+ length: Must be between 6 and 30 characters, inclusive
+ characters: Only lowercase letters (`a-z`), digits (`0-9`), and hyphens (`-`) are allowed
+ start and end: Must begin with a lowercase letter and must not end with a hyphen
+ hyphens: No consecutive hyphens are allowed (e.g., "my--project" is invalid)
+ valid examples: "my-project", "my-project-1", "my-project-123".
+ maxLength: 30
+ minLength: 6
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ x-kubernetes-validations:
+ - message: Project is immutable
+ rule: self == oldSelf
+ region:
+ description: |-
+ region is the GCP region in which the cluster resides.
+ A valid region must satisfy the following rules:
+ format: Must be in the form `-`
+ characters: Only lowercase letters (`a-z`), digits (`0-9`), and a single hyphen (`-`) separator
+ valid examples: "us-central1", "europe-west2"
+ region must not include zone suffixes (e.g., "-a").
+ For a full list of valid regions, see: https://cloud.google.com/compute/docs/regions-zones.
+ maxLength: 63
+ pattern: ^[a-z]+-[a-z0-9]+[0-9]$
+ type: string
+ x-kubernetes-validations:
+ - message: Region is immutable
+ rule: self == oldSelf
+ required:
+ - networkConfig
+ - project
+ - region
+ type: object
+ ibmcloud:
+ description: ibmcloud defines IBMCloud specific settings for components
+ properties:
+ providerType:
+ description: providerType is a specific supported infrastructure
+ provider within IBM Cloud.
+ type: string
+ type: object
+ kubevirt:
+ description: kubevirt defines KubeVirt specific settings for cluster
+ components.
+ properties:
+ baseDomainPassthrough:
+ description: |-
+ baseDomainPassthrough toggles whether or not an automatically
+ generated base domain for the guest cluster should be used that
+ is a subdomain of the management cluster's *.apps DNS.
+
+ For the KubeVirt platform, the basedomain can be autogenerated using
+ the *.apps domain of the management/infra hosting cluster
+ This makes the guest cluster's base domain a subdomain of the
+ hypershift infra/mgmt cluster's base domain.
+
+ Example:
+ Infra/Mgmt cluster's DNS
+ Base: example.com
+ Cluster: mgmt-cluster.example.com
+ Apps: *.apps.mgmt-cluster.example.com
+ KubeVirt Guest cluster's DNS
+ Base: apps.mgmt-cluster.example.com
+ Cluster: guest.apps.mgmt-cluster.example.com
+ Apps: *.apps.guest.apps.mgmt-cluster.example.com
+
+ This is possible using OCP wildcard routes
+ type: boolean
+ x-kubernetes-validations:
+ - message: baseDomainPassthrough is immutable
+ rule: self == oldSelf
+ credentials:
+ description: |-
+ credentials defines the client credentials used when creating KubeVirt virtual machines.
+ Defining credentials is only necessary when the KubeVirt virtual machines are being placed
+ on a cluster separate from the one hosting the Hosted Control Plane components.
+
+ The default behavior when Credentials is not defined is for the KubeVirt VMs to be placed on
+ the same cluster and namespace as the Hosted Control Plane.
+ properties:
+ infraKubeConfigSecret:
+ description: |-
+ infraKubeConfigSecret is a reference to the secret containing the kubeconfig
+ of an external infrastructure cluster for kubevirt provider
+ properties:
+ key:
+ description: key is the key in the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: infraKubeConfigSecret is immutable
+ rule: self == oldSelf
+ infraNamespace:
+ description: |-
+ infraNamespace is the namespace in the external infrastructure cluster
+ where kubevirt resources will be created
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: infraNamespace is immutable
+ rule: self == oldSelf
+ required:
+ - infraNamespace
+ type: object
+ generateID:
+ description: |-
+ generateID is used to uniquely apply a name suffix to resources associated with
+ kubevirt infrastructure resources
+ maxLength: 11
+ type: string
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is immutable once set
+ rule: self == oldSelf
+ storageDriver:
+ description: |-
+ storageDriver defines how the KubeVirt CSI driver exposes StorageClasses on
+ the infra cluster (hosting the VMs) to the guest cluster.
+ properties:
+ manual:
+ description: |-
+ manual is used to explicitly define how the infra storageclasses are
+ mapped to guest storageclasses
+ properties:
+ storageClassMapping:
+ description: |-
+ storageClassMapping maps StorageClasses on the infra cluster hosting
+ the KubeVirt VMs to StorageClasses that are made available within the
+ Guest Cluster.
+
+ NOTE: It is possible that not all capabilities of an infra cluster's
+ storageclass will be present for the corresponding guest clusters storageclass.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestStorageClassName:
+ description: |-
+ guestStorageClassName is the name that the corresponding storageclass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraStorageClassName:
+ description: |-
+ infraStorageClassName is the name of the infra cluster storage class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestStorageClassName
+ - infraStorageClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: storageClassMapping is immutable
+ rule: self == oldSelf
+ volumeSnapshotClassMapping:
+ description: |-
+ volumeSnapshotClassMapping maps VolumeSnapshotClasses on the infra cluster hosting
+ the KubeVirt VMs to VolumeSnapshotClasses that are made available within the
+ Guest Cluster.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestVolumeSnapshotClassName:
+ description: |-
+ guestVolumeSnapshotClassName is the name that the corresponding volumeSnapshotClass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraVolumeSnapshotClassName:
+ description: |-
+ infraVolumeSnapshotClassName is the name of the infra cluster volume snapshot class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestVolumeSnapshotClassName
+ - infraVolumeSnapshotClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: volumeSnapshotClassMapping is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver.Manual is immutable
+ rule: self == oldSelf
+ type:
+ default: Default
+ description: type represents the type of kubevirt csi
+ driver configuration to use
+ enum:
+ - None
+ - Default
+ - Manual
+ type: string
+ x-kubernetes-validations:
+ - message: storageDriver.Type is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is required once set
+ rule: '!has(oldSelf.generateID) || has(self.generateID)'
+ openstack:
+ description: openstack specifies configuration for clusters running
+ on OpenStack.
+ properties:
+ disableExternalNetwork:
+ description: |-
+ disableExternalNetwork specifies whether or not to attempt to connect the cluster
+ to an external network. This allows for the creation of clusters when connecting
+ to an external network is not possible or desirable, e.g. if using a provider network.
+ type: boolean
+ externalNetwork:
+ description: |-
+ externalNetwork is the OpenStack Network to be used to get public internet to the VMs.
+ This option is ignored if DisableExternalNetwork is set to true.
+
+ If ExternalNetwork is defined it must refer to exactly one external network.
+
+ If ExternalNetwork is not defined or is empty the controller will use any
+ existing external network as long as there is only one. It is an
+ error if ExternalNetwork is not defined and there are multiple
+ external networks unless DisableExternalNetwork is also set.
+
+ If ExternalNetwork is not defined and there are no external networks
+ the controller will proceed as though DisableExternalNetwork was set.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ network. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ network to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the network to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the network
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the network to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ identityRef:
+ description: |-
+ identityRef is a reference to a secret holding OpenStack credentials
+ to be used when reconciling the hosted cluster.
+ properties:
+ cloudName:
+ description: cloudName specifies the name of the entry
+ in the clouds.yaml file to use.
+ maxLength: 255
+ type: string
+ name:
+ description: |-
+ name is the name of a secret in the same namespace as the resource being provisioned.
+ The secret must contain a key named `clouds.yaml` which contains an OpenStack clouds.yaml file.
+ The secret may optionally contain a key named `cacert` containing a PEM-encoded CA certificate.
+ maxLength: 255
+ type: string
+ required:
+ - cloudName
+ - name
+ type: object
+ ingressFloatingIP:
+ description: |-
+ ingressFloatingIP is an available floating IP in your OpenStack cluster that will
+ be associated with the OpenShift ingress port.
+ When not specified, an IP address will be assigned randomly by the OpenStack cloud provider.
+ When specified, the floating IP has to be pre-created. If the
+ specified value is not a floating IP or is already claimed, the
+ OpenStack cloud provider won't be able to provision the load
+ balancer.
+ This value must be a valid IPv4 or IPv6 address.
+ maxLength: 45
+ type: string
+ x-kubernetes-validations:
+ - message: floatingIP must be a valid IPv4 or IPv6 address
+ rule: isIP(self)
+ managedSubnets:
+ description: |-
+ managedSubnets describe the OpenStack Subnet to be created. Cluster actuator will create a network,
+ and a subnet with the defined DNSNameservers, AllocationPools and the CIDR defined in the HostedCluster
+ MachineNetwork, and a router connected to the subnet. Currently only one IPv4
+ subnet is supported.
+ items:
+ properties:
+ allocationPools:
+ description: |-
+ allocationPools is an array of AllocationPool objects that will be applied to OpenStack Subnet being created.
+ If set, OpenStack will only allocate these IPs for Machines. It will still be possible to create ports from
+ outside of these ranges manually.
+ items:
+ properties:
+ end:
+ description: end represents the end of the AlloctionPool,
+ that is the highest IP of the pool.
+ maxLength: 255
+ type: string
+ start:
+ description: start represents the start of the
+ AllocationPool, that is the lowest IP of the
+ pool.
+ maxLength: 255
+ type: string
+ required:
+ - end
+ - start
+ type: object
+ maxItems: 10
+ type: array
+ dnsNameservers:
+ description: |-
+ dnsNameservers holds a list of DNS server addresses that will be provided when creating
+ the subnet. These addresses need to have the same IP version as CIDR.
+ items:
+ maxLength: 45
+ type: string
+ maxItems: 10
+ type: array
+ type: object
+ maxItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network specifies an existing network to use if no ManagedSubnets
+ are specified.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ network. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ network to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the network to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the network
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the network to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ networkMTU:
+ description: networkMTU is the MTU for the network.
+ maximum: 9000
+ minimum: 1500
+ type: integer
+ router:
+ description: |-
+ router specifies an existing router to be used if ManagedSubnets are
+ specified. If specified, no new router will be created.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ router. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ router to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the router to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the router
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the router to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ subnets:
+ description: |-
+ subnets specifies existing subnets to use if not ManagedSubnets are
+ specified. All subnets must be in the network specified by Network.
+ There can be zero, one, or two subnets. If no subnets are specified,
+ all subnets in Network will be used. If 2 subnets are specified, one
+ must be IPv4 and the other IPv6.
+ items:
+ description: SubnetParam specifies an OpenStack subnet to
+ use. It may be specified by either ID or filter, but not
+ both.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select the
+ subnet. It must match exactly one subnet.
+ minProperties: 1
+ properties:
+ cidr:
+ description: cidr is the CIDR of the subnet to filter
+ by.
+ maxLength: 45
+ type: string
+ description:
+ description: description is the description of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ gatewayIP:
+ description: gatewayIP is the gateway IP of the
+ subnet to filter by.
+ maxLength: 45
+ type: string
+ ipVersion:
+ description: ipVersion is the IP version of the
+ subnet to filter by.
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ ipv6AddressMode:
+ description: ipv6AddressMode is the IPv6 address
+ mode of the subnet to filter by.
+ maxLength: 255
+ type: string
+ ipv6RAMode:
+ description: ipv6RAMode is the IPv6 RA mode of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the subnet to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the uuid of the subnet. It will not
+ be validated.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ tags:
+ description: tags to set on all resources in cluster which
+ support tags
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - identityRef
+ type: object
+ powervs:
+ description: |-
+ powervs specifies configuration for clusters running on IBMCloud Power VS Service.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ accountID:
+ description: |-
+ accountID is the IBMCloud account id.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the IBMCloud CIS Service Instance's Cloud Resource Name
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ pattern: '^crn:'
+ type: string
+ imageRegistryOperatorCloudCreds:
+ description: |-
+ imageRegistryOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for image registry operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ ingressOperatorCloudCreds:
+ description: |-
+ ingressOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for ingress operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ kubeCloudControllerCreds:
+ description: |
+ kubeCloudControllerCreds is a reference to a secret containing cloud
+ credentials with permissions matching the cloud controller policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ nodePoolManagementCreds:
+ description: |
+ nodePoolManagementCreds is a reference to a secret containing cloud
+ credentials with permissions matching the node pool management policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ region:
+ description: |-
+ region is the IBMCloud region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot image for a given release.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the IBMCloud Resource Group in which the cluster resides.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ serviceInstanceID:
+ description: |-
+ serviceInstanceID is the reference to the Power VS service on which the server instance(VM) will be created.
+ Power VS service is a container for all Power VS instances at a specific geographic region.
+ serviceInstance can be created via IBM Cloud catalog or CLI.
+ ServiceInstanceID is the unique identifier that can be obtained from IBM Cloud UI or IBM Cloud cli.
+
+ More detail about Power VS service instance.
+ https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-creating-power-virtual-server
+
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ storageOperatorCloudCreds:
+ description: |-
+ storageOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for storage operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ subnet:
+ description: |-
+ subnet is the subnet to use for control plane cloud resources.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ name:
+ description: name of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: |-
+ vpc specifies IBM Cloud PowerVS Load Balancing configuration for the control
+ plane.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ description: |-
+ name for VPC to used for all the service load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ region:
+ description: |-
+ region is the IBMCloud region in which VPC gets created, this VPC used for all the ingress traffic
+ into the OCP cluster.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ subnet:
+ description: |-
+ subnet is the subnet to use for load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where load balancer cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - region
+ type: object
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - accountID
+ - cisInstanceCRN
+ - imageRegistryOperatorCloudCreds
+ - ingressOperatorCloudCreds
+ - kubeCloudControllerCreds
+ - nodePoolManagementCreds
+ - region
+ - resourceGroup
+ - serviceInstanceID
+ - storageOperatorCloudCreds
+ - subnet
+ - vpc
+ - zone
+ type: object
+ type:
+ description: type is the type of infrastructure provider for the
+ cluster.
+ enum:
+ - AWS
+ - Azure
+ - IBMCloud
+ - KubeVirt
+ - Agent
+ - PowerVS
+ - None
+ - OpenStack
+ - GCP
+ maxLength: 100
+ type: string
+ x-kubernetes-validations:
+ - message: Type is immutable
+ rule: self == oldSelf
+ required:
+ - type
+ type: object
+ pullSecret:
+ description: |-
+ pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
+ and it will be injected into the container runtime of all NodePools.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ release:
+ description: |-
+ release specifies the desired OCP release payload for all the hosted cluster components.
+ This includes those components running management side like the Kube API Server and the CVO but also the operands which land in the hosted cluster data plane like the ingress controller, ovn agents, etc.
+ The maximum and minimum supported release versions are determined by the running Hypersfhit Operator.
+ Attempting to use an unsupported version will result in the HostedCluster being degraded and the validateReleaseImage condition being false.
+ Attempting to use a release with a skew against a NodePool release bigger than N-2 for the y-stream will result in leaving the NodePool in an unsupported state.
+ Changing this field will trigger a rollout of the control plane components.
+ The behavior of the rollout will be driven by the ControllerAvailabilityPolicy and InfrastructureAvailabilityPolicy for PDBs and maxUnavailable and surce policies.
+ properties:
+ image:
+ description: |-
+ image is the image pullspec of an OCP release payload image.
+ See https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags for a list of available images.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: Image must start with a word character (letters, digits,
+ or underscores) and contain no white spaces
+ rule: self.matches('^(\\w+\\S+)$')
+ required:
+ - image
+ type: object
+ secretEncryption:
+ description: |-
+ secretEncryption specifies a Kubernetes secret encryption strategy for the
+ control plane.
+ properties:
+ aescbc:
+ description: aescbc defines metadata about the AESCBC secret encryption
+ strategy
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to encrypt
+ new secrets
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - activeKey
+ type: object
+ kms:
+ description: kms defines metadata about the kms secret encryption
+ strategy
+ properties:
+ aws:
+ description: aws defines metadata about the configuration
+ of the AWS KMS Secret Encryption provider
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ auth:
+ description: auth defines metadata about the management
+ of credentials used to interact with AWS KMS
+ properties:
+ awsKms:
+ description: "awsKms is an ARN value referencing a
+ role appropriate for managing the auth via the AWS
+ KMS key.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n \t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"kms:Encrypt\",\n\t\t\t\t\"kms:Decrypt\",\n\t\t\t\t\"kms:ReEncrypt*\",\n\t\t\t\t\"kms:GenerateDataKey*\",\n\t\t\t\t\"kms:DescribeKey\"\n\t\t\t],\n\t\t\t\"Resource\":
+ %q\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - awsKms
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ region:
+ description: region contains the AWS region
+ maxLength: 255
+ type: string
+ required:
+ - activeKey
+ - auth
+ - region
+ type: object
+ azure:
+ description: azure defines metadata about the configuration
+ of the Azure KMS Secret Encryption provider using Azure
+ key vault
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ kms:
+ description: kms is a pre-existing managed identity used
+ to authenticate with Azure KMS.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity must
+ be a valid UUID. It should be 5 groups of hyphen
+ separated hexadecimal characters in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - activeKey
+ - kms
+ type: object
+ ibmcloud:
+ description: ibmcloud defines metadata for the IBM Cloud KMS
+ encryption strategy
+ properties:
+ auth:
+ description: auth defines metadata for how authentication
+ is done with IBM Cloud KMS
+ properties:
+ managed:
+ description: |-
+ managed defines metadata around the service to service authentication strategy for the IBM Cloud
+ KMS system (all provider managed).
+ type: object
+ type:
+ description: type defines the IBM Cloud KMS authentication
+ strategy
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ unmanaged:
+ description: unmanaged defines the auth metadata the
+ customer provides to interact with IBM Cloud KMS
+ properties:
+ credentials:
+ description: |-
+ credentials should reference a secret with a key field of IBMCloudIAMAPIKeySecretKey that contains a apikey to
+ call IBM Cloud KMS APIs
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - credentials
+ type: object
+ required:
+ - type
+ type: object
+ keyList:
+ description: keyList defines the list of keys used for
+ data encryption
+ items:
+ description: IBMCloudKMSKeyEntry defines metadata for
+ an IBM Cloud KMS encryption key
+ properties:
+ correlationID:
+ description: correlationID is an identifier used
+ to track all api call usage from hypershift
+ maxLength: 255
+ type: string
+ crkID:
+ description: crkID is the customer rook key id
+ maxLength: 255
+ type: string
+ instanceID:
+ description: instanceID is the id for the key protect
+ instance
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: |-
+ keyVersion is a unique number associated with the key. The number increments whenever a new
+ key is enabled for data encryption.
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ url:
+ description: url is the url to call key protect
+ apis over
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - correlationID
+ - crkID
+ - instanceID
+ - keyVersion
+ - url
+ type: object
+ maxItems: 100
+ type: array
+ region:
+ description: region is the IBM Cloud region
+ maxLength: 255
+ type: string
+ required:
+ - auth
+ - keyList
+ - region
+ type: object
+ provider:
+ description: provider defines the KMS provider
+ enum:
+ - IBMCloud
+ - AWS
+ - Azure
+ type: string
+ required:
+ - provider
+ type: object
+ type:
+ description: type defines the type of kube secret encryption being
+ used
+ enum:
+ - kms
+ - aescbc
+ type: string
+ required:
+ - type
+ type: object
+ serviceAccountSigningKey:
+ description: |-
+ serviceAccountSigningKey is a local reference to a secret that must have a "key" key whose content must be the private key
+ used by the service account token issuer.
+ If not specified, a service account signing key will
+ be generated automatically for the cluster.
+ When specifying a service account signing key, an IssuerURL must also be specified.
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ services:
+ description: |-
+ services specifies how individual control plane services endpoints are published for consumption.
+ This requires APIServer;OAuthServer;Konnectivity;Ignition.
+ This field is immutable for all platforms but IBMCloud.
+ Max is 6 to account for OIDC;OVNSbDb for backward compatibility though they are no-op.
+
+ -kubebuilder:validation:XValidation:rule="self.all(s, !(s.service == 'APIServer' && s.servicePublishingStrategy.type == 'Route') || has(s.servicePublishingStrategy.route.hostname))",message="If serviceType is 'APIServer' and publishing strategy is 'Route', then hostname must be set"
+ -kubebuilder:validation:XValidation:rule="self.platform.type == 'IBMCloud' ? ['APIServer', 'OAuthServer', 'Konnectivity'].all(requiredType, self.exists(s, s.service == requiredType))",message="Services list must contain at least 'APIServer', 'OAuthServer', and 'Konnectivity' service types" : ['APIServer', 'OAuthServer', 'Konnectivity', 'Ignition'].all(requiredType, self.exists(s, s.service == requiredType))",message="Services list must contain at least 'APIServer', 'OAuthServer', 'Konnectivity', and 'Ignition' service types"
+ -kubebuilder:validation:XValidation:rule="self.filter(s, s.servicePublishingStrategy.type == 'Route' && has(s.servicePublishingStrategy.route) && has(s.servicePublishingStrategy.route.hostname)).all(x, self.filter(y, y.servicePublishingStrategy.type == 'Route' && (has(y.servicePublishingStrategy.route) && has(y.servicePublishingStrategy.route.hostname) && y.servicePublishingStrategy.route.hostname == x.servicePublishingStrategy.route.hostname)).size() <= 1)",message="Each route publishingStrategy 'hostname' must be unique within the Services list."
+ -kubebuilder:validation:XValidation:rule="self.filter(s, s.servicePublishingStrategy.type == 'NodePort' && has(s.servicePublishingStrategy.nodePort) && has(s.servicePublishingStrategy.nodePort.address) && has(s.servicePublishingStrategy.nodePort.port)).all(x, self.filter(y, y.servicePublishingStrategy.type == 'NodePort' && (has(y.servicePublishingStrategy.nodePort) && has(y.servicePublishingStrategy.nodePort.address) && y.servicePublishingStrategy.nodePort.address == x.servicePublishingStrategy.nodePort.address && has(y.servicePublishingStrategy.nodePort.port) && y.servicePublishingStrategy.nodePort.port == x.servicePublishingStrategy.nodePort.port )).size() <= 1)",message="Each nodePort publishingStrategy 'nodePort' and 'hostname' must be unique within the Services list."
+ items:
+ description: |-
+ ServicePublishingStrategyMapping specifies how individual control plane services endpoints are published for consumption.
+ This includes APIServer;OAuthServer;Konnectivity;Ignition.
+ If a given service is not present in this list, it will be exposed publicly by default.
+ properties:
+ service:
+ description: |-
+ service identifies the type of service being published.
+ It can be APIServer;OAuthServer;Konnectivity;Ignition
+ OVNSbDb;OIDC are no-op and kept for backward compatibility.
+ This field is immutable.
+ enum:
+ - APIServer
+ - OAuthServer
+ - OIDC
+ - Konnectivity
+ - Ignition
+ - OVNSbDb
+ type: string
+ servicePublishingStrategy:
+ description: servicePublishingStrategy specifies how to publish
+ a service endpoint.
+ properties:
+ loadBalancer:
+ description: loadBalancer configures exposing a service
+ using a dedicated LoadBalancer.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the LoadBalancer and passed through to consumers of the service.
+ If omitted, the value will be inferred from the corev1.Service Load balancer type .status.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ nodePort:
+ description: nodePort configures exposing a service using
+ a NodePort.
+ properties:
+ address:
+ description: address is the host/ip that the NodePort
+ service is exposed over.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: address must be a valid hostname, IPv4, or
+ IPv6 address
+ rule: self.matches('^(([a-zA-Z0-9][-a-zA-Z0-9]*\\.)+[a-zA-Z]{2,}|localhost)$')
+ || self.matches('^((\\d{1,3}\\.){3}\\d{1,3})$')
+ || self.matches('^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$')
+ port:
+ description: |-
+ port is the port of the NodePort service. If <=0, the port is dynamically
+ assigned when the service is created.
+ format: int32
+ type: integer
+ required:
+ - address
+ type: object
+ route:
+ description: |-
+ route configures exposing a service using a Route through and an ingress controller behind a cloud Load Balancer.
+ The specifics of the setup are platform dependent.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the Route and passed through to consumers of the service.
+ If omitted, the value will be inferred from management ingress.Spec.Domain.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy used for the service.
+ It can be LoadBalancer;NodePort;Route;None;S3
+ enum:
+ - LoadBalancer
+ - NodePort
+ - Route
+ - None
+ - S3
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: nodePort is required when type is NodePort, and forbidden
+ otherwise
+ rule: 'self.type == ''NodePort'' ? has(self.nodePort) : !has(self.nodePort)'
+ - message: only route is allowed when type is Route, and forbidden
+ otherwise
+ rule: 'self.type == ''Route'' ? !has(self.nodePort) && !has(self.loadBalancer)
+ : !has(self.route)'
+ - message: only loadBalancer is required when type is LoadBalancer,
+ and forbidden otherwise
+ rule: 'self.type == ''LoadBalancer'' ? !has(self.nodePort)
+ && !has(self.route) : !has(self.loadBalancer)'
+ - message: None does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''None'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ - message: S3 does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''S3'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ required:
+ - service
+ - servicePublishingStrategy
+ type: object
+ maxItems: 6
+ type: array
+ sshKey:
+ description: |-
+ sshKey is a local reference to a Secret that must have a "id_rsa.pub" key whose content must be the public part of 1..N SSH keys.
+ If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
+ When sshKey is set, the controllers will generate a machineConfig with the sshAuthorizedKeys https://coreos.github.io/ignition/configuration-v3_2/ populated with this value.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ tolerations:
+ description: tolerations when specified, define what custom tolerations
+ are added to the hcp pods.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ maxItems: 25
+ type: array
+ updateService:
+ description: |-
+ updateService may be used to specify the preferred upstream update service.
+ If omitted we will use the appropriate update service for the cluster and region.
+ This is used by the control plane operator to determine and signal the appropriate available upgrades in the hostedCluster.status.
+ type: string
+ x-kubernetes-validations:
+ - message: updateService must be a valid absolute URL
+ rule: isURL(self)
+ required:
+ - etcd
+ - networking
+ - platform
+ - pullSecret
+ - release
+ - services
+ type: object
+ x-kubernetes-validations:
+ - message: spec.services in body should have at least 4 items or 3 for
+ IBMCloud
+ rule: 'self.platform.type == ''IBMCloud'' ? size(self.services) >= 3
+ : size(self.services) >= 4'
+ - message: Services is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: 'self.platform.type != "IBMCloud" ? self.services == oldSelf.services
+ : true'
+ - message: Azure platform requires OAuthServer to use Route service publishing
+ strategy
+ rule: 'self.platform.type == "Azure" ? self.services.exists(s, s.service
+ == "OAuthServer" && s.servicePublishingStrategy.type == "Route") :
+ true'
+ - message: Azure platform requires Konnectivity to use Route service publishing
+ strategy
+ rule: 'self.platform.type == "Azure" ? self.services.exists(s, s.service
+ == "Konnectivity" && s.servicePublishingStrategy.type == "Route")
+ : true'
+ - message: Azure platform requires Ignition to use Route service publishing
+ strategy
+ rule: 'self.platform.type == "Azure" ? self.services.exists(s, s.service
+ == "Ignition" && s.servicePublishingStrategy.type == "Route") : true'
+ - message: If serviceAccountSigningKey is set, issuerURL must be set
+ rule: has(self.issuerURL) || !has(self.serviceAccountSigningKey)
+ - message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
+ rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
+ && s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
+ && has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
+ cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
+ - message: disableMultiNetwork can only be set to true when networkType
+ is 'Other'
+ rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)
+ || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork)
+ || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork
+ || self.networking.networkType == ''Other'''
+ - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
+ rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
+ || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
+ status:
+ description: status is the latest observed status of the HostedCluster.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the latest available observations of a control
+ plane's current state.
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ configuration:
+ description: configuration contains the cluster configuration status
+ of the HostedCluster
+ properties:
+ authentication:
+ description: |-
+ authentication contains the observed authentication configuration status from the hosted cluster.
+ This field reflects the current state of the cluster authentication including OAuth metadata,
+ OIDC client status, and other authentication-related configurations.
+ properties:
+ integratedOAuthMetadata:
+ description: |-
+ integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for the in-cluster integrated OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ This contains the observed value based on cluster state.
+ An explicitly set value in spec.oauthMetadata has precedence over this field.
+ This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
+ The key "oauthMetadata" is used to locate the data.
+ If the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config-managed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcClients:
+ description: |-
+ oidcClients is where participating operators place the current OIDC client status
+ for OIDC clients that can be customized by the cluster-admin.
+ items:
+ description: |-
+ OIDCClientStatus represents the current state
+ of platform components and how they interact with
+ the configured identity providers.
+ properties:
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component using the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component using the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ conditions:
+ description: |-
+ conditions are used to communicate the state of the `oidcClients` entry.
+
+ Supported conditions include Available, Degraded and Progressing.
+
+ If Available is true, the component is successfully using the configured client.
+ If Degraded is true, that means something has gone wrong trying to handle the client configuration.
+ If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or
+ in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ consumingUsers:
+ description: |-
+ consumingUsers is an optional list of ServiceAccounts requiring
+ read permissions on the `clientSecret` secret.
+
+ consumingUsers must not exceed 5 entries.
+ items:
+ description: ConsumingUser is an alias for string
+ which we add validation to. Currently only service
+ accounts are supported.
+ maxLength: 512
+ minLength: 1
+ pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ maxItems: 5
+ type: array
+ x-kubernetes-list-type: set
+ currentOIDCClients:
+ description: |-
+ currentOIDCClients is an optional list of clients that the component is currently using.
+ Entries must have unique issuerURL/clientID pairs.
+ items:
+ description: |-
+ OIDCClientReference is a reference to a platform component
+ client configuration.
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that specifies the client identifier, from
+ the identity provider, that the platform component is using for authentication
+ requests made to the identity provider.
+
+ clientID must not be empty.
+ minLength: 1
+ type: string
+ issuerURL:
+ description: |-
+ issuerURL is a required field that specifies the URL of the identity
+ provider that this client is configured to make requests against.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ oidcProviderName:
+ description: |-
+ oidcProviderName is a required reference to the 'name' of the identity provider
+ configured in 'oidcProviders' that this client is associated with.
+
+ oidcProviderName must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - clientID
+ - issuerURL
+ - oidcProviderName
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - issuerURL
+ - clientID
+ x-kubernetes-list-type: map
+ required:
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ type: object
+ type: object
+ controlPlaneEndpoint:
+ description: |-
+ controlPlaneEndpoint contains the endpoint information by which
+ external clients can access the control plane. This is populated
+ after the infrastructure is ready.
+ properties:
+ host:
+ description: host is the hostname on which the API server is serving.
+ maxLength: 255
+ type: string
+ port:
+ description: port is the port on which the API server is serving.
+ format: int32
+ type: integer
+ required:
+ - host
+ - port
+ type: object
+ customKubeconfig:
+ description: |-
+ customKubeconfig is a local secret reference to the external custom kubeconfig.
+ Once the hypershift operator sets this status field, it will generate a secret with the specified name containing a kubeconfig within the `HostedCluster` namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ ignitionEndpoint:
+ description: |-
+ ignitionEndpoint is the endpoint injected in the ign config userdata.
+ It exposes the config for instances to become kubernetes nodes.
+ maxLength: 1024
+ type: string
+ kubeadminPassword:
+ description: |-
+ kubeadminPassword is a reference to the secret that contains the initial
+ kubeadmin user password for the guest cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ kubeconfig:
+ description: |-
+ kubeconfig is a reference to the secret containing the default kubeconfig
+ for the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ oauthCallbackURLTemplate:
+ description: |-
+ oauthCallbackURLTemplate contains a template for the URL to use as a callback
+ for identity providers. The [identity-provider-name] placeholder must be replaced
+ with the name of an identity provider defined on the HostedCluster.
+ This is populated after the infrastructure is ready.
+ maxLength: 1024
+ type: string
+ payloadArch:
+ description: |-
+ payloadArch represents the CPU architecture type of the HostedCluster.Spec.Release.Image. The valid values are:
+ Multi, ARM64, AMD64, S390X, or PPC64LE.
+ enum:
+ - Multi
+ - ARM64
+ - AMD64
+ - PPC64LE
+ - S390X
+ type: string
+ platform:
+ description: platform contains platform-specific status of the HostedCluster
+ properties:
+ aws:
+ description: aws contains platform-specific status for AWS
+ properties:
+ defaultWorkerSecurityGroupID:
+ description: |-
+ defaultWorkerSecurityGroupID is the ID of a security group created by
+ the control plane operator. It is always added to worker machines in
+ addition to any security groups specified in the NodePool.
+ maxLength: 255
+ type: string
+ type: object
+ type: object
+ version:
+ description: |-
+ version is the status of the release version applied to the
+ HostedCluster.
+ properties:
+ availableUpdates:
+ description: |-
+ availableUpdates contains updates recommended for this
+ cluster. Updates which appear in conditionalUpdates but not in
+ availableUpdates may expose this cluster to known issues. This list
+ may be empty if no updates are recommended, if the update service
+ is unavailable, or if an invalid channel has been specified.
+ items:
+ description: Release represents an OpenShift release image and
+ associated metadata.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ maxItems: 100
+ nullable: true
+ type: array
+ conditionalUpdates:
+ description: |-
+ conditionalUpdates contains the list of updates that may be
+ recommended for this cluster if it meets specific required
+ conditions. Consumers interested in the set of updates that are
+ actually recommended for this cluster should use
+ availableUpdates. This list may be empty if no updates are
+ recommended, if the update service is unavailable, or if an empty
+ or invalid channel has been specified.
+ items:
+ description: |-
+ ConditionalUpdate represents an update which is recommended to some
+ clusters on the version the current cluster is reconciling, but which
+ may not be recommended for the current cluster.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the observations of the conditional update's
+ current status. Known types are:
+ * Recommended, for whether the update is recommended for the current cluster.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in
+ foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ release:
+ description: release is the target of the update.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ risks:
+ description: |-
+ risks represents the range of issues associated with
+ updating to the target release. The cluster-version
+ operator will evaluate all entries, and only recommend the
+ update if there is at least one entry and all entries
+ recommend the update.
+ items:
+ description: |-
+ ConditionalUpdateRisk represents a reason and cluster-state
+ for not recommending a conditional update.
+ properties:
+ matchingRules:
+ description: |-
+ matchingRules is a slice of conditions for deciding which
+ clusters match the risk and which do not. The slice is
+ ordered by decreasing precedence. The cluster-version
+ operator will walk the slice in order, and stop after the
+ first it can successfully evaluate. If no condition can be
+ successfully evaluated, the update will not be recommended.
+ items:
+ description: |-
+ ClusterCondition is a union of typed cluster conditions. The 'type'
+ property determines which of the type-specific properties are relevant.
+ When evaluated on a cluster, the condition may match, not match, or
+ fail to evaluate.
+ properties:
+ promql:
+ description: promql represents a cluster condition
+ based on PromQL.
+ properties:
+ promql:
+ description: |-
+ promql is a PromQL query classifying clusters. This query
+ query should return a 1 in the match case and a 0 in the
+ does-not-match case. Queries which return no time
+ series, or which return values besides 0 or 1, are
+ evaluation failures.
+ type: string
+ required:
+ - promql
+ type: object
+ type:
+ description: |-
+ type represents the cluster-condition type. This defines
+ the members and semantics of any additional properties.
+ enum:
+ - Always
+ - PromQL
+ type: string
+ required:
+ - type
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ message:
+ description: |-
+ message provides additional information about the risk of
+ updating, in the event that matchingRules match the cluster
+ state. This is only to be consumed by humans. It may
+ contain Line Feed characters (U+000A), which should be
+ rendered as new lines.
+ minLength: 1
+ type: string
+ name:
+ description: |-
+ name is the CamelCase reason for not recommending a
+ conditional update, in the event that matchingRules match the
+ cluster state.
+ minLength: 1
+ type: string
+ url:
+ description: url contains information about this risk.
+ format: uri
+ minLength: 1
+ type: string
+ required:
+ - matchingRules
+ - message
+ - name
+ - url
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - release
+ - risks
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-type: atomic
+ desired:
+ description: |-
+ desired is the version that the cluster is reconciling towards.
+ If the cluster is not yet fully initialized desired will be set
+ with the information available, which may be an image or a tag.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ history:
+ description: |-
+ history contains a list of the most recent versions applied to the cluster.
+ This value may be empty during cluster startup, and then will be updated
+ when a new update is being applied. The newest update is first in the
+ list and it is ordered by recency. Updates in the history have state
+ Completed if the rollout completed - if an update was failing or halfway
+ applied the state will be Partial. Only a limited amount of update history
+ is preserved.
+ items:
+ description: UpdateHistory is a single attempted update to the
+ cluster.
+ properties:
+ acceptedRisks:
+ description: |-
+ acceptedRisks records risks which were accepted to initiate the update.
+ For example, it may menition an Upgradeable=False or missing signature
+ that was overriden via desiredUpdate.force, or an update that was
+ initiated despite not being in the availableUpdates set of recommended
+ update targets.
+ type: string
+ completionTime:
+ description: |-
+ completionTime, if set, is when the update was fully applied. The update
+ that is currently being applied will have a null completion time.
+ Completion time will always be set for entries that are not the current
+ update (usually to the started time of the next update).
+ format: date-time
+ nullable: true
+ type: string
+ image:
+ description: |-
+ image is a container image location that contains the update. This value
+ is always populated.
+ type: string
+ startedTime:
+ description: startedTime is the time at which the update
+ was started.
+ format: date-time
+ type: string
+ state:
+ description: |-
+ state reflects whether the update was fully applied. The Partial state
+ indicates the update is not fully applied, while the Completed state
+ indicates the update was successfully rolled out at least once (all
+ parts of the update successfully applied).
+ type: string
+ verified:
+ description: |-
+ verified indicates whether the provided update was properly verified
+ before it was installed. If this is false the cluster may not be trusted.
+ Verified does not cover upgradeable checks that depend on the cluster
+ state at the time when the update target was accepted.
+ type: boolean
+ version:
+ description: |-
+ version is a semantic version identifying the update version. If the
+ requested image does not define a version, or if a failure occurs
+ retrieving the image, this value may be empty.
+ type: string
+ required:
+ - completionTime
+ - image
+ - startedTime
+ - state
+ - verified
+ type: object
+ type: array
+ observedGeneration:
+ description: |-
+ observedGeneration reports which version of the spec is being synced.
+ If this value is not equal to metadata.generation, then the desired
+ and conditions fields may represent a previous version.
+ format: int64
+ type: integer
+ required:
+ - availableUpdates
+ - desired
+ - observedGeneration
+ type: object
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/hostedcontrolplanes-CustomNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/hostedcontrolplanes-CustomNoUpgrade.crd.yaml
new file mode 100644
index 00000000000..aa24f8d4a2e
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/hostedcontrolplanes-CustomNoUpgrade.crd.yaml
@@ -0,0 +1,8097 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: CustomNoUpgrade
+ name: hostedcontrolplanes.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ categories:
+ - cluster-api
+ kind: HostedControlPlane
+ listKind: HostedControlPlaneList
+ plural: hostedcontrolplanes
+ shortNames:
+ - hcp
+ - hcps
+ singular: hostedcontrolplane
+ scope: Namespaced
+ versions:
+ - name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: HostedControlPlane defines the desired state of HostedControlPlane
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the specification for the HostedControlPlane.
+ properties:
+ additionalTrustBundle:
+ description: additionalTrustBundle references a ConfigMap containing
+ a PEM-encoded X.509 certificate bundle
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ auditWebhook:
+ description: |-
+ auditWebhook contains metadata for configuring an audit webhook
+ endpoint for a cluster to process cluster audit events. It references
+ a secret that contains the webhook information for the audit webhook endpoint.
+ It is a secret because if the endpoint has MTLS the kubeconfig will contain client
+ keys. This is currently only supported in IBM Cloud. The kubeconfig needs to be stored
+ in the secret with a secret key name that corresponds to the constant AuditWebhookKubeconfigKey.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ autoNode:
+ description: autoNode specifies the configuration for the autoNode
+ feature.
+ properties:
+ provisionerConfig:
+ description: provisionerConfig is the implementation used for
+ Node auto provisioning.
+ properties:
+ karpenter:
+ description: karpenter specifies the configuration for the
+ Karpenter provisioner.
+ properties:
+ aws:
+ description: aws specifies the AWS-specific configuration
+ for Karpenter.
+ properties:
+ roleARN:
+ description: roleARN specifies the ARN of the Karpenter
+ provisioner.
+ maxLength: 255
+ type: string
+ required:
+ - roleARN
+ type: object
+ platform:
+ description: platform specifies the platform-specific
+ configuration for Karpenter.
+ maxLength: 100
+ type: string
+ required:
+ - platform
+ type: object
+ name:
+ allOf:
+ - enum:
+ - Karpenter
+ - enum:
+ - Karpenter
+ description: name specifies the name of the provisioner to
+ use.
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - provisionerConfig
+ type: object
+ autoscaling:
+ description: |-
+ autoscaling specifies auto-scaling behavior that applies to all NodePools
+ associated with the control plane.
+ properties:
+ balancingIgnoredLabels:
+ description: |-
+ balancingIgnoredLabels sets "--balancing-ignore-label " flag on cluster-autoscaler for each listed label.
+ This option specifies labels that cluster autoscaler should ignore when considering node group similarity.
+ For example, if you have nodes with "topology.ebs.csi.aws.com/zone" label, you can add name of this label here
+ to prevent cluster autoscaler from splitting nodes into different node groups based on its value.
+
+ HyperShift automatically appends platform-specific balancing ignore labels:
+ - AWS: "lifecycle", "k8s.amazonaws.com/eniConfig", "topology.k8s.aws/zone-id"
+ - Azure: "agentpool", "kubernetes.azure.com/agentpool"
+ - Common:
+ - "hypershift.openshift.io/nodePool"
+ - "topology.ebs.csi.aws.com/zone"
+ - "topology.disk.csi.azure.com/zone"
+ - "ibm-cloud.kubernetes.io/worker-id"
+ - "vpc-block-csi-driver-labels"
+ These labels are added by default and do not need to be manually specified.
+ items:
+ maxLength: 317
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-validations:
+ - message: Each balancingIgnoredLabels item must be a valid label
+ key
+ rule: self.all(l, l.matches('^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?[a-zA-Z0-9]([a-zA-Z0-9_.-]{0,61}[a-zA-Z0-9])?$'))
+ expanders:
+ description: |-
+ expanders guide the autoscaler in choosing node groups during scale-out.
+ Sets the order of expanders for scaling out node groups.
+ Options include:
+ * LeastWaste - selects the group with minimal idle CPU and memory after scaling.
+ * Priority - selects the group with the highest user-defined priority.
+ * Random - selects a group randomly.
+ If not specified, `[Priority, LeastWaste]` is the default.
+ Maximum of 3 expanders can be specified.
+ items:
+ description: ExpanderString contains the name of an expander
+ to be used by the cluster autoscaler.
+ enum:
+ - LeastWaste
+ - Priority
+ - Random
+ type: string
+ maxItems: 3
+ minItems: 1
+ type: array
+ maxFreeDifferenceRatioPercent:
+ description: |-
+ maxFreeDifferenceRatioPercent sets the maximum difference ratio for free resources between similar node groups. This parameter controls how strict the similarity check is when comparing node groups for load balancing.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means node groups must have exactly the same free resources to be considered similar (no difference allowed).
+ When set to 100, this means node groups will be considered similar regardless of their free resource differences (any difference allowed).
+ A value between 0 and 100 represents the maximum allowed difference ratio for free resources between node groups to be considered similar.
+ When omitted, the autoscaler defaults to 10%.
+ This affects the "--max-free-difference-ratio" flag on cluster-autoscaler.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ maxNodeProvisionTime:
+ description: |-
+ maxNodeProvisionTime is the maximum time to wait for node provisioning
+ before considering the provisioning to be unsuccessful, expressed as a Go
+ duration string. The default is 15 minutes.
+ maxLength: 100
+ pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
+ type: string
+ maxNodesTotal:
+ description: |-
+ maxNodesTotal is the maximum allowable number of nodes for the Autoscaler scale out to be operational.
+ The autoscaler will not grow the cluster beyond this number.
+ If omitted, the autoscaler will not have a maximum limit.
+ number.
+ format: int32
+ minimum: 0
+ type: integer
+ maxPodGracePeriod:
+ description: |-
+ maxPodGracePeriod is the maximum seconds to wait for graceful pod
+ termination before scaling down a NodePool. The default is 600 seconds.
+ format: int32
+ minimum: 0
+ type: integer
+ podPriorityThreshold:
+ description: |-
+ podPriorityThreshold enables users to schedule "best-effort" pods, which
+ shouldn't trigger autoscaler actions, but only run when there are spare
+ resources available. The default is -10.
+
+ See the following for more details:
+ https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#how-does-cluster-autoscaler-work-with-pod-priority-and-preemption
+ format: int32
+ type: integer
+ scaleDown:
+ description: |-
+ scaleDown configures the behavior of the Cluster Autoscaler scale down operation.
+ This field is only valid when scaling is set to ScaleUpAndScaleDown.
+ properties:
+ delayAfterAddSeconds:
+ description: |-
+ delayAfterAddSeconds sets how long after scale up the scale down evaluation resumes in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after scale up, without any delay.
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterDeleteSeconds:
+ description: |-
+ delayAfterDeleteSeconds sets how long after node deletion, scale down evaluation resumes, defaults to scan-interval.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after node deletion, without any delay.
+ When omitted, the autoscaler defaults to 0s.
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterFailureSeconds:
+ description: |-
+ delayAfterFailureSeconds sets how long after a scale down failure, scale down evaluation resumes.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after a scale down failure, without any delay.
+ When omitted, the autoscaler defaults to 180s (3 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ unneededDurationSeconds:
+ description: |-
+ unneededDurationSeconds establishes how long a node should be unneeded before it is eligible for scale down in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ utilizationThresholdPercent:
+ description: |-
+ utilizationThresholdPercent determines the node utilization level, defined as sum of requested resources divided by capacity, below which a node can be considered for scale down.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means nodes will only be considered for scale down if they are completely idle (0% utilization).
+ When set to 100, this means nodes will be considered for scale down regardless of their utilization level.
+ A value between 0 and 100 represents the utilization threshold below which a node can be considered for scale down.
+ When omitted, the autoscaler defaults to 50%.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ type: object
+ scaling:
+ default: ScaleUpAndScaleDown
+ description: |-
+ scaling defines the scaling behavior for the cluster autoscaler.
+ ScaleUpOnly means the autoscaler will only scale up nodes, never scale down.
+ ScaleUpAndScaleDown means the autoscaler will both scale up and scale down nodes.
+ When set to ScaleUpAndScaleDown, the scaleDown field can be used to configure scale down behavior.
+
+ Note: This field is only supported in OpenShift versions 4.19 and above.
+ enum:
+ - ScaleUpOnly
+ - ScaleUpAndScaleDown
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: scaleDown can only be set when scaling is ScaleUpAndScaleDown
+ rule: 'self.scaling == ''ScaleUpAndScaleDown'' ? true : !has(self.scaleDown)'
+ capabilities:
+ default: {}
+ description: |-
+ capabilities allows for disabling optional components at cluster install time.
+ This field is optional and once set cannot be changed.
+ properties:
+ disabled:
+ description: |-
+ disabled when specified, explicitly disables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+
+ Note: Disabling 'openshift-samples','Insights', 'Console', 'NodeTuning', 'Ingress' are only supported in OpenShift versions 4.20 and above.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Disabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Ingress capability can only be disabled if Console
+ capability is also disabled
+ rule: '!self.exists(cap, cap == ''Ingress'') || self.exists(cap,
+ cap == ''Console'')'
+ enabled:
+ description: |-
+ enabled when specified, explicitly enables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Enabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Capabilities is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Capabilities can not be both enabled and disabled at once.
+ rule: 'has(self.enabled) && has(self.disabled) ? self.enabled.all(e,
+ !(e in self.disabled)) : true'
+ channel:
+ description: |-
+ channel is an identifier for explicitly requesting that a non-default
+ set of updates be applied to this cluster. The default channel will be
+ contain stable updates that are appropriate for production clusters.
+ maxLength: 255
+ type: string
+ clusterID:
+ description: |-
+ clusterID is the unique id that identifies the cluster externally.
+ Making it optional here allows us to keep compatibility with previous
+ versions of the control-plane-operator that have no knowledge of this
+ field.
+ maxLength: 255
+ type: string
+ configuration:
+ description: |-
+ configuration embeds resources that correspond to the openshift configuration API:
+ https://docs.openshift.com/container-platform/4.7/rest_api/config_apis/config-apis-index.html
+ properties:
+ apiServer:
+ description: |-
+ apiServer holds configuration (like serving certificates, client CA and CORS domains)
+ shared by all API servers in the system, among them especially kube-apiserver
+ and openshift-apiserver.
+ properties:
+ additionalCORSAllowedOrigins:
+ description: |-
+ additionalCORSAllowedOrigins lists additional, user-defined regular expressions describing hosts for which the
+ API server allows access using the CORS headers. This may be needed to access the API and the integrated OAuth
+ server from JavaScript applications.
+ The values are regular expressions that correspond to the Golang regular expression language.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ audit:
+ default:
+ profile: Default
+ description: |-
+ audit specifies the settings for audit configuration to be applied to all OpenShift-provided
+ API servers in the cluster.
+ properties:
+ customRules:
+ description: |-
+ customRules specify profiles per group. These profile take precedence over the
+ top-level profile field if they apply. They are evaluation from top to bottom and
+ the first one that matches, applies.
+ items:
+ description: |-
+ AuditCustomRule describes a custom rule for an audit profile that takes precedence over
+ the top-level profile.
+ properties:
+ group:
+ description: group is a name of group a request
+ user must be member of in order to this profile
+ to apply.
+ minLength: 1
+ type: string
+ profile:
+ description: |-
+ profile specifies the name of the desired audit policy configuration to be deployed to
+ all OpenShift-provided API servers in the cluster.
+
+ The following profiles are provided:
+ - Default: the existing default policy.
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ required:
+ - group
+ - profile
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - group
+ x-kubernetes-list-type: map
+ profile:
+ default: Default
+ description: |-
+ profile specifies the name of the desired top-level audit profile to be applied to all requests
+ sent to any of the OpenShift-provided API servers in the cluster (kube-apiserver,
+ openshift-apiserver and oauth-apiserver), with the exception of those requests that match
+ one or more of the customRules.
+
+ The following profiles are provided:
+ - Default: default policy which means MetaData level logging with the exception of events
+ (not logged at all), oauthaccesstokens and oauthauthorizetokens (both logged at RequestBody
+ level).
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ Warning: It is not recommended to disable audit logging by using the `None` profile unless you
+ are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues.
+ If you disable audit logging and a support situation arises, you might need to enable audit logging
+ and reproduce the issue in order to troubleshoot properly.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ type: object
+ clientCA:
+ description: |-
+ clientCA references a ConfigMap containing a certificate bundle for the signers that will be recognized for
+ incoming client certificates in addition to the operator managed signers. If this is empty, then only operator managed signers are valid.
+ You usually only have to set this if you have your own PKI you wish to honor client certificates from.
+ The ConfigMap must exist in the openshift-config namespace and contain the following required fields:
+ - ConfigMap.Data["ca-bundle.crt"] - CA bundle.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ encryption:
+ description: encryption allows the configuration of encryption
+ of resources at the datastore layer.
+ properties:
+ kms:
+ description: |-
+ kms defines the configuration for the external KMS instance that manages the encryption keys,
+ when KMS encryption is enabled sensitive resources will be encrypted using keys managed by an
+ externally configured KMS instance.
+
+ The Key Management Service (KMS) instance provides symmetric encryption and is responsible for
+ managing the lifecyle of the encryption keys outside of the control plane.
+ This allows integration with an external provider to manage the data encryption keys securely.
+ properties:
+ aws:
+ description: |-
+ aws defines the key config for using an AWS KMS instance
+ for the encryption. The AWS KMS instance is managed
+ by the user outside the purview of the control plane.
+ properties:
+ keyARN:
+ description: |-
+ keyARN specifies the Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
+ The value must adhere to the format `arn:aws:kms:::key/`, where:
+ - `` is the AWS region consisting of lowercase letters and hyphens followed by a number.
+ - `` is a 12-digit numeric identifier for the AWS account.
+ - `` is a unique identifier for the KMS key, consisting of lowercase hexadecimal characters and hyphens.
+ maxLength: 128
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: keyARN must follow the format `arn:aws:kms:::key/`.
+ The account ID must be a 12 digit number and
+ the region and key ID should consist only
+ of lowercase hexadecimal characters and hyphens
+ (-).
+ rule: self.matches('^arn:aws:kms:[a-z0-9-]+:[0-9]{12}:key/[a-f0-9-]+$')
+ region:
+ description: |-
+ region specifies the AWS region where the KMS instance exists, and follows the format
+ `--`, e.g.: `us-east-1`.
+ Only lowercase letters and hyphens followed by numbers are allowed.
+ maxLength: 64
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: region must be a valid AWS region,
+ consisting of lowercase characters, digits
+ and hyphens (-) only.
+ rule: self.matches('^[a-z0-9]+(-[a-z0-9]+)*$')
+ required:
+ - keyARN
+ - region
+ type: object
+ type:
+ description: |-
+ type defines the kind of platform for the KMS provider.
+ Available provider types are AWS only.
+ enum:
+ - AWS
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: aws config is required when kms provider type
+ is AWS, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws)
+ : !has(self.aws)'
+ type:
+ description: |-
+ type defines what encryption type should be used to encrypt resources at the datastore layer.
+ When this field is unset (i.e. when it is set to the empty string), identity is implied.
+ The behavior of unset can and will change over time. Even if encryption is enabled by default,
+ the meaning of unset may change to a different encryption type based on changes in best practices.
+
+ When encryption is enabled, all sensitive resources shipped with the platform are encrypted.
+ This list of sensitive resources can and will change over time. The current authoritative list is:
+
+ 1. secrets
+ 2. configmaps
+ 3. routes.route.openshift.io
+ 4. oauthaccesstokens.oauth.openshift.io
+ 5. oauthauthorizetokens.oauth.openshift.io
+ enum:
+ - ""
+ - identity
+ - aescbc
+ - aesgcm
+ - KMS
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: kms config is required when encryption type is
+ KMS, and forbidden otherwise
+ rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms)
+ : !has(self.kms)'
+ servingCerts:
+ description: |-
+ servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates
+ will be used for serving secure traffic.
+ properties:
+ namedCertificates:
+ description: |-
+ namedCertificates references secrets containing the TLS cert info for serving secure traffic to specific hostnames.
+ If no named certificates are provided, or no named certificates match the server name as understood by a client,
+ the defaultServingCertificate will be used.
+ items:
+ description: APIServerNamedServingCert maps a server
+ DNS name, as understood by a client, to a certificate.
+ properties:
+ names:
+ description: |-
+ names is a optional list of explicit DNS names (leading wildcards allowed) that should use this certificate to
+ serve secure traffic. If no names are provided, the implicit names will be extracted from the certificates.
+ Exact names trump over wildcard names. Explicit names defined here trump over extracted implicit names.
+ items:
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-list-type: atomic
+ servingCertificate:
+ description: |-
+ servingCertificate references a kubernetes.io/tls type secret containing the TLS cert info for serving secure traffic.
+ The secret must exist in the openshift-config namespace and contain the following required fields:
+ - Secret.Data["tls.key"] - TLS private key.
+ - Secret.Data["tls.crt"] - TLS certificate.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ tlsSecurityProfile:
+ description: |-
+ tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
+
+ If unset, a default (which may change between releases) is chosen. Note that only Old,
+ Intermediate and Custom profiles are currently supported, and the maximum available
+ minTLSVersion is VersionTLS12.
+ properties:
+ custom:
+ description: |-
+ custom is a user-defined TLS security profile. Be extremely careful using a custom
+ profile as invalid configurations can be catastrophic. An example custom profile
+ looks like this:
+
+ ciphers:
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ minTLSVersion: VersionTLS11
+ nullable: true
+ properties:
+ ciphers:
+ description: |-
+ ciphers is used to specify the cipher algorithms that are negotiated
+ during the TLS handshake. Operators may remove entries their operands
+ do not support. For example, to use DES-CBC3-SHA (yaml):
+
+ ciphers:
+ - DES-CBC3-SHA
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ minTLSVersion:
+ description: |-
+ minTLSVersion is used to specify the minimal version of the TLS protocol
+ that is negotiated during the TLS handshake. For example, to use TLS
+ versions 1.1, 1.2 and 1.3 (yaml):
+
+ minTLSVersion: VersionTLS11
+
+ NOTE: currently the highest minTLSVersion allowed is VersionTLS12
+ enum:
+ - VersionTLS10
+ - VersionTLS11
+ - VersionTLS12
+ - VersionTLS13
+ type: string
+ type: object
+ intermediate:
+ description: |-
+ intermediate is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ minTLSVersion: VersionTLS12
+ nullable: true
+ type: object
+ modern:
+ description: |-
+ modern is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ minTLSVersion: VersionTLS13
+ nullable: true
+ type: object
+ old:
+ description: |-
+ old is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ - DHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-ECDSA-AES128-SHA256
+
+ - ECDHE-RSA-AES128-SHA256
+
+ - ECDHE-ECDSA-AES128-SHA
+
+ - ECDHE-RSA-AES128-SHA
+
+ - ECDHE-ECDSA-AES256-SHA384
+
+ - ECDHE-RSA-AES256-SHA384
+
+ - ECDHE-ECDSA-AES256-SHA
+
+ - ECDHE-RSA-AES256-SHA
+
+ - DHE-RSA-AES128-SHA256
+
+ - DHE-RSA-AES256-SHA256
+
+ - AES128-GCM-SHA256
+
+ - AES256-GCM-SHA384
+
+ - AES128-SHA256
+
+ - AES256-SHA256
+
+ - AES128-SHA
+
+ - AES256-SHA
+
+ - DES-CBC3-SHA
+
+ minTLSVersion: VersionTLS10
+ nullable: true
+ type: object
+ type:
+ description: |-
+ type is one of Old, Intermediate, Modern or Custom. Custom provides
+ the ability to specify individual TLS security profile parameters.
+ Old, Intermediate and Modern are TLS security profiles based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
+
+ The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers
+ are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be
+ reduced.
+
+ Note that the Modern profile is currently not supported because it is not
+ yet well adopted by common software libraries.
+ enum:
+ - Old
+ - Intermediate
+ - Modern
+ - Custom
+ type: string
+ type: object
+ type: object
+ authentication:
+ description: |-
+ authentication specifies cluster-wide settings for authentication (like OAuth and
+ webhook token authenticators).
+ properties:
+ oauthMetadata:
+ description: |-
+ oauthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for an external OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ If oauthMetadata.name is non-empty, this value has precedence
+ over any metadata reference stored in status.
+ The key "oauthMetadata" is used to locate the data.
+ If specified and the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcProviders:
+ description: |-
+ oidcProviders are OIDC identity providers that can issue tokens
+ for this cluster
+ Can only be set if "Type" is set to "OIDC".
+
+ At most one provider can be configured.
+ items:
+ properties:
+ claimMappings:
+ description: |-
+ claimMappings is an optional field that configures the rules to be used by
+ the Kubernetes API server for translating claims in a JWT token, issued
+ by the identity provider, to a cluster identity.
+ properties:
+ extra:
+ description: |-
+ extra is an optional field for configuring the mappings
+ used to construct the extra attribute for the cluster identity.
+ When omitted, no extra attributes will be present on the cluster identity.
+ key values for extra mappings must be unique.
+ A maximum of 64 extra attribute mappings may be provided.
+ items:
+ description: |-
+ ExtraMapping allows specifying a key and CEL expression
+ to evaluate the keys' value. It is used to create additional
+ mappings and attributes added to a cluster identity from
+ a provided authentication token.
+ properties:
+ key:
+ description: |-
+ key is a required field that specifies the string
+ to use as the extra attribute key.
+
+ key must be a domain-prefix path (e.g 'example.org/foo').
+ key must not exceed 510 characters in length.
+ key must contain the '/' character, separating the domain and path characters.
+ key must not be empty.
+
+ The domain portion of the key (string of characters prior to the '/') must be a valid RFC1123 subdomain.
+ It must not exceed 253 characters in length.
+ It must start and end with an alphanumeric character.
+ It must only contain lower case alphanumeric characters and '-' or '.'.
+ It must not use the reserved domains, or be subdomains of, "kubernetes.io", "k8s.io", and "openshift.io".
+
+ The path portion of the key (string of characters after the '/') must not be empty and must consist of at least one
+ alphanumeric character, percent-encoded octets, '-', '.', '_', '~', '!', '$', '&', ''', '(', ')', '*', '+', ',', ';', '=', and ':'.
+ It must not exceed 256 characters in length.
+ maxLength: 510
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: key must contain the '/' character
+ rule: self.contains('/')
+ - message: the domain of the key must consist
+ of only lower case alphanumeric characters,
+ '-' or '.', and must start and end with
+ an alphanumeric character
+ rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
+ - message: the domain of the key must not
+ exceed 253 characters in length
+ rule: self.split('/', 2)[0].size() <= 253
+ - message: the domain 'kubernetes.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'kubernetes.io'
+ - message: the subdomains '*.kubernetes.io'
+ are reserved for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
+ - message: the domain 'k8s.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'k8s.io'
+ - message: the subdomains '*.k8s.io' are reserved
+ for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
+ - message: the domain 'openshift.io' is reserved
+ for OpenShift use
+ rule: self.split('/', 2)[0] != 'openshift.io'
+ - message: the subdomains '*.openshift.io'
+ are reserved for OpenShift use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
+ - message: the path of the key must not be
+ empty and must consist of at least one
+ alphanumeric character, percent-encoded
+ octets, apostrophe, '-', '.', '_', '~',
+ '!', '$', '&', '(', ')', '*', '+', ',',
+ ';', '=', and ':'
+ rule: self.split('/', 2)[1].matches('[A-Za-z0-9/\\-._~%!$&\'()*+;=:]+')
+ - message: the path of the key must not exceed
+ 256 characters in length
+ rule: self.split('/', 2)[1].size() <= 256
+ valueExpression:
+ description: |-
+ valueExpression is a required field to specify the CEL expression to extract
+ the extra attribute value from a JWT token's claims.
+ valueExpression must produce a string or string array value.
+ "", [], and null are treated as the extra mapping not being present.
+ Empty string values within an array are filtered out.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ valueExpression must not exceed 4096 characters in length.
+ valueExpression must not be empty.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ required:
+ - key
+ - valueExpression
+ type: object
+ maxItems: 64
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ groups:
+ description: |-
+ groups is an optional field that configures how the groups of a cluster identity
+ should be constructed from the claims in a JWT token issued
+ by the identity provider.
+ When referencing a claim, if the claim is present in the JWT
+ token, its value must be a list of groups separated by a comma (',').
+ For example - '"example"' and '"exampleOne", "exampleTwo", "exampleThree"' are valid claim values.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix is an optional field that configures the prefix that will be
+ applied to the cluster identity attribute during the process of mapping
+ JWT claims to cluster identity attributes.
+
+ When omitted (""), no prefix is applied to the cluster identity attribute.
+
+ Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains
+ an array of strings "a", "b" and "c", the mapping will result in an
+ array of string "myoidc:a", "myoidc:b" and "myoidc:c".
+ type: string
+ required:
+ - claim
+ type: object
+ uid:
+ description: |-
+ uid is an optional field for configuring the claim mapping
+ used to construct the uid for the cluster identity.
+
+ When using uid.claim to specify the claim it must be a single string value.
+ When using uid.expression the expression must result in a single string value.
+
+ When omitted, this means the user has no opinion and the platform
+ is left to choose a default, which is subject to change over time.
+ The current default is to use the 'sub' claim.
+ properties:
+ claim:
+ description: |-
+ claim is an optional field for specifying the
+ JWT token claim that is used in the mapping.
+ The value of this claim will be assigned to
+ the field in which this mapping is associated.
+
+ Precisely one of claim or expression must be set.
+ claim must not be specified when expression is set.
+ When specified, claim must be at least 1 character in length
+ and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ expression:
+ description: |-
+ expression is an optional field for specifying a
+ CEL expression that produces a string value from
+ JWT token claims.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ Precisely one of claim or expression must be set.
+ expression must not be specified when claim is set.
+ When specified, expression must be at least 1 character in length
+ and must not exceed 4096 characters in length.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: precisely one of claim or expression
+ must be set
+ rule: 'has(self.claim) ? !has(self.expression)
+ : has(self.expression)'
+ username:
+ description: |-
+ username is an optional field that configures how the username of a cluster identity
+ should be constructed from the claims in a JWT token issued by the identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix configures the prefix that should be prepended to the value
+ of the JWT claim.
+
+ prefix must be set when prefixPolicy is set to 'Prefix' and must be unset otherwise.
+ properties:
+ prefixString:
+ description: |-
+ prefixString is a required field that configures the prefix that will
+ be applied to cluster identity username attribute
+ during the process of mapping JWT claims to cluster identity attributes.
+
+ prefixString must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - prefixString
+ type: object
+ prefixPolicy:
+ description: |-
+ prefixPolicy is an optional field that configures how a prefix should be
+ applied to the value of the JWT claim specified in the 'claim' field.
+
+ Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
+
+ When set to 'Prefix', the value specified in the prefix field will be
+ prepended to the value of the JWT claim.
+ The prefix field must be set when prefixPolicy is 'Prefix'.
+
+ When set to 'NoPrefix', no prefix will be prepended to the value
+ of the JWT claim.
+
+ When omitted, this means no opinion and the platform is left to choose
+ any prefixes that are applied which is subject to change over time.
+ Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim
+ when the claim is not 'email'.
+ As an example, consider the following scenario:
+ `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
+ the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
+ and `claim` is set to:
+ - "username": the mapped value will be "https://myoidc.tld#userA"
+ - "email": the mapped value will be "userA@myoidc.tld"
+ enum:
+ - ""
+ - NoPrefix
+ - Prefix
+ type: string
+ required:
+ - claim
+ type: object
+ x-kubernetes-validations:
+ - message: prefix must be set if prefixPolicy is
+ 'Prefix', but must remain unset otherwise
+ rule: 'has(self.prefixPolicy) && self.prefixPolicy
+ == ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
+ > 0) : !has(self.prefix)'
+ type: object
+ claimValidationRules:
+ description: |-
+ claimValidationRules is an optional field that configures the rules to
+ be used by the Kubernetes API server for validating the claims in a JWT
+ token issued by the identity provider.
+
+ Validation rules are joined via an AND operation.
+ items:
+ properties:
+ requiredClaim:
+ description: |-
+ requiredClaim is an optional field that configures the required claim
+ and value that the Kubernetes API server will use to validate if an incoming
+ JWT is valid for this identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the name of the required claim.
+ When taken from the JWT claims, claim must be a string value.
+
+ claim must not be an empty string ("").
+ minLength: 1
+ type: string
+ requiredValue:
+ description: |-
+ requiredValue is a required field that configures the value that 'claim' must
+ have when taken from the incoming JWT claims.
+ If the value in the JWT claims does not match, the token
+ will be rejected for authentication.
+
+ requiredValue must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - claim
+ - requiredValue
+ type: object
+ type:
+ default: RequiredClaim
+ description: |-
+ type is an optional field that configures the type of the validation rule.
+
+ Allowed values are 'RequiredClaim' and omitted (not provided or an empty string).
+
+ When set to 'RequiredClaim', the Kubernetes API server
+ will be configured to validate that the incoming JWT
+ contains the required claim and that its value matches
+ the required value.
+
+ Defaults to 'RequiredClaim'.
+ enum:
+ - RequiredClaim
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ issuer:
+ description: |-
+ issuer is a required field that configures how the platform interacts
+ with the identity provider and how tokens issued from the identity provider
+ are evaluated by the Kubernetes API server.
+ properties:
+ audiences:
+ description: |-
+ audiences is a required field that configures the acceptable audiences
+ the JWT token, issued by the identity provider, must be issued to.
+ At least one of the entries must match the 'aud' claim in the JWT token.
+
+ audiences must contain at least one entry and must not exceed ten entries.
+ items:
+ minLength: 1
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ issuerCertificateAuthority:
+ description: |-
+ issuerCertificateAuthority is an optional field that configures the
+ certificate authority, used by the Kubernetes API server, to validate
+ the connection to the identity provider when fetching discovery information.
+
+ When not specified, the system trust is used.
+
+ When specified, it must reference a ConfigMap in the openshift-config
+ namespace containing the PEM-encoded CA certificates under the 'ca-bundle.crt'
+ key in the data field of the ConfigMap.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ issuerURL:
+ description: |-
+ issuerURL is a required field that configures the URL used to issue tokens
+ by the identity provider.
+ The Kubernetes API server determines how authentication tokens should be handled
+ by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ required:
+ - audiences
+ - issuerURL
+ type: object
+ name:
+ description: |-
+ name is a required field that configures the unique human-readable identifier
+ associated with the identity provider.
+ It is used to distinguish between multiple identity providers
+ and has no impact on token validation or authentication mechanics.
+
+ name must not be an empty string ("").
+ minLength: 1
+ type: string
+ oidcClients:
+ description: |-
+ oidcClients is an optional field that configures how on-cluster,
+ platform clients should request tokens from the identity provider.
+ oidcClients must not exceed 20 entries and entries must have unique namespace/name pairs.
+ items:
+ description: |-
+ OIDCClientConfig configures how platform clients
+ interact with identity providers as an authentication
+ method
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that configures the client identifier, from
+ the identity provider, that the platform component uses for authentication
+ requests made to the identity provider.
+ The identity provider must accept this identifier for platform components
+ to be able to use the identity provider as an authentication mode.
+
+ clientID must not be an empty string ("").
+ minLength: 1
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is an optional field that configures the client secret used
+ by the platform component when making authentication requests to the identity provider.
+
+ When not specified, no client secret will be used when making authentication requests
+ to the identity provider.
+
+ When specified, clientSecret references a Secret in the 'openshift-config'
+ namespace that contains the client secret in the 'clientSecret' key of the '.data' field.
+ The client secret will be used when making authentication requests to the identity provider.
+
+ Public clients do not require a client secret but private
+ clients do require a client secret to work with the identity provider.
+ properties:
+ name:
+ description: name is the metadata.name of
+ the referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component being configured to use the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component being configured to use the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ extraScopes:
+ description: |-
+ extraScopes is an optional field that configures the extra scopes that should
+ be requested by the platform component when making authentication requests to the
+ identity provider.
+ This is useful if you have configured claim mappings that requires specific
+ scopes to be requested beyond the standard OIDC scopes.
+
+ When omitted, no additional scopes are requested.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - clientID
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ required:
+ - issuer
+ - name
+ type: object
+ maxItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ serviceAccountIssuer:
+ description: |-
+ serviceAccountIssuer is the identifier of the bound service account token
+ issuer.
+ The default is https://kubernetes.default.svc
+ WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
+ previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
+ be trusted for a time period chosen by the platform (currently set to 24h).
+ This time period is subject to change over time.
+ This allows internal components to transition to use new service account issuer without service distruption.
+ type: string
+ type:
+ description: |-
+ type identifies the cluster managed, user facing authentication mode in use.
+ Specifically, it manages the component that responds to login attempts.
+ The default is IntegratedOAuth.
+ enum:
+ - ""
+ - None
+ - IntegratedOAuth
+ - OIDC
+ type: string
+ webhookTokenAuthenticator:
+ description: |-
+ webhookTokenAuthenticator configures a remote token reviewer.
+ These remote authentication webhooks can be used to verify bearer tokens
+ via the tokenreviews.authentication.k8s.io REST API. This is required to
+ honor bearer tokens that are provisioned by an external authentication service.
+
+ Can only be set if "Type" is set to "None".
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig references a secret that contains kube config file data which
+ describes how to access the remote webhook service.
+ The namespace for the referenced secret is openshift-config.
+
+ For further details, see:
+
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - kubeConfig
+ type: object
+ webhookTokenAuthenticators:
+ description: webhookTokenAuthenticators is DEPRECATED, setting
+ it has no effect.
+ items:
+ description: |-
+ deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
+ It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig contains kube config file data which describes how to access the remote webhook service.
+ For further details, see:
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ The namespace for this secret is determined by the point of use.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ featureGate:
+ description: featureGate holds cluster-wide information about
+ feature gates.
+ properties:
+ customNoUpgrade:
+ description: |-
+ customNoUpgrade allows the enabling or disabling of any feature. Turning this feature set on IS NOT SUPPORTED, CANNOT BE UNDONE, and PREVENTS UPGRADES.
+ Because of its nature, this setting cannot be validated. If you have any typos or accidentally apply invalid combinations
+ your cluster may fail in an unrecoverable way. featureSet must equal "CustomNoUpgrade" must be set to use this field.
+ nullable: true
+ properties:
+ disabled:
+ description: disabled is a list of all feature gates that
+ you want to force off
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ enabled:
+ description: enabled is a list of all feature gates that
+ you want to force on
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ type: object
+ featureSet:
+ description: |-
+ featureSet changes the list of features in the cluster. The default is empty. Be very careful adjusting this setting.
+ Turning on or off features may cause irreversible changes in your cluster which cannot be undone.
+ enum:
+ - CustomNoUpgrade
+ - DevPreviewNoUpgrade
+ - TechPreviewNoUpgrade
+ - ""
+ type: string
+ x-kubernetes-validations:
+ - message: CustomNoUpgrade may not be changed
+ rule: 'oldSelf == ''CustomNoUpgrade'' ? self == ''CustomNoUpgrade''
+ : true'
+ - message: TechPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''TechPreviewNoUpgrade'' ? self == ''TechPreviewNoUpgrade''
+ : true'
+ - message: DevPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''DevPreviewNoUpgrade'' ? self == ''DevPreviewNoUpgrade''
+ : true'
+ type: object
+ image:
+ description: |-
+ image governs policies related to imagestream imports and runtime configuration
+ for external registries. It allows cluster admins to configure which registries
+ OpenShift is allowed to import images from, extra CA trust bundles for external
+ registries, and policies to block or allow registry hostnames.
+ When exposing OpenShift's image registry to the public, this also lets cluster
+ admins specify the external hostname.
+ This input will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ additionalTrustedCA:
+ description: |-
+ additionalTrustedCA is a reference to a ConfigMap containing additional CAs that
+ should be trusted during imagestream import, pod image pull, build image pull, and
+ imageregistry pullthrough.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ allowedRegistriesForImport:
+ description: |-
+ allowedRegistriesForImport limits the container image registries that normal users may import
+ images from. Set this list to the registries that you trust to contain valid Docker
+ images and that you want applications to be able to import from. Users with
+ permission to create Images or ImageStreamMappings via the API are not affected by
+ this policy - typically only administrators or system integrations will have those
+ permissions.
+ items:
+ description: |-
+ RegistryLocation contains a location of the registry specified by the registry domain
+ name. The domain name might include wildcards, like '*' or '??'.
+ properties:
+ domainName:
+ description: |-
+ domainName specifies a domain name for the registry
+ In case the registry use non-standard (80 or 443) port, the port should be included
+ in the domain name as well.
+ type: string
+ insecure:
+ description: |-
+ insecure indicates whether the registry is secure (https) or insecure (http)
+ By default (if not specified) the registry is assumed as secure.
+ type: boolean
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalRegistryHostnames:
+ description: |-
+ externalRegistryHostnames provides the hostnames for the default external image
+ registry. The external hostname should be set only when the image registry
+ is exposed externally. The first value is used in 'publicDockerImageRepository'
+ field in ImageStreams. The value must be in "hostname[:port]" format.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ imageStreamImportMode:
+ description: |-
+ imageStreamImportMode controls the import mode behaviour of imagestreams.
+ It can be set to `Legacy` or `PreserveOriginal` or the empty string. If this value
+ is specified, this setting is applied to all newly created imagestreams which do not have the
+ value set. `Legacy` indicates that the legacy behaviour should be used.
+ For manifest lists, the legacy behaviour will discard the manifest list and import a single
+ sub-manifest. In this case, the platform is chosen in the following order of priority:
+ 1. tag annotations; 2. control plane arch/os; 3. linux/amd64; 4. the first manifest in the list.
+ `PreserveOriginal` indicates that the original manifest will be preserved. For manifest lists,
+ the manifest list and all its sub-manifests will be imported. When empty, the behaviour will be
+ decided based on the payload type advertised by the ClusterVersion status, i.e single arch payload
+ implies the import mode is Legacy and multi payload implies PreserveOriginal.
+ enum:
+ - ""
+ - Legacy
+ - PreserveOriginal
+ type: string
+ registrySources:
+ description: |-
+ registrySources contains configuration that determines how the container runtime
+ should treat individual registries when accessing images for builds+pods. (e.g.
+ whether or not to allow insecure access). It does not contain configuration for the
+ internal cluster registry.
+ properties:
+ allowedRegistries:
+ description: |-
+ allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ blockedRegistries:
+ description: |-
+ blockedRegistries cannot be used for image pull and push actions. All other registries are permitted.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ containerRuntimeSearchRegistries:
+ description: |-
+ containerRuntimeSearchRegistries are registries that will be searched when pulling images that do not have fully qualified
+ domains in their pull specs. Registries will be searched in the order provided in the list.
+ Note: this search list only works with the container runtime, i.e CRI-O. Will NOT work with builds or imagestream imports.
+ format: hostname
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ insecureRegistries:
+ description: insecureRegistries are registries which do
+ not have a valid TLS certificates or only support HTTP
+ connections.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-validations:
+ - message: Only one of blockedRegistries or allowedRegistries
+ may be set
+ rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
+ : true'
+ type: object
+ ingress:
+ description: |-
+ ingress holds cluster-wide information about ingress, including the default ingress domain
+ used for routes.
+ properties:
+ appsDomain:
+ description: |-
+ appsDomain is an optional domain to use instead of the one specified
+ in the domain field when a Route is created without specifying an explicit
+ host. If appsDomain is nonempty, this value is used to generate default
+ host values for Route. Unlike domain, appsDomain may be modified after
+ installation.
+ This assumes a new ingresscontroller has been setup with a wildcard
+ certificate.
+ type: string
+ componentRoutes:
+ description: |-
+ componentRoutes is an optional list of routes that are managed by OpenShift components
+ that a cluster-admin is able to configure the hostname and serving certificate for.
+ The namespace and name of each route in this list should match an existing entry in the
+ status.componentRoutes list.
+
+ To determine the set of configurable Routes, look at namespace and name of entries in the
+ .status.componentRoutes list, where participating operators write the status of
+ configurable routes.
+ items:
+ description: ComponentRouteSpec allows for configuration
+ of a route's hostname and serving certificate.
+ properties:
+ hostname:
+ description: hostname is the hostname that should be
+ used by the route.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ servingCertKeyPairSecret:
+ description: |-
+ servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
+ The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
+ If the custom hostname uses the default routing suffix of the cluster,
+ the Secret specification for a serving certificate will not be needed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - hostname
+ - name
+ - namespace
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ domain:
+ description: |-
+ domain is used to generate a default host name for a route when the
+ route's host name is empty. The generated host name will follow this
+ pattern: "..".
+
+ It is also used as the default wildcard domain suffix for ingress. The
+ default ingresscontroller domain will follow this pattern: "*.".
+
+ Once set, changing domain is not currently supported.
+ type: string
+ loadBalancer:
+ description: |-
+ loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
+ provider of the current cluster and are required for Ingress Controller to work on OpenShift.
+ properties:
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for the ingress load balancers.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains settings specific to the
+ Amazon Web Services infrastructure provider.
+ properties:
+ type:
+ description: |-
+ type allows user to set a load balancer type.
+ When this field is set the default ingresscontroller will get created using the specified LBType.
+ If this field is not set then the default ingress controller of LBType Classic will be created.
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - NLB
+ - Classic
+ type: string
+ required:
+ - type
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
+ "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
+ and must handle unrecognized platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ type: object
+ type: object
+ requiredHSTSPolicies:
+ description: |-
+ requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
+ matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
+ Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
+ annotation, and affect route admission.
+
+ A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
+ "haproxy.router.openshift.io/hsts_header"
+ E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
+
+ - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
+ is rejected.
+ - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
+ determines the route's admission status.
+ - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then it may use any HSTS Policy annotation.
+
+ The HSTS policy configuration may be changed after routes have already been created. An update to a previously
+ admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
+ However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
+
+ Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
+ items:
+ properties:
+ domainPatterns:
+ description: |-
+ domainPatterns is a list of domains for which the desired HSTS annotations are required.
+ If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
+ the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
+
+ The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
+ foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ includeSubDomainsPolicy:
+ description: |-
+ includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
+ domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
+ - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ enum:
+ - RequireIncludeSubDomains
+ - RequireNoIncludeSubDomains
+ - NoOpinion
+ type: string
+ maxAge:
+ description: |-
+ maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
+ If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
+ If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
+ maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
+ policy will eventually expire on that client.
+ properties:
+ largestMaxAge:
+ description: |-
+ The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ This value can be left unspecified, in which case no upper limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ smallestMaxAge:
+ description: |-
+ The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
+ tool for administrators to quickly correct mistakes.
+ This value can be left unspecified, in which case no lower limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ type: object
+ namespaceSelector:
+ description: |-
+ namespaceSelector specifies a label selector such that the policy applies only to those routes that
+ are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
+ Defaults to the empty LabelSelector, which matches everything.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label
+ selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the
+ selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ preloadPolicy:
+ description: |-
+ preloadPolicy directs the client to include hosts in its host preload list so that
+ it never needs to do an initial load to get the HSTS header (note that this is not defined
+ in RFC 6797 and is therefore client implementation-dependent).
+ enum:
+ - RequirePreload
+ - RequireNoPreload
+ - NoOpinion
+ type: string
+ required:
+ - domainPatterns
+ type: object
+ type: array
+ type: object
+ network:
+ description: |-
+ network holds cluster-wide information about the network. It is used to configure the desired network configuration, such as: IP address pools for services/pod IPs, network plugin, etc.
+ Please view network.spec for an explanation on what applies when configuring this resource.
+ properties:
+ clusterNetwork:
+ description: |-
+ IP address pool to use for pod IPs.
+ This field is immutable after installation.
+ items:
+ description: |-
+ ClusterNetworkEntry is a contiguous block of IP addresses from which pod IPs
+ are allocated.
+ properties:
+ cidr:
+ description: The complete block for pod IPs.
+ type: string
+ hostPrefix:
+ description: |-
+ The size (prefix) of block to allocate to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalIP:
+ description: |-
+ externalIP defines configuration for controllers that
+ affect Service.ExternalIP. If nil, then ExternalIP is
+ not allowed to be set.
+ properties:
+ autoAssignCIDRs:
+ description: |-
+ autoAssignCIDRs is a list of CIDRs from which to automatically assign
+ Service.ExternalIP. These are assigned when the service is of type
+ LoadBalancer. In general, this is only useful for bare-metal clusters.
+ In Openshift 3.x, this was misleadingly called "IngressIPs".
+ Automatically assigned External IPs are not affected by any
+ ExternalIPPolicy rules.
+ Currently, only one entry may be provided.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ policy:
+ description: |-
+ policy is a set of restrictions applied to the ExternalIP field.
+ If nil or empty, then ExternalIP is not allowed to be set.
+ properties:
+ allowedCIDRs:
+ description: allowedCIDRs is the list of allowed CIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ rejectedCIDRs:
+ description: |-
+ rejectedCIDRs is the list of disallowed CIDRs. These take precedence
+ over allowedCIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkDiagnostics:
+ description: |-
+ networkDiagnostics defines network diagnostics configuration.
+
+ Takes precedence over spec.disableNetworkDiagnostics in network.operator.openshift.io.
+ If networkDiagnostics is not specified or is empty,
+ and the spec.disableNetworkDiagnostics flag in network.operator.openshift.io is set to true,
+ the network diagnostics feature will be disabled.
+ properties:
+ mode:
+ description: |-
+ mode controls the network diagnostics mode
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is All.
+ enum:
+ - ""
+ - All
+ - Disabled
+ type: string
+ sourcePlacement:
+ description: |-
+ sourcePlacement controls the scheduling of network diagnostics source deployment
+
+ See NetworkDiagnosticsSourcePlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is an empty list.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ targetPlacement:
+ description: |-
+ targetPlacement controls the scheduling of network diagnostics target daemonset
+
+ See NetworkDiagnosticsTargetPlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `- operator: "Exists"` which means that all taints are tolerated.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkType:
+ description: |-
+ networkType is the plugin that is to be deployed (e.g. OVNKubernetes).
+ This should match a value that the cluster-network-operator understands,
+ or else no networking will be installed.
+ Currently supported values are:
+ - OVNKubernetes
+ This field is immutable after installation.
+ type: string
+ serviceNetwork:
+ description: |-
+ IP address pool for services.
+ Currently, we only support a single entry here.
+ This field is immutable after installation.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceNodePortRange:
+ description: |-
+ The port range allowed for Services of type NodePort.
+ If not specified, the default of 30000-32767 will be used.
+ Such Services without a NodePort specified will have one
+ automatically allocated from this range.
+ This parameter can be updated after the cluster is
+ installed.
+ pattern: ^([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])-([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot set networkDiagnostics.sourcePlacement and networkDiagnostics.targetPlacement
+ when networkDiagnostics.mode is Disabled
+ rule: '!has(self.networkDiagnostics) || !has(self.networkDiagnostics.mode)
+ || self.networkDiagnostics.mode!=''Disabled'' || !has(self.networkDiagnostics.sourcePlacement)
+ && !has(self.networkDiagnostics.targetPlacement)'
+ oauth:
+ description: |-
+ oauth holds cluster-wide information about OAuth.
+ It is used to configure the integrated OAuth server.
+ This configuration is only honored when the top level Authentication config has type set to IntegratedOAuth.
+ properties:
+ identityProviders:
+ description: |-
+ identityProviders is an ordered list of ways for a user to identify themselves.
+ When this list is empty, no identities are provisioned for users.
+ items:
+ description: IdentityProvider provides identities for users
+ authenticating using credentials
+ properties:
+ basicAuth:
+ description: basicAuth contains configuration options
+ for the BasicAuth IdP
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ github:
+ description: github enables user authentication using
+ GitHub credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ This can only be configured when hostname is set to a non-empty value.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostname:
+ description: |-
+ hostname is the optional domain (e.g. "mycompany.com") for use with a hosted instance of
+ GitHub Enterprise.
+ It must match the GitHub Enterprise settings value configured at /setup/settings#hostname.
+ type: string
+ organizations:
+ description: organizations optionally restricts
+ which organizations are allowed to log in
+ items:
+ type: string
+ type: array
+ teams:
+ description: teams optionally restricts which teams
+ are allowed to log in. Format is /.
+ items:
+ type: string
+ type: array
+ type: object
+ gitlab:
+ description: gitlab enables user authentication using
+ GitLab credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the oauth server base URL
+ type: string
+ type: object
+ google:
+ description: google enables user authentication using
+ Google credentials
+ properties:
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostedDomain:
+ description: hostedDomain is the optional Google
+ App domain (e.g. "mycompany.com") to restrict
+ logins to
+ type: string
+ type: object
+ htpasswd:
+ description: htpasswd enables user authentication using
+ an HTPasswd file to validate credentials
+ properties:
+ fileData:
+ description: |-
+ fileData is a required reference to a secret by name containing the data to use as the htpasswd file.
+ The key "htpasswd" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ If the specified htpasswd data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ keystone:
+ description: keystone enables user authentication using
+ keystone password credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ domainName:
+ description: domainName is required for keystone
+ v3
+ type: string
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ ldap:
+ description: ldap enables user authentication using
+ LDAP credentials
+ properties:
+ attributes:
+ description: attributes maps LDAP attributes to
+ identities
+ properties:
+ email:
+ description: |-
+ email is the list of attributes whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ id:
+ description: |-
+ id is the list of attributes whose values should be used as the user ID. Required.
+ First non-empty attribute is used. At least one attribute is required. If none of the listed
+ attribute have a value, authentication fails.
+ LDAP standard identity attribute is "dn"
+ items:
+ type: string
+ type: array
+ name:
+ description: |-
+ name is the list of attributes whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ LDAP standard display name attribute is "cn"
+ items:
+ type: string
+ type: array
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of attributes whose values should be used as the preferred username.
+ LDAP standard login attribute is "uid"
+ items:
+ type: string
+ type: array
+ type: object
+ bindDN:
+ description: bindDN is an optional DN to bind with
+ during the search phase.
+ type: string
+ bindPassword:
+ description: |-
+ bindPassword is an optional reference to a secret by name
+ containing a password to bind with during the search phase.
+ The key "bindPassword" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ insecure:
+ description: |-
+ insecure, if true, indicates the connection should not use TLS
+ WARNING: Should not be set to `true` with the URL scheme "ldaps://" as "ldaps://" URLs always
+ attempt to connect using TLS, even when `insecure` is set to `true`
+ When `true`, "ldap://" URLS connect insecurely. When `false`, "ldap://" URLs are upgraded to
+ a TLS connection using StartTLS as specified in https://tools.ietf.org/html/rfc2830.
+ type: boolean
+ url:
+ description: |-
+ url is an RFC 2255 URL which specifies the LDAP search parameters to use.
+ The syntax of the URL is:
+ ldap://host:port/basedn?attribute?scope?filter
+ type: string
+ type: object
+ mappingMethod:
+ description: |-
+ mappingMethod determines how identities from this provider are mapped to users
+ Defaults to "claim"
+ type: string
+ name:
+ description: |-
+ name is used to qualify the identities returned by this provider.
+ - It MUST be unique and not shared by any other identity provider used
+ - It MUST be a valid path segment: name cannot equal "." or ".." or contain "/" or "%" or ":"
+ Ref: https://godoc.org/github.com/openshift/origin/pkg/user/apis/user/validation#ValidateIdentityProviderName
+ type: string
+ openID:
+ description: openID enables user authentication using
+ OpenID credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ claims:
+ description: claims mappings
+ properties:
+ email:
+ description: |-
+ email is the list of claims whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ groups:
+ description: |-
+ groups is the list of claims value of which should be used to synchronize groups
+ from the OIDC provider to OpenShift for the user.
+ If multiple claims are specified, the first one with a non-empty value is used.
+ items:
+ description: |-
+ OpenIDClaim represents a claim retrieved from an OpenID provider's tokens or userInfo
+ responses
+ minLength: 1
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: |-
+ name is the list of claims whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of claims whose values should be used as the preferred username.
+ If unspecified, the preferred username is determined from the value of the sub claim
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ extraAuthorizeParameters:
+ additionalProperties:
+ type: string
+ description: extraAuthorizeParameters are any custom
+ parameters to add to the authorize request.
+ type: object
+ extraScopes:
+ description: extraScopes are any scopes to request
+ in addition to the standard "openid" scope.
+ items:
+ type: string
+ type: array
+ issuer:
+ description: |-
+ issuer is the URL that the OpenID Provider asserts as its Issuer Identifier.
+ It must use the https scheme with no query or fragment component.
+ type: string
+ type: object
+ requestHeader:
+ description: requestHeader enables user authentication
+ using request header credentials
+ properties:
+ ca:
+ description: |-
+ ca is a required reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ Specifically, it allows verification of incoming requests to prevent header spoofing.
+ The key "ca.crt" is used to locate the data.
+ If the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ challengeURL:
+ description: |-
+ challengeURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect WWW-Authenticate challenges will be
+ redirected here.
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when challenge is set to true.
+ type: string
+ clientCommonNames:
+ description: |-
+ clientCommonNames is an optional list of common names to require a match from. If empty, any
+ client certificate validated against the clientCA bundle is considered authoritative.
+ items:
+ type: string
+ type: array
+ emailHeaders:
+ description: emailHeaders is the set of headers
+ to check for the email address
+ items:
+ type: string
+ type: array
+ headers:
+ description: headers is the set of headers to check
+ for identity information
+ items:
+ type: string
+ type: array
+ loginURL:
+ description: |-
+ loginURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect interactive logins will be redirected here
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when login is set to true.
+ type: string
+ nameHeaders:
+ description: nameHeaders is the set of headers to
+ check for the display name
+ items:
+ type: string
+ type: array
+ preferredUsernameHeaders:
+ description: preferredUsernameHeaders is the set
+ of headers to check for the preferred username
+ items:
+ type: string
+ type: array
+ type: object
+ type:
+ description: type identifies the identity provider type
+ for this entry.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ templates:
+ description: templates allow you to customize pages like the
+ login page.
+ properties:
+ error:
+ description: |-
+ error is the name of a secret that specifies a go template to use to render error pages
+ during the authentication or grant flow.
+ The key "errors.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default error page is used.
+ If the specified template is not valid, the default error page is used.
+ If unspecified, the default error page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ login:
+ description: |-
+ login is the name of a secret that specifies a go template to use to render the login page.
+ The key "login.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default login page is used.
+ If the specified template is not valid, the default login page is used.
+ If unspecified, the default login page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ providerSelection:
+ description: |-
+ providerSelection is the name of a secret that specifies a go template to use to render
+ the provider selection page.
+ The key "providers.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default provider selection page is used.
+ If the specified template is not valid, the default provider selection page is used.
+ If unspecified, the default provider selection page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ tokenConfig:
+ description: tokenConfig contains options for authorization
+ and access tokens
+ properties:
+ accessTokenInactivityTimeout:
+ description: |-
+ accessTokenInactivityTimeout defines the token inactivity timeout
+ for tokens granted by any client.
+ The value represents the maximum amount of time that can occur between
+ consecutive uses of the token. Tokens become invalid if they are not
+ used within this temporal window. The user will need to acquire a new
+ token to regain access once a token times out. Takes valid time
+ duration string such as "5m", "1.5h" or "2h45m". The minimum allowed
+ value for duration is 300s (5 minutes). If the timeout is configured
+ per client, then that value takes precedence. If the timeout value is
+ not specified and the client does not override the value, then tokens
+ are valid until their lifetime.
+
+ WARNING: existing tokens' timeout will not be affected (lowered) by changing this value
+ type: string
+ accessTokenInactivityTimeoutSeconds:
+ description: 'accessTokenInactivityTimeoutSeconds - DEPRECATED:
+ setting this field has no effect.'
+ format: int32
+ type: integer
+ accessTokenMaxAgeSeconds:
+ description: accessTokenMaxAgeSeconds defines the maximum
+ age of access tokens
+ format: int32
+ type: integer
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: spec.configuration.oauth.tokenConfig.accessTokenInactivityTimeout
+ minimum acceptable token timeout value is 300 seconds
+ rule: '!has(self.tokenConfig) || !has(self.tokenConfig.accessTokenInactivityTimeout)
+ || duration(self.tokenConfig.accessTokenInactivityTimeout).getSeconds()
+ >= 300'
+ operatorhub:
+ description: |-
+ operatorhub specifies the configuration for the Operator Lifecycle Manager in the HostedCluster. This is only configured at deployment time but the controller are not reconcilling over it.
+ The OperatorHub configuration will be constantly reconciled if catalog placement is management, but only on cluster creation otherwise.
+ properties:
+ disableAllDefaultSources:
+ description: |-
+ disableAllDefaultSources allows you to disable all the default hub
+ sources. If this is true, a specific entry in sources can be used to
+ enable a default source. If this is false, a specific entry in
+ sources can be used to disable or enable a default source.
+ type: boolean
+ sources:
+ description: |-
+ sources is the list of default hub sources and their configuration.
+ If the list is empty, it implies that the default hub sources are
+ enabled on the cluster unless disableAllDefaultSources is true.
+ If disableAllDefaultSources is true and sources is not empty,
+ the configuration present in sources will take precedence. The list of
+ default hub sources and their current state will always be reflected in
+ the status block.
+ items:
+ description: HubSource is used to specify the hub source
+ and its configuration
+ properties:
+ disabled:
+ description: disabled is used to disable a default hub
+ source on cluster
+ type: boolean
+ name:
+ description: name is the name of one of the default
+ hub sources
+ maxLength: 253
+ minLength: 1
+ type: string
+ type: object
+ type: array
+ type: object
+ proxy:
+ description: |-
+ proxy holds cluster-wide information on how to configure default proxies for the cluster.
+ This affects traffic flowing from the hosted cluster data plane.
+ The controllers will generate a machineConfig with the proxy config for the cluster.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ httpProxy:
+ description: httpProxy is the URL of the proxy for HTTP requests. Empty
+ means unset and will not result in an env var.
+ type: string
+ httpsProxy:
+ description: httpsProxy is the URL of the proxy for HTTPS
+ requests. Empty means unset and will not result in an env
+ var.
+ type: string
+ noProxy:
+ description: |-
+ noProxy is a comma-separated list of hostnames and/or CIDRs and/or IPs for which the proxy should not be used.
+ Empty means unset and will not result in an env var.
+ type: string
+ readinessEndpoints:
+ description: readinessEndpoints is a list of endpoints used
+ to verify readiness of the proxy.
+ items:
+ type: string
+ type: array
+ trustedCA:
+ description: |-
+ trustedCA is a reference to a ConfigMap containing a CA certificate bundle.
+ The trustedCA field should only be consumed by a proxy validator. The
+ validator is responsible for reading the certificate bundle from the required
+ key "ca-bundle.crt", merging it with the system default trust bundle,
+ and writing the merged trust bundle to a ConfigMap named "trusted-ca-bundle"
+ in the "openshift-config-managed" namespace. Clients that expect to make
+ proxy connections must use the trusted-ca-bundle for all HTTPS requests to
+ the proxy, and may use the trusted-ca-bundle for non-proxy HTTPS requests as
+ well.
+
+ The namespace for the ConfigMap referenced by trustedCA is
+ "openshift-config". Here is an example ConfigMap (in yaml):
+
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: user-ca-bundle
+ namespace: openshift-config
+ data:
+ ca-bundle.crt: |
+ -----BEGIN CERTIFICATE-----
+ Custom CA certificate bundle.
+ -----END CERTIFICATE-----
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ scheduler:
+ description: |-
+ scheduler holds cluster-wide config information to run the Kubernetes Scheduler
+ and influence its placement decisions. The canonical name for this config is `cluster`.
+ properties:
+ defaultNodeSelector:
+ description: |-
+ defaultNodeSelector helps set the cluster-wide default node selector to
+ restrict pod placement to specific nodes. This is applied to the pods
+ created in all namespaces and creates an intersection with any existing
+ nodeSelectors already set on a pod, additionally constraining that pod's selector.
+ For example,
+ defaultNodeSelector: "type=user-node,region=east" would set nodeSelector
+ field in pod spec to "type=user-node,region=east" to all pods created
+ in all namespaces. Namespaces having project-wide node selectors won't be
+ impacted even if this field is set. This adds an annotation section to
+ the namespace.
+ For example, if a new namespace is created with
+ node-selector='type=user-node,region=east',
+ the annotation openshift.io/node-selector: type=user-node,region=east
+ gets added to the project. When the openshift.io/node-selector annotation
+ is set on the project the value is used in preference to the value we are setting
+ for defaultNodeSelector field.
+ For instance,
+ openshift.io/node-selector: "type=user-node,region=west" means
+ that the default of "type=user-node,region=east" set in defaultNodeSelector
+ would not be applied.
+ type: string
+ mastersSchedulable:
+ description: |-
+ mastersSchedulable allows masters nodes to be schedulable. When this flag is
+ turned on, all the master nodes in the cluster will be made schedulable,
+ so that workload pods can run on them. The default value for this field is false,
+ meaning none of the master nodes are schedulable.
+ Important Note: Once the workload pods start running on the master nodes,
+ extreme care must be taken to ensure that cluster-critical control plane components
+ are not impacted.
+ Please turn on this field after doing due diligence.
+ type: boolean
+ policy:
+ description: |-
+ DEPRECATED: the scheduler Policy API has been deprecated and will be removed in a future release.
+ policy is a reference to a ConfigMap containing scheduler policy which has
+ user specified predicates and priorities. If this ConfigMap is not available
+ scheduler will default to use DefaultAlgorithmProvider.
+ The namespace for this configmap is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ profile:
+ description: |-
+ profile sets which scheduling profile should be set in order to configure scheduling
+ decisions for new pods.
+
+ Valid values are "LowNodeUtilization", "HighNodeUtilization", "NoScoring"
+ Defaults to "LowNodeUtilization"
+ enum:
+ - ""
+ - LowNodeUtilization
+ - HighNodeUtilization
+ - NoScoring
+ type: string
+ profileCustomizations:
+ description: profileCustomizations contains configuration
+ for modifying the default behavior of existing scheduler
+ profiles.
+ properties:
+ dynamicResourceAllocation:
+ description: |-
+ dynamicResourceAllocation allows to enable or disable dynamic resource allocation within the scheduler.
+ Dynamic resource allocation is an API for requesting and sharing resources between pods and containers inside a pod.
+ Third-party resource drivers are responsible for tracking and allocating resources.
+ Different kinds of resources support arbitrary parameters for defining requirements and initialization.
+ Valid values are Enabled, Disabled and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default,
+ which is subject to change over time.
+ The current default is Disabled.
+ enum:
+ - ""
+ - Enabled
+ - Disabled
+ type: string
+ type: object
+ type: object
+ type: object
+ controlPlaneReleaseImage:
+ description: |-
+ controlPlaneReleaseImage specifies the desired OCP release payload for
+ control plane components running on the management cluster.
+ If not defined, ReleaseImage is used
+ maxLength: 255
+ type: string
+ controllerAvailabilityPolicy:
+ default: HighlyAvailable
+ description: |-
+ controllerAvailabilityPolicy specifies the availability policy applied to
+ critical control plane components. The default value is SingleReplica.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ x-kubernetes-validations:
+ - message: ControllerAvailabilityPolicy is immutable
+ rule: self == oldSelf
+ dns:
+ description: dns is the DNS configuration for the cluster.
+ properties:
+ baseDomain:
+ description: |-
+ baseDomain is the base domain of the hosted cluster.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Once set, this field is immutable.
+ When the value is the empty string "", the controller might default to a value depending on the platform.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomain must be a valid domain name (e.g., example,
+ example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomain is immutable
+ rule: oldSelf == "" || self == oldSelf
+ baseDomainPrefix:
+ description: |-
+ baseDomainPrefix is the base domain prefix for the hosted cluster ingress.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Set baseDomainPrefix to an empty string "", if you don't want a prefix at all (not even hostedCluster.name) to be prepended to baseDomain.
+ This field is immutable.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomainPrefix must be a valid domain name (e.g.,
+ example, example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomainPrefix is immutable
+ rule: self == oldSelf
+ privateZoneID:
+ description: |-
+ privateZoneID is the Hosted Zone ID where all the DNS records that are only available internally to the cluster exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: privateZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ publicZoneID:
+ description: |-
+ publicZoneID is the Hosted Zone ID where all the DNS records that are publicly accessible to the internet exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: publicZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ required:
+ - baseDomain
+ type: object
+ etcd:
+ description: |-
+ etcd contains metadata about the etcd cluster the hypershift managed Openshift control plane components
+ use to store data.
+ properties:
+ managed:
+ description: managed specifies the behavior of an etcd cluster
+ managed by HyperShift.
+ properties:
+ storage:
+ description: storage specifies how etcd data is persisted.
+ properties:
+ persistentVolume:
+ description: |-
+ persistentVolume is the configuration for PersistentVolume etcd storage.
+ With this implementation, a PersistentVolume will be allocated for every
+ etcd member (either 1 or 3 depending on the HostedCluster control plane
+ availability configuration).
+ properties:
+ size:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 8Gi
+ description: |-
+ size is the minimum size of the data volume for each etcd member.
+ Default is 8Gi.
+ This field is immutable
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ x-kubernetes-validations:
+ - message: Etcd PV storage size is immutable
+ rule: self == oldSelf
+ storageClassName:
+ description: |-
+ storageClassName is the StorageClass of the data volume for each etcd member.
+ See https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: storageClassName is immutable
+ rule: self == oldSelf
+ type: object
+ restoreSnapshotURL:
+ description: |-
+ restoreSnapshotURL allows an optional URL to be provided where
+ an etcd snapshot can be downloaded, for example a pre-signed URL
+ referencing a storage service.
+ This snapshot will be restored on initial startup, only when the etcd PV
+ is empty.
+ items:
+ maxLength: 1024
+ type: string
+ maxItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: RestoreSnapshotURL shouldn't contain more than
+ 1 entry
+ rule: self.size() <= 1
+ type:
+ description: |-
+ type is the kind of persistent storage implementation to use for etcd.
+ Only PersistentVolume is supported at the moment.
+ enum:
+ - PersistentVolume
+ type: string
+ required:
+ - type
+ type: object
+ required:
+ - storage
+ type: object
+ managementType:
+ description: |-
+ managementType defines how the etcd cluster is managed.
+ This can be either Managed or Unmanaged.
+ This field is immutable.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ x-kubernetes-validations:
+ - message: managementType is immutable
+ rule: self == oldSelf
+ unmanaged:
+ description: |-
+ unmanaged specifies configuration which enables the control plane to
+ integrate with an externally managed etcd cluster.
+ properties:
+ endpoint:
+ description: |-
+ endpoint is the full etcd cluster client endpoint URL. For example:
+
+ https://etcd-client:2379
+
+ If the URL uses an HTTPS scheme, the TLS field is required.
+ maxLength: 255
+ pattern: ^https://
+ type: string
+ tls:
+ description: tls specifies TLS configuration for HTTPS etcd
+ client endpoints.
+ properties:
+ clientSecret:
+ description: |-
+ clientSecret refers to a secret for client mTLS authentication with the etcd cluster. It
+ may have the following key/value pairs:
+
+ etcd-client-ca.crt: Certificate Authority value
+ etcd-client.crt: Client certificate value
+ etcd-client.key: Client certificate key value
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - clientSecret
+ type: object
+ required:
+ - endpoint
+ - tls
+ type: object
+ required:
+ - managementType
+ type: object
+ x-kubernetes-validations:
+ - message: Only managed configuration must be set when managementType
+ is Managed
+ rule: 'self.managementType == ''Managed'' ? has(self.managed) :
+ !has(self.managed)'
+ - message: Only unmanaged configuration must be set when managementType
+ is Unmanaged
+ rule: 'self.managementType == ''Unmanaged'' ? has(self.unmanaged)
+ : !has(self.unmanaged)'
+ fips:
+ description: fips specifies if the nodes for the cluster will be running
+ in FIPS mode
+ type: boolean
+ imageContentSources:
+ description: imageContentSources lists sources/repositories for the
+ release-image content.
+ items:
+ description: |-
+ ImageContentSource specifies image mirrors that can be used by cluster nodes
+ to pull content. For cluster workloads, if a container image registry host of
+ the pullspec matches Source then one of the Mirrors are substituted as hosts
+ in the pullspec and tried in order to fetch the image.
+ properties:
+ mirrors:
+ description: mirrors are one or more repositories that may also
+ contain the same images.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 255
+ type: array
+ x-kubernetes-list-type: set
+ source:
+ description: |-
+ source is the repository that users refer to, e.g. in image pull
+ specifications.
+ maxLength: 255
+ type: string
+ required:
+ - source
+ type: object
+ maxItems: 255
+ type: array
+ infraID:
+ description: infraID is the unique id that identifies the cluster
+ internally.
+ maxLength: 255
+ type: string
+ infrastructureAvailabilityPolicy:
+ default: SingleReplica
+ description: |-
+ infrastructureAvailabilityPolicy specifies the availability policy applied
+ to infrastructure services which run on cluster nodes. The default value is
+ SingleReplica.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ issuerURL:
+ description: |-
+ issuerURL is an OIDC issuer URL which is used as the issuer in all
+ ServiceAccount tokens generated by the control plane API server. The
+ default value is kubernetes.default.svc, which only works for in-cluster
+ validation.
+ maxLength: 255
+ type: string
+ kubeAPIServerDNSName:
+ description: |-
+ kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
+ When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
+ If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
+ The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
+ This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
+ access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
+ for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ kubeconfig:
+ description: kubeconfig specifies the name and key for the kubeconfig
+ secret
+ properties:
+ key:
+ description: key is the key in the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: |-
+ labels when specified, define what custom labels are added to the hcp pods.
+ Changing this day 2 will cause a rollout of all hcp pods.
+ Duplicate keys are not supported. If duplicate keys are defined, only the last key/value pair is preserved.
+ Valid values are those in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
+
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(key) <= 317 && key.matches('^(([A-Za-z0-9]+(\\.[A-Za-z0-9]+)?)*[A-Za-z0-9]\\/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$'))`, message="label key must have two segments: an optional prefix and name, separated by a slash (/). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (_), dots (.), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (.), not longer than 253 characters in total, followed by a slash (/)"
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(self[key]) <= 63 && self[key].matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$'))`, message="label value must be 63 characters or less (can be empty), consist of alphanumeric characters, dashes (-), underscores (_) or dots (.), and begin and end with an alphanumeric character"
+ maxProperties: 20
+ type: object
+ networking:
+ description: |-
+ networking specifies network configuration for the cluster.
+ Temporarily optional for backward compatibility, required in future releases.
+ properties:
+ apiServer:
+ description: |-
+ apiServer contains advanced network settings for the API server that affect
+ how the APIServer is exposed inside a hosted cluster node.
+ properties:
+ advertiseAddress:
+ description: |-
+ advertiseAddress is the address that pods within the nodes will use to talk to the API
+ server. This is an address associated with the loopback adapter of each
+ node. If not specified, the controller will take default values.
+ The default values will be set as 172.20.0.1 or fd00::1.
+ This value is immutable.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: advertiseAddress is immutable
+ rule: self == oldSelf
+ allowedCIDRBlocks:
+ description: |-
+ allowedCIDRBlocks is an allow list of CIDR blocks that can access the APIServer.
+ If not specified, traffic is allowed from all addresses.
+ This field is enforced for ARO (Azure Red Hat OpenShift) via the shared-ingress HAProxy.
+ For platforms other than ARO, the enforcement depends on whether the underlying cloud provider supports the Service LoadBalancerSourceRanges field.
+ If the platform does not support LoadBalancerSourceRanges, this field may have no effect.
+ items:
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ maxItems: 500
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the port at which the APIServer is exposed inside a node. Other
+ pods using host networking cannot listen on this port.
+ If omitted 6443 is used.
+ This is useful to choose a port other than the default one which might interfere with customer environments e.g. https://github.com/openshift/hypershift/pull/356.
+ Setting this to 443 is possible only for backward compatibility reasons and it's discouraged.
+ Doing so, it would result in the controller overriding the KAS endpoint in the guest cluster having a discrepancy with the KAS Pod and potentially causing temporarily network failures.
+ This value is immutable.
+ format: int32
+ type: integer
+ x-kubernetes-validations:
+ - message: port is immutable
+ rule: self == oldSelf
+ type: object
+ clusterNetwork:
+ default:
+ - cidr: 10.132.0.0/14
+ description: |-
+ clusterNetwork is the list of IP address pools for pods.
+ Defaults to cidr: "10.132.0.0/14".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: |-
+ ClusterNetworkEntry is a single IP address block for pod IP blocks. IP blocks
+ are allocated with size 2^HostSubnetLength.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ hostPrefix:
+ description: |-
+ hostPrefix is the prefix size to allocate to each node from the CIDR.
+ For example, 24 would allocate 2^(32-24)=2^8=256 addresses to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ type: integer
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: clusterNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ machineNetwork:
+ description: |-
+ machineNetwork is the list of IP address pools for machines.
+ This might be used among other things to generate appropriate networking security groups in some clouds providers.
+ Currently only one entry or two for dual stack is supported.
+ This field is immutable.
+ items:
+ description: MachineNetworkEntry is a single IP address block
+ for node IP blocks.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for machines
+ within the cluster.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: machineNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ networkType:
+ default: OVNKubernetes
+ description: |-
+ networkType specifies the SDN provider used for cluster networking.
+ Defaults to OVNKubernetes.
+ This field is required and immutable.
+ kubebuilder:validation:XValidation:rule="self == oldSelf", message="networkType is immutable"
+ enum:
+ - OpenShiftSDN
+ - Calico
+ - OVNKubernetes
+ - Other
+ type: string
+ serviceNetwork:
+ default:
+ - cidr: 172.31.0.0/16
+ description: |-
+ serviceNetwork is the list of IP address pools for services.
+ Defaults to cidr: "172.31.0.0/16".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: ServiceNetworkEntry is a single IP address block
+ for the service network.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for services
+ within the cluster in CIDR format (e.g., 192.168.1.0/24
+ or 2001:0db8::/64)
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: serviceNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+ must be unique and non-overlapping
+ rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
+ c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
+ self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
+ self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
+ self.serviceNetwork.all(s, c.cidr != s.cidr)))))
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: nodeSelector when specified, must be true for the pods
+ managed by the HostedCluster to be scheduled.
+ type: object
+ olmCatalogPlacement:
+ default: management
+ description: |-
+ olmCatalogPlacement specifies the placement of OLM catalog components. By default,
+ this is set to management and OLM catalog components are deployed onto the management
+ cluster. If set to guest, the OLM catalog components will be deployed onto the guest
+ cluster.
+ enum:
+ - management
+ - guest
+ type: string
+ operatorConfiguration:
+ description: operatorConfiguration specifies configuration for individual
+ OCP operators in the cluster.
+ properties:
+ clusterNetworkOperator:
+ description: clusterNetworkOperator specifies the configuration
+ for the Cluster Network Operator in the hosted cluster.
+ properties:
+ disableMultiNetwork:
+ default: false
+ description: |-
+ disableMultiNetwork when set to true disables the Multus CNI plugin and related components
+ in the hosted cluster. This prevents the installation of multus daemon sets in the
+ guest cluster and the multus-admission-controller in the management cluster.
+ Default is false (Multus is enabled).
+ This field is immutable.
+ This field can only be set to true when NetworkType is "Other". Setting it to true
+ with any other NetworkType will result in a validation error during cluster creation.
+ type: boolean
+ x-kubernetes-validations:
+ - message: disableMultiNetwork is immutable
+ rule: self == oldSelf
+ ovnKubernetesConfig:
+ description: |-
+ ovnKubernetesConfig holds OVN-Kubernetes specific configuration.
+ This is only consumed when NetworkType is OVNKubernetes.
+ minProperties: 1
+ properties:
+ ipv4:
+ description: |-
+ ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
+ this means no opinions and the default configuration is used. Check individual
+ fields within ipv4 for details of default values.
+ minProperties: 1
+ properties:
+ internalJoinSubnet:
+ description: |-
+ internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the
+ default one is being already used by something else. It must not overlap with
+ any other subnet being used by OpenShift or by the node network. The size of the
+ subnet must be larger than the number of nodes.
+ The current default value is 100.64.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ (e.g., 192.168.1.1/24)
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ internalTransitSwitchSubnet:
+ description: |-
+ internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally
+ by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect
+ architecture that connects the cluster routers on each node together to enable
+ east west traffic. The subnet chosen should not overlap with other networks
+ specified for OVN-Kubernetes as well as other networks used on the host.
+ When omitted, this means no opinion and the platform is left to choose a reasonable
+ default which is subject to change over time.
+ The current default subnet is 100.88.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: internalJoinSubnet and internalTransitSwitchSubnet
+ must not be the same
+ rule: '!has(self.ipv4) || !has(self.ipv4.internalJoinSubnet)
+ || !has(self.ipv4.internalTransitSwitchSubnet) || self.ipv4.internalJoinSubnet
+ != self.ipv4.internalTransitSwitchSubnet'
+ type: object
+ clusterVersionOperator:
+ description: clusterVersionOperator specifies the configuration
+ for the Cluster Version Operator in the hosted cluster.
+ properties:
+ operatorLogLevel:
+ default: Normal
+ description: |-
+ operatorLogLevel is an intent based logging for the operator itself. It does not give fine-grained control,
+ but it is a simple way to manage coarse grained logging choices that operators have to interpret for themselves.
+
+ Valid values are: "Normal", "Debug", "Trace", "TraceAll".
+ Defaults to "Normal".
+ enum:
+ - ""
+ - Normal
+ - Debug
+ - Trace
+ - TraceAll
+ type: string
+ type: object
+ ingressOperator:
+ description: |-
+ ingressOperator specifies the configuration for the Ingress Operator in the hosted cluster.
+ This allows configuring how the default ingress controller endpoints are published.
+ properties:
+ endpointPublishingStrategy:
+ description: |-
+ endpointPublishingStrategy is used to publish the default ingress controller endpoints.
+
+ The endpoint publishing strategy is determined by the following precedence order:
+ 1. User-specified endpointPublishingStrategy (highest priority) - if this field is set,
+ it takes precedence over all other configuration methods
+ 2. Platform-specific defaults with annotation overrides - if no user strategy is set,
+ the platform type determines the default strategy, which can be further modified by:
+ - hypershift.openshift.io/private-ingress-controller annotation (sets PrivateStrategyType)
+ - hypershift.openshift.io/ingress-controller-load-balancer-scope annotation (sets LoadBalancerScope)
+ 3. Generic LoadBalancer fallback - if the platform is not recognized, defaults to
+ LoadBalancerService with External scope
+
+ Platform-specific defaults when endpointPublishingStrategy is not set:
+ - AWS: LoadBalancerService with External scope (or NLB if configured)
+ - Azure, GCP: LoadBalancerService with External scope
+ - IBMCloud: LoadBalancerService with External scope (or NodePort for UPI)
+ - None: HostNetwork
+ - KubeVirt: NodePortService
+ - OpenStack: LoadBalancerService with External scope and optional FloatingIP
+ - Other platforms: LoadBalancerService with External scope
+
+ See the OpenShift Ingress Operator EndpointPublishingStrategy type for the full specification:
+ https://github.com/openshift/api/blob/master/operator/v1/types_ingress.go
+ properties:
+ hostNetwork:
+ description: |-
+ hostNetwork holds parameters for the HostNetwork endpoint publishing
+ strategy. Present only if type is HostNetwork.
+ properties:
+ httpPort:
+ default: 80
+ description: |-
+ httpPort is the port on the host which should be used to listen for
+ HTTP requests. This field should be set when port 80 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 80.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ httpsPort:
+ default: 443
+ description: |-
+ httpsPort is the port on the host which should be used to listen for
+ HTTPS requests. This field should be set when port 443 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 443.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ statsPort:
+ default: 1936
+ description: |-
+ statsPort is the port on the host where the stats from the router are
+ published. The value should not coincide with the NodePort range of the
+ cluster. If an external load balancer is configured to forward connections
+ to this IngressController, the load balancer should use this port for
+ health checks. The load balancer can send HTTP probes on this port on a
+ given node, with the path /healthz/ready to determine if the ingress
+ controller is ready to receive traffic on the node. For proper operation
+ the load balancer must not forward traffic to a node until the health
+ check reports ready. The load balancer should also stop forwarding requests
+ within a maximum of 45 seconds after /healthz/ready starts reporting
+ not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with
+ a threshold of two successful or failed requests to become healthy or
+ unhealthy respectively, are well-tested values. When the value is 0 or
+ is not specified it defaults to 1936.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ type: object
+ loadBalancer:
+ description: |-
+ loadBalancer holds parameters for the load balancer. Present only if
+ type is LoadBalancerService.
+ properties:
+ allowedSourceRanges:
+ description: |-
+ allowedSourceRanges specifies an allowlist of IP address ranges to which
+ access to the load balancer should be restricted. Each range must be
+ specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is
+ specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default,
+ which allows all source addresses.
+
+ To facilitate migration from earlier versions of OpenShift that did
+ not have the allowedSourceRanges field, you may set the
+ service.beta.kubernetes.io/load-balancer-source-ranges annotation on
+ the "router-" service in the
+ "openshift-ingress" namespace, and this annotation will take
+ effect if allowedSourceRanges is empty on OpenShift 4.12.
+ items:
+ description: |-
+ CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8"
+ or "fd00::/8").
+ pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)
+ type: string
+ nullable: true
+ type: array
+ x-kubernetes-list-type: atomic
+ dnsManagementPolicy:
+ default: Managed
+ description: |-
+ dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record
+ associated with the load balancer service will be managed by
+ the ingress operator. It defaults to Managed.
+ Valid values are: Managed and Unmanaged.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ providerParameters:
+ description: |-
+ providerParameters holds desired load balancer information specific to
+ the underlying infrastructure provider.
+
+ If empty, defaults will be applied. See specific providerParameters
+ fields for details about their defaults.
+ properties:
+ aws:
+ description: |-
+ aws provides configuration settings that are specific to AWS
+ load balancers.
+
+ If empty, defaults will be applied. See specific aws fields for
+ details about their defaults.
+ properties:
+ classicLoadBalancer:
+ description: |-
+ classicLoadBalancerParameters holds configuration parameters for an AWS
+ classic load balancer. Present only if type is Classic.
+ properties:
+ connectionIdleTimeout:
+ description: |-
+ connectionIdleTimeout specifies the maximum time period that a
+ connection may be idle before the load balancer closes the
+ connection. The value must be parseable as a time duration value;
+ see . A nil or zero value
+ means no opinion, in which case a default value is used. The default
+ value for this field is 60s. This default is subject to change.
+ format: duration
+ type: string
+ subnets:
+ description: |-
+ subnets specifies the subnets to which the load balancer will
+ attach. The subnets may be specified by either their
+ ID or name. The total number of subnets is limited to 10.
+
+ In order for the load balancer to be provisioned with subnets,
+ each subnet must exist, each subnet must be from a different
+ availability zone, and the load balancer service must be
+ recreated to pick up new values.
+
+ When omitted from the spec, the subnets will be auto-discovered
+ for each availability zone. Auto-discovered subnets are not reported
+ in the status of the IngressController object.
+ properties:
+ ids:
+ description: |-
+ ids specifies a list of AWS subnets by subnet ID.
+ Subnet IDs must start with "subnet-", consist only
+ of alphanumeric characters, must be exactly 24
+ characters long, must be unique, and the total
+ number of subnets specified by ids and names
+ must not exceed 10.
+ items:
+ description: AWSSubnetID is a reference
+ to an AWS subnet ID.
+ maxLength: 24
+ minLength: 24
+ pattern: ^subnet-[0-9A-Za-z]+$
+ type: string
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: subnet ids cannot contain
+ duplicates
+ rule: self.all(x, self.exists_one(y,
+ x == y))
+ names:
+ description: |-
+ names specifies a list of AWS subnets by subnet name.
+ Subnet names must not start with "subnet-", must not
+ include commas, must be under 256 characters in length,
+ must be unique, and the total number of subnets
+ specified by ids and names must not exceed 10.
+ items:
+ description: AWSSubnetName is a
+ reference to an AWS subnet name.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: subnet name cannot contain
+ a comma
+ rule: '!self.contains('','')'
+ - message: subnet name cannot start
+ with 'subnet-'
+ rule: '!self.startsWith(''subnet-'')'
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: subnet names cannot contain
+ duplicates
+ rule: self.all(x, self.exists_one(y,
+ x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: the total number of subnets
+ cannot exceed 10
+ rule: 'has(self.ids) && has(self.names)
+ ? size(self.ids + self.names) <= 10
+ : true'
+ - message: must specify at least 1 subnet
+ name or id
+ rule: has(self.ids) && self.ids.size()
+ > 0 || has(self.names) && self.names.size()
+ > 0
+ type: object
+ networkLoadBalancer:
+ description: |-
+ networkLoadBalancerParameters holds configuration parameters for an AWS
+ network load balancer. Present only if type is NLB.
+ properties:
+ eipAllocations:
+ description: |-
+ eipAllocations is a list of IDs for Elastic IP (EIP) addresses that
+ are assigned to the Network Load Balancer.
+ The following restrictions apply:
+
+ eipAllocations can only be used with external scope, not internal.
+ An EIP can be allocated to only a single IngressController.
+ The number of EIP allocations must match the number of subnets that are used for the load balancer.
+ Each EIP allocation must be unique.
+ A maximum of 10 EIP allocations are permitted.
+
+ See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html for general
+ information about configuration, characteristics, and limitations of Elastic IP addresses.
+ items:
+ description: |-
+ EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment.
+ Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters.
+ maxLength: 26
+ minLength: 26
+ type: string
+ x-kubernetes-validations:
+ - message: eipAllocations should start
+ with 'eipalloc-'
+ rule: self.startsWith('eipalloc-')
+ - message: eipAllocations must be 'eipalloc-'
+ followed by exactly 17 hexadecimal
+ characters (0-9, a-f, A-F)
+ rule: self.split("-", 2)[1].matches('[0-9a-fA-F]{17}$')
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: eipAllocations cannot contain
+ duplicates
+ rule: self.all(x, self.exists_one(y,
+ x == y))
+ subnets:
+ description: |-
+ subnets specifies the subnets to which the load balancer will
+ attach. The subnets may be specified by either their
+ ID or name. The total number of subnets is limited to 10.
+
+ In order for the load balancer to be provisioned with subnets,
+ each subnet must exist, each subnet must be from a different
+ availability zone, and the load balancer service must be
+ recreated to pick up new values.
+
+ When omitted from the spec, the subnets will be auto-discovered
+ for each availability zone. Auto-discovered subnets are not reported
+ in the status of the IngressController object.
+ properties:
+ ids:
+ description: |-
+ ids specifies a list of AWS subnets by subnet ID.
+ Subnet IDs must start with "subnet-", consist only
+ of alphanumeric characters, must be exactly 24
+ characters long, must be unique, and the total
+ number of subnets specified by ids and names
+ must not exceed 10.
+ items:
+ description: AWSSubnetID is a reference
+ to an AWS subnet ID.
+ maxLength: 24
+ minLength: 24
+ pattern: ^subnet-[0-9A-Za-z]+$
+ type: string
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: subnet ids cannot contain
+ duplicates
+ rule: self.all(x, self.exists_one(y,
+ x == y))
+ names:
+ description: |-
+ names specifies a list of AWS subnets by subnet name.
+ Subnet names must not start with "subnet-", must not
+ include commas, must be under 256 characters in length,
+ must be unique, and the total number of subnets
+ specified by ids and names must not exceed 10.
+ items:
+ description: AWSSubnetName is a
+ reference to an AWS subnet name.
+ maxLength: 256
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: subnet name cannot contain
+ a comma
+ rule: '!self.contains('','')'
+ - message: subnet name cannot start
+ with 'subnet-'
+ rule: '!self.startsWith(''subnet-'')'
+ maxItems: 10
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: subnet names cannot contain
+ duplicates
+ rule: self.all(x, self.exists_one(y,
+ x == y))
+ type: object
+ x-kubernetes-validations:
+ - message: the total number of subnets
+ cannot exceed 10
+ rule: 'has(self.ids) && has(self.names)
+ ? size(self.ids + self.names) <= 10
+ : true'
+ - message: must specify at least 1 subnet
+ name or id
+ rule: has(self.ids) && self.ids.size()
+ > 0 || has(self.names) && self.names.size()
+ > 0
+ type: object
+ type:
+ description: |-
+ type is the type of AWS load balancer to instantiate for an ingresscontroller.
+
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - Classic
+ - NLB
+ type: string
+ required:
+ - type
+ type: object
+ gcp:
+ description: |-
+ gcp provides configuration settings that are specific to GCP
+ load balancers.
+
+ If empty, defaults will be applied. See specific gcp fields for
+ details about their defaults.
+ properties:
+ clientAccess:
+ description: |-
+ clientAccess describes how client access is restricted for internal
+ load balancers.
+
+ Valid values are:
+ * "Global": Specifying an internal load balancer with Global client access
+ allows clients from any region within the VPC to communicate with the load
+ balancer.
+
+ https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access
+
+ * "Local": Specifying an internal load balancer with Local client access
+ means only clients within the same region (and VPC) as the GCP load balancer
+ can communicate with the load balancer. Note that this is the default behavior.
+
+ https://cloud.google.com/load-balancing/docs/internal#client_access
+ enum:
+ - Global
+ - Local
+ type: string
+ type: object
+ ibm:
+ description: |-
+ ibm provides configuration settings that are specific to IBM Cloud
+ load balancers.
+
+ If empty, defaults will be applied. See specific ibm fields for
+ details about their defaults.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the load balancer uses PROXY protocol to forward connections to
+ the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features:
+ "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas"
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ Valid values for protocol are TCP, PROXY and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is TCP, without the proxy protocol enabled.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ openstack:
+ description: |-
+ openstack provides configuration settings that are specific to OpenStack
+ load balancers.
+
+ If empty, defaults will be applied. See specific openstack fields for
+ details about their defaults.
+ properties:
+ floatingIP:
+ description: |-
+ floatingIP specifies the IP address that the load balancer will use.
+ When not specified, an IP address will be assigned randomly by the OpenStack cloud provider.
+ When specified, the floating IP has to be pre-created. If the
+ specified value is not a floating IP or is already claimed, the
+ OpenStack cloud provider won't be able to provision the load
+ balancer.
+ This field may only be used if the IngressController has External scope.
+ This value must be a valid IPv4 or IPv6 address.
+ type: string
+ x-kubernetes-validations:
+ - message: floatingIP must be a valid IPv4
+ or IPv6 address
+ rule: isIP(self)
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the load balancer.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix",
+ "OpenStack", and "VSphere".
+ enum:
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Nutanix
+ - OpenStack
+ - VSphere
+ - IBM
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: openstack is not permitted when type is
+ not OpenStack
+ rule: 'has(self.type) && self.type == ''OpenStack''
+ ? true : !has(self.openstack)'
+ scope:
+ description: |-
+ scope indicates the scope at which the load balancer is exposed.
+ Possible values are "External" and "Internal".
+ enum:
+ - Internal
+ - External
+ type: string
+ required:
+ - dnsManagementPolicy
+ - scope
+ type: object
+ x-kubernetes-validations:
+ - message: eipAllocations are forbidden when the scope
+ is Internal.
+ rule: '!has(self.scope) || self.scope != ''Internal''
+ || !has(self.providerParameters) || !has(self.providerParameters.aws)
+ || !has(self.providerParameters.aws.networkLoadBalancer)
+ || !has(self.providerParameters.aws.networkLoadBalancer.eipAllocations)'
+ - message: cannot specify a floating ip when scope is
+ internal
+ rule: '!has(self.scope) || self.scope != ''Internal''
+ || !has(self.providerParameters) || !has(self.providerParameters.openstack)
+ || !has(self.providerParameters.openstack.floatingIP)
+ || self.providerParameters.openstack.floatingIP ==
+ ""'
+ nodePort:
+ description: |-
+ nodePort holds parameters for the NodePortService endpoint publishing strategy.
+ Present only if type is NodePortService.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ private:
+ description: |-
+ private holds parameters for the Private endpoint publishing
+ strategy. Present only if type is Private.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy to use. Valid values are:
+
+ * LoadBalancerService
+
+ Publishes the ingress controller using a Kubernetes LoadBalancer Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A LoadBalancer Service is created to publish the deployment.
+
+ See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
+
+ If domain is set, a wildcard DNS record will be managed to point at the
+ LoadBalancer Service's external name. DNS records are managed only in DNS
+ zones defined by dns.config.openshift.io/cluster .spec.publicZone and
+ .spec.privateZone.
+
+ Wildcard DNS management is currently supported only on the AWS, Azure,
+ and GCP platforms.
+
+ * HostNetwork
+
+ Publishes the ingress controller on node ports where the ingress controller
+ is deployed.
+
+ In this configuration, the ingress controller deployment uses host
+ networking, bound to node ports 80 and 443. The user is responsible for
+ configuring an external load balancer to publish the ingress controller via
+ the node ports.
+
+ * Private
+
+ Does not publish the ingress controller.
+
+ In this configuration, the ingress controller deployment uses container
+ networking, and is not explicitly published. The user must manually publish
+ the ingress controller.
+
+ * NodePortService
+
+ Publishes the ingress controller using a Kubernetes NodePort Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A NodePort Service is created to publish the deployment. The
+ specific node ports are dynamically allocated by OpenShift; however, to
+ support static port allocations, user changes to the node port
+ field of the managed NodePort Service will preserved.
+ enum:
+ - LoadBalancerService
+ - HostNetwork
+ - Private
+ - NodePortService
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-preserve-unknown-fields: true
+ type: object
+ type: object
+ pausedUntil:
+ description: |-
+ pausedUntil is a field that can be used to pause reconciliation on a resource.
+ Either a date can be provided in RFC3339 format or a boolean. If a date is
+ provided: reconciliation is paused on the resource until that date. If the boolean true is
+ provided: reconciliation is paused on the resource until the field is removed.
+ maxLength: 255
+ type: string
+ platform:
+ description: platform is the platform configuration for the cluster.
+ properties:
+ agent:
+ description: agent specifies configuration for agent-based installations.
+ properties:
+ agentNamespace:
+ description: agentNamespace is the namespace where to search
+ for Agents for this cluster
+ maxLength: 63
+ type: string
+ required:
+ - agentNamespace
+ type: object
+ aws:
+ description: aws specifies configuration for clusters running
+ on Amazon Web Services.
+ properties:
+ additionalAllowedPrincipals:
+ description: |-
+ additionalAllowedPrincipals specifies a list of additional allowed principal ARNs
+ to be added to the hosted control plane's VPC Endpoint Service to enable additional
+ VPC Endpoint connection requests to be automatically accepted.
+ See https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html
+ for more details around VPC Endpoint Service allowed principals.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 25
+ type: array
+ cloudProviderConfig:
+ description: |-
+ cloudProviderConfig specifies AWS networking configuration for the control
+ plane.
+ This is mainly used for cloud provider controller config:
+ https://github.com/kubernetes/kubernetes/blob/f5be5052e3d0808abb904aebd3218fe4a5c2dd82/staging/src/k8s.io/legacy-cloud-providers/aws/aws.go#L1347-L1364
+ properties:
+ subnet:
+ description: subnet is the subnet to use for control plane
+ cloud resources.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify
+ an AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for
+ the filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: vpc is the VPC to use for control plane cloud
+ resources.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ maxLength: 255
+ type: string
+ required:
+ - vpc
+ type: object
+ endpointAccess:
+ default: Public
+ description: |-
+ endpointAccess specifies the publishing scope of cluster endpoints. The
+ default is Public.
+ enum:
+ - Public
+ - PublicAndPrivate
+ - Private
+ type: string
+ multiArch:
+ default: false
+ description: |-
+ multiArch specifies whether the Hosted Cluster will be expected to support NodePools with different
+ CPU architectures, i.e., supporting arm64 NodePools and supporting amd64 NodePools on the same Hosted Cluster.
+ Deprecated: This field is no longer used. The HyperShift Operator now performs multi-arch validations
+ automatically despite the platform type. The HyperShift Operator will set HostedCluster.Status.PayloadArch based
+ on the HostedCluster release image. This field is used by the NodePool controller to validate the
+ NodePool.Spec.Arch is supported.
+ type: boolean
+ region:
+ description: |-
+ region is the AWS region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot AMI for a given release.
+ maxLength: 255
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created
+ for the cluster. See
+ https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for
+ information on tagging AWS resources. AWS supports a maximum of 50 tags per
+ resource. OpenShift reserves 25 tags for its use, leaving 25 tags available
+ for the user.
+ Changes to this field will be propagated in-place to AWS resources (VPC Endpoints, EC2 instances, initial EBS volumes and default/endpoint security groups).
+ These tags will be propagated to the infrastructure CR in the guest cluster, where other OCP operators might choose to honor this input to reconcile AWS resources created by them.
+ Please consult the official documentation for a list of all AWS resources that support in-place tag updates.
+ These take precedence over tags defined out of band (i.e., tags added manually or by other tools outside of HyperShift) in AWS in case of conflicts.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ value:
+ description: |-
+ value is the value of the tag.
+
+ Some AWS service do not support empty values. Since tags are added to
+ resources in many services, the length of the tag value must meet the
+ requirements of all services.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ rolesRef:
+ description: |-
+ rolesRef contains references to various AWS IAM roles required to enable
+ integrations such as OIDC.
+ properties:
+ controlPlaneOperatorARN:
+ description: "controlPlaneOperatorARN is an ARN value
+ referencing a role appropriate for the Control Plane
+ Operator.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"arn:aws:route53:::%s\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ imageRegistryARN:
+ description: "imageRegistryARN is an ARN value referencing
+ a role appropriate for the Image Registry Operator.\n\nThe
+ following is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"s3:CreateBucket\",\n\t\t\t\t\"s3:DeleteBucket\",\n\t\t\t\t\"s3:PutBucketTagging\",\n\t\t\t\t\"s3:GetBucketTagging\",\n\t\t\t\t\"s3:PutBucketPublicAccessBlock\",\n\t\t\t\t\"s3:GetBucketPublicAccessBlock\",\n\t\t\t\t\"s3:PutEncryptionConfiguration\",\n\t\t\t\t\"s3:GetEncryptionConfiguration\",\n\t\t\t\t\"s3:PutLifecycleConfiguration\",\n\t\t\t\t\"s3:GetLifecycleConfiguration\",\n\t\t\t\t\"s3:GetBucketLocation\",\n\t\t\t\t\"s3:ListBucket\",\n\t\t\t\t\"s3:GetObject\",\n\t\t\t\t\"s3:PutObject\",\n\t\t\t\t\"s3:DeleteObject\",\n\t\t\t\t\"s3:ListBucketMultipartUploads\",\n\t\t\t\t\"s3:AbortMultipartUpload\",\n\t\t\t\t\"s3:ListMultipartUploadParts\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing a
+ role appropriate for the Ingress Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"elasticloadbalancing:DescribeLoadBalancers\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"route53:ListHostedZones\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ [\n\t\t\t\t\"arn:aws:route53:::PUBLIC_ZONE_ID\",\n\t\t\t\t\"arn:aws:route53:::PRIVATE_ZONE_ID\"\n\t\t\t]\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ kubeCloudControllerARN:
+ description: |-
+ kubeCloudControllerARN is an ARN value referencing a role appropriate for the KCM/KCC.
+ Source: https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies
+
+ The following is an example of a valid policy document:
+
+ {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Action": [
+ "autoscaling:DescribeAutoScalingGroups",
+ "autoscaling:DescribeLaunchConfigurations",
+ "autoscaling:DescribeTags",
+ "ec2:DescribeAvailabilityZones",
+ "ec2:DescribeInstances",
+ "ec2:DescribeImages",
+ "ec2:DescribeRegions",
+ "ec2:DescribeRouteTables",
+ "ec2:DescribeSecurityGroups",
+ "ec2:DescribeSubnets",
+ "ec2:DescribeVolumes",
+ "ec2:CreateSecurityGroup",
+ "ec2:CreateTags",
+ "ec2:CreateVolume",
+ "ec2:ModifyInstanceAttribute",
+ "ec2:ModifyVolume",
+ "ec2:AttachVolume",
+ "ec2:AuthorizeSecurityGroupIngress",
+ "ec2:CreateRoute",
+ "ec2:DeleteRoute",
+ "ec2:DeleteSecurityGroup",
+ "ec2:DeleteVolume",
+ "ec2:DetachVolume",
+ "ec2:RevokeSecurityGroupIngress",
+ "ec2:DescribeVpcs",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:AttachLoadBalancerToSubnets",
+ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancerPolicy",
+ "elasticloadbalancing:CreateLoadBalancerListeners",
+ "elasticloadbalancing:ConfigureHealthCheck",
+ "elasticloadbalancing:DeleteLoadBalancer",
+ "elasticloadbalancing:DeleteLoadBalancerListeners",
+ "elasticloadbalancing:DescribeLoadBalancers",
+ "elasticloadbalancing:DescribeLoadBalancerAttributes",
+ "elasticloadbalancing:DetachLoadBalancerFromSubnets",
+ "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
+ "elasticloadbalancing:ModifyLoadBalancerAttributes",
+ "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
+ "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:CreateListener",
+ "elasticloadbalancing:CreateTargetGroup",
+ "elasticloadbalancing:DeleteListener",
+ "elasticloadbalancing:DeleteTargetGroup",
+ "elasticloadbalancing:DeregisterTargets",
+ "elasticloadbalancing:DescribeListeners",
+ "elasticloadbalancing:DescribeLoadBalancerPolicies",
+ "elasticloadbalancing:DescribeTargetGroups",
+ "elasticloadbalancing:DescribeTargetHealth",
+ "elasticloadbalancing:ModifyListener",
+ "elasticloadbalancing:ModifyTargetGroup",
+ "elasticloadbalancing:RegisterTargets",
+ "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
+ "iam:CreateServiceLinkedRole",
+ "kms:DescribeKey"
+ ],
+ "Resource": [
+ "*"
+ ],
+ "Effect": "Allow"
+ }
+ ]
+ }
+ maxLength: 2048
+ type: string
+ networkARN:
+ description: "networkARN is an ARN value referencing a
+ role appropriate for the Network Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:DescribeInstances\",\n
+ \ \"ec2:DescribeInstanceStatus\",\n \"ec2:DescribeInstanceTypes\",\n
+ \ \"ec2:UnassignPrivateIpAddresses\",\n \"ec2:AssignPrivateIpAddresses\",\n
+ \ \"ec2:UnassignIpv6Addresses\",\n \"ec2:AssignIpv6Addresses\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeNetworkInterfaces\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ nodePoolManagementARN:
+ description: "nodePoolManagementARN is an ARN value referencing
+ a role appropriate for the CAPI Controller.\n\nThe following
+ is an example of a valid policy document:\n\n{\n \"Version\":
+ \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\":
+ [\n \"ec2:AssociateRouteTable\",\n \"ec2:AttachInternetGateway\",\n
+ \ \"ec2:AuthorizeSecurityGroupIngress\",\n \"ec2:CreateInternetGateway\",\n
+ \ \"ec2:CreateNatGateway\",\n \"ec2:CreateRoute\",\n
+ \ \"ec2:CreateRouteTable\",\n \"ec2:CreateSecurityGroup\",\n
+ \ \"ec2:CreateSubnet\",\n \"ec2:CreateTags\",\n
+ \ \"ec2:DeleteInternetGateway\",\n \"ec2:DeleteNatGateway\",\n
+ \ \"ec2:DeleteRouteTable\",\n \"ec2:DeleteSecurityGroup\",\n
+ \ \"ec2:DeleteSubnet\",\n \"ec2:DeleteTags\",\n
+ \ \"ec2:DescribeAccountAttributes\",\n \"ec2:DescribeAddresses\",\n
+ \ \"ec2:DescribeAvailabilityZones\",\n \"ec2:DescribeImages\",\n
+ \ \"ec2:DescribeInstances\",\n \"ec2:DescribeInternetGateways\",\n
+ \ \"ec2:DescribeNatGateways\",\n \"ec2:DescribeNetworkInterfaces\",\n
+ \ \"ec2:DescribeNetworkInterfaceAttribute\",\n
+ \ \"ec2:DescribeRouteTables\",\n \"ec2:DescribeSecurityGroups\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeVpcs\",\n
+ \ \"ec2:DescribeVpcAttribute\",\n \"ec2:DescribeVolumes\",\n
+ \ \"ec2:DetachInternetGateway\",\n \"ec2:DisassociateRouteTable\",\n
+ \ \"ec2:DisassociateAddress\",\n \"ec2:ModifyInstanceAttribute\",\n
+ \ \"ec2:ModifyNetworkInterfaceAttribute\",\n \"ec2:ModifySubnetAttribute\",\n
+ \ \"ec2:RevokeSecurityGroupIngress\",\n \"ec2:RunInstances\",\n
+ \ \"ec2:TerminateInstances\",\n \"tag:GetResources\",\n
+ \ \"ec2:CreateLaunchTemplate\",\n \"ec2:CreateLaunchTemplateVersion\",\n
+ \ \"ec2:DescribeLaunchTemplates\",\n \"ec2:DescribeLaunchTemplateVersions\",\n
+ \ \"ec2:DeleteLaunchTemplate\",\n \"ec2:DeleteLaunchTemplateVersions\"\n
+ \ ],\n \"Resource\": [\n \"*\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n {\n \"Condition\":
+ {\n \"StringLike\": {\n \"iam:AWSServiceName\":
+ \"elasticloadbalancing.amazonaws.com\"\n }\n },\n
+ \ \"Action\": [\n \"iam:CreateServiceLinkedRole\"\n
+ \ ],\n \"Resource\": [\n \"arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing\"\n
+ \ ],\n \"Effect\": \"Allow\"\n },\n {\n \"Action\":
+ [\n \"iam:PassRole\"\n ],\n \"Resource\":
+ [\n \"arn:*:iam::*:role/*-worker-role\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n\t {\n\t \t\"Effect\":
+ \"Allow\",\n\t \t\"Action\": [\n\t \t\t\"kms:Decrypt\",\n\t
+ \ \t\t\"kms:ReEncrypt\",\n\t \t\t\"kms:GenerateDataKeyWithoutPlainText\",\n\t
+ \ \t\t\"kms:DescribeKey\"\n\t \t],\n\t \t\"Resource\":
+ \"*\"\n\t },\n\t {\n\t \t\"Effect\": \"Allow\",\n\t
+ \ \t\"Action\": [\n\t \t\t\"kms:CreateGrant\"\n\t \t],\n\t
+ \ \t\"Resource\": \"*\",\n\t \t\"Condition\": {\n\t
+ \ \t\t\"Bool\": {\n\t \t\t\t\"kms:GrantIsForAWSResource\":
+ true\n\t \t\t}\n\t \t}\n\t }\n ]\n}"
+ maxLength: 2048
+ type: string
+ storageARN:
+ description: "storageARN is an ARN value referencing a
+ role appropriate for the Storage Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:AttachVolume\",\n\t\t\t\t\"ec2:CreateSnapshot\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"ec2:CreateVolume\",\n\t\t\t\t\"ec2:DeleteSnapshot\",\n\t\t\t\t\"ec2:DeleteTags\",\n\t\t\t\t\"ec2:DeleteVolume\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeSnapshots\",\n\t\t\t\t\"ec2:DescribeTags\",\n\t\t\t\t\"ec2:DescribeVolumes\",\n\t\t\t\t\"ec2:DescribeVolumesModifications\",\n\t\t\t\t\"ec2:DetachVolume\",\n\t\t\t\t\"ec2:ModifyVolume\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - controlPlaneOperatorARN
+ - imageRegistryARN
+ - ingressARN
+ - kubeCloudControllerARN
+ - networkARN
+ - nodePoolManagementARN
+ - storageARN
+ type: object
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints specifies optional custom endpoints which will override
+ the default service endpoint of specific AWS Services.
+
+ There must be only one ServiceEndpoint for a given service name.
+ items:
+ description: |-
+ AWSServiceEndpoint stores the configuration for services to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ This must be provided and cannot be empty.
+ maxLength: 255
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 50
+ type: array
+ sharedVPC:
+ description: |-
+ sharedVPC contains fields that must be specified if the HostedCluster must use a VPC that is
+ created in a different AWS account and is shared with the AWS account where the HostedCluster
+ will be created.
+ properties:
+ localZoneID:
+ description: |-
+ localZoneID is the ID of the route53 hosted zone for [cluster-name].hypershift.local that is
+ associated with the HostedCluster's VPC and exists in the VPC owner account.
+ maxLength: 32
+ type: string
+ rolesRef:
+ description: |-
+ rolesRef contains references to roles in the VPC owner account that enable a
+ HostedCluster on a shared VPC.
+ properties:
+ controlPlaneARN:
+ description: "controlPlaneARN is an ARN value referencing
+ the role in the VPC owner account that allows\nthe
+ control plane operator in the cluster account to
+ create and manage a VPC endpoint, its\ncorresponding
+ Security Group, and DNS records in the hypershift
+ local hosted zone.\n\nThe referenced role must have
+ a trust relationship that allows it to be assumed
+ by the\ncontrol plane operator role in the VPC creator
+ account.\nExample:\n{\n\t \"Version\": \"2012-10-17\",\n\t
+ \"Statement\": [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t
+ \t\t\"Effect\": \"Allow\",\n\t \t\t\"Principal\":
+ {\n\t \t\t\t\"AWS\": \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-control-plane-operator\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing
+ the role in the VPC owner account that allows the\ningress
+ operator in the cluster account to create and manage
+ records in the private DNS\nhosted zone.\n\nThe
+ referenced role must have a trust relationship that
+ allows it to be assumed by the\ningress operator
+ role in the VPC creator account.\nExample:\n{\n\t
+ \"Version\": \"2012-10-17\",\n\t \"Statement\":
+ [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t \t\t\"Effect\":
+ \"Allow\",\n\t \t\t\"Principal\": {\n\t \t\t\t\"AWS\":
+ \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-openshift-ingress\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n(Based on https://docs.openshift.com/rosa/rosa_install_access_delete_clusters/rosa-shared-vpc-config.html#rosa-sharing-vpc-dns-and-roles_rosa-shared-vpc-config)\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"route53:ListHostedZonesByName\",\n\t\t\t\t\"route53:ChangeTagsForResource\",\n\t\t\t\t\"route53:GetAccountLimit\",\n\t\t\t\t\"route53:GetChange\",\n\t\t\t\t\"route53:GetHostedZone\",\n\t\t\t\t\"route53:ListTagsForResource\",\n\t\t\t\t\"route53:UpdateHostedZoneComment\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"tag:UntagResources\"\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ required:
+ - controlPlaneARN
+ - ingressARN
+ type: object
+ required:
+ - localZoneID
+ - rolesRef
+ type: object
+ required:
+ - region
+ - rolesRef
+ type: object
+ azure:
+ description: azure defines azure specific settings
+ properties:
+ azureAuthenticationConfig:
+ description: |-
+ azureAuthenticationConfig is the type of Azure authentication configuration to use to authenticate with Azure's
+ Cloud API.
+ properties:
+ azureAuthenticationConfigType:
+ description: |-
+ azureAuthenticationConfigType is the type of identity configuration used in the Hosted Cluster. This field is
+ used to determine which identity configuration is being used. Valid values are "ManagedIdentities" and
+ "WorkloadIdentities".
+ enum:
+ - ManagedIdentities
+ - WorkloadIdentities
+ type: string
+ managedIdentities:
+ description: |-
+ managedIdentities contains the managed identities needed for HCP control plane and data plane components that
+ authenticate with Azure's API.
+
+ These are required for managed Azure, also known as ARO HCP.
+ properties:
+ controlPlane:
+ description: |-
+ controlPlane contains the client IDs of all the managed identities on the HCP control plane needing to
+ authenticate with Azure's API.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is a pre-existing managed identity associated with the azure cloud provider, aka cloud controller
+ manager.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ controlPlaneOperator:
+ description: controlPlaneOperator is a pre-existing
+ managed identity associated with the control
+ plane operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ disk:
+ description: disk is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ file:
+ description: file is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ imageRegistry:
+ description: imageRegistry is a pre-existing managed
+ identity associated with the cluster-image-registry-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ ingress:
+ description: ingress is a pre-existing managed
+ identity associated with the cluster-ingress-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ managedIdentitiesKeyVault:
+ description: |-
+ managedIdentitiesKeyVault contains information on the management cluster's managed identities Azure Key Vault.
+ This Key Vault is where the managed identities certificates are stored. These certificates are pulled out of the
+ Key Vault by the Secrets Store CSI driver and mounted into a volume on control plane pods requiring
+ authentication with Azure API.
+
+ More information on how the Secrets Store CSI driver works to do this can be found here:
+ https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver.
+ properties:
+ name:
+ description: name is the name of the Azure
+ Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ tenantID:
+ description: tenantID is the tenant ID of
+ the Azure Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - tenantID
+ type: object
+ network:
+ description: network is a pre-existing managed
+ identity associated with the cluster-network-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ nodePoolManagement:
+ description: nodePoolManagement is a pre-existing
+ managed identity associated with the operator
+ managing the NodePools.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - cloudProvider
+ - controlPlaneOperator
+ - disk
+ - file
+ - ingress
+ - managedIdentitiesKeyVault
+ - network
+ - nodePoolManagement
+ type: object
+ dataPlane:
+ description: |-
+ dataPlane contains the client IDs of all the managed identities on the data plane needing to authenticate with
+ Azure's API.
+ properties:
+ diskMSIClientID:
+ description: diskMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI Disk driver.
+ maxLength: 255
+ type: string
+ fileMSIClientID:
+ description: fileMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI File driver.
+ maxLength: 255
+ type: string
+ imageRegistryMSIClientID:
+ description: |-
+ imageRegistryMSIClientID is the client ID of a pre-existing managed identity ID associated with the image
+ registry controller.
+ maxLength: 255
+ type: string
+ required:
+ - diskMSIClientID
+ - fileMSIClientID
+ - imageRegistryMSIClientID
+ type: object
+ required:
+ - controlPlane
+ - dataPlane
+ type: object
+ workloadIdentities:
+ description: |-
+ workloadIdentities is a struct of client IDs for each component that needs to authenticate with Azure's API in
+ self-managed Azure. These client IDs are used to authenticate with Azure cloud on both the control plane and data
+ plane.
+
+ This is required for self-managed Azure.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is the client ID of a federated managed identity, associated with azure-cloud-provider, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ disk:
+ description: |-
+ disk is the client ID of a federated managed identity, associated with cluster-storage-operator-disk,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ file:
+ description: |-
+ file is the client ID of a federated managed identity, associated with cluster-storage-operator-file,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ imageRegistry:
+ description: |-
+ imageRegistry is the client ID of a federated managed identity, associated with cluster-image-registry-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ ingress:
+ description: |-
+ ingress is the client ID of a federated managed identity, associated with cluster-ingress-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ network:
+ description: |-
+ network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ nodePoolManagement:
+ description: |-
+ nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
+ in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ required:
+ - cloudProvider
+ - disk
+ - file
+ - imageRegistry
+ - ingress
+ - network
+ - nodePoolManagement
+ type: object
+ required:
+ - azureAuthenticationConfigType
+ type: object
+ x-kubernetes-validations:
+ - message: managedIdentities is required when azureAuthenticationConfigType
+ is ManagedIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''ManagedIdentities''
+ ? has(self.managedIdentities) : !has(self.managedIdentities)'
+ - message: workloadIdentities is required when azureAuthenticationConfigType
+ is WorkloadIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''WorkloadIdentities''
+ ? has(self.workloadIdentities) : !has(self.workloadIdentities)'
+ cloud:
+ default: AzurePublicCloud
+ description: 'cloud is the cloud environment identifier, valid
+ values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33'
+ enum:
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ location:
+ description: |-
+ location is the Azure region in where all the cloud infrastructure resources will be created.
+
+ Example: eastus
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: Location is immutable
+ rule: self == oldSelf
+ resourceGroup:
+ default: default
+ description: |-
+ resourceGroup is the name of an existing resource group where all cloud resources created by the Hosted
+ Cluster are to be placed. The resource group is expected to exist under the same subscription as SubscriptionID.
+
+ In ARO HCP, this will be the managed resource group where customer cloud resources will be created.
+
+ Resource group naming requirements can be found here: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ResourceGroup.Name/.
+
+ Example: if your resource group ID is /subscriptions//resourceGroups/, your
+ ResourceGroupName is .
+ maxLength: 90
+ pattern: ^[a-zA-Z0-9_()\-\.]{1,89}[a-zA-Z0-9_()\-]$
+ type: string
+ x-kubernetes-validations:
+ - message: ResourceGroupName is immutable
+ rule: self == oldSelf
+ securityGroupID:
+ description: |-
+ securityGroupID is the ID of an existing security group on the SubnetID. This field is provided as part of the
+ configuration for the Azure cloud provider, aka Azure cloud controller manager (CCM). This security group is
+ expected to exist under the same subscription as SubscriptionID.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SecurityGroupID is immutable
+ rule: self == oldSelf
+ subnetID:
+ description: |-
+ subnetID is the subnet ID of an existing subnet where the nodes in the nodepool will be created. This can be a
+ different subnet than the one listed in the HostedCluster, HostedCluster.Spec.Platform.Azure.SubnetID, but must
+ exist in the same network, HostedCluster.Spec.Platform.Azure.VnetID, and must exist under the same subscription ID,
+ HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ subnetID is immutable once set.
+ The subnetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The vnetName should be between 2 and 64 characters, consisting only of alphanumeric characters, hyphens, underscores and periods and must not end with either a period (.) or hyphen (-) character.
+ The subnetName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores and must start with an alphanumeric character and must not end with a period (.) or hyphen (-) character.
+ maxLength: 355
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`
+ rule: size(self.split('/')) == 11 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Network/virtualNetworks/.*/subnets/.*$')
+ - message: The resourceGroupName should be between 1 and 90
+ characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the subnetID must not
+ end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The vnetName should be between 2 and 64 characters,
+ consisting only of alphanumeric characters, hyphens, underscores
+ and periods
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_\\.]{2,64}')
+ - message: the vnetName in the subnetID must not end with
+ either a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[8].endsWith(''.'') && !self.split(''/'')[8].endsWith(''-'')'
+ - message: The subnetName should be between 1 and 80 characters,
+ consisting only of alphanumeric characters, hyphens and
+ underscores and must start with an alphanumeric character
+ rule: self.split('/')[10].matches('[a-zA-Z0-9][a-zA-Z0-9-_\\.]{0,79}')
+ - message: the subnetName in the subnetID must not end with
+ a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[10].endsWith(''.'') && !self.split(''/'')[10].endsWith(''-'')'
+ - message: SubnetID is immutable
+ rule: self == oldSelf
+ subscriptionID:
+ description: subscriptionID is a unique identifier for an
+ Azure subscription used to manage resources.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SubscriptionID is immutable
+ rule: self == oldSelf
+ tenantID:
+ description: tenantID is a unique identifier for the tenant
+ where Azure resources will be created and managed in.
+ maxLength: 255
+ type: string
+ vnetID:
+ description: |-
+ vnetID is the ID of an existing VNET to use in creating VMs. The VNET can exist in a different resource group
+ other than the one specified in ResourceGroupName, but it must exist under the same subscription as
+ SubscriptionID.
+
+ In ARO HCP, this will be the ID of the customer provided VNET.
+
+ Example: /subscriptions//resourceGroups//providers/Microsoft.Network/virtualNetworks/
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: VnetID is immutable
+ rule: self == oldSelf
+ required:
+ - azureAuthenticationConfig
+ - location
+ - resourceGroup
+ - securityGroupID
+ - subnetID
+ - subscriptionID
+ - tenantID
+ - vnetID
+ type: object
+ gcp:
+ description: gcp specifies configuration for clusters running
+ on Google Cloud Platform.
+ properties:
+ endpointAccess:
+ default: Private
+ description: |-
+ endpointAccess controls API endpoint accessibility for the HostedControlPlane on GCP.
+ Allowed values: "Private", "PublicAndPrivate". Defaults to "Private".
+ enum:
+ - PublicAndPrivate
+ - Private
+ type: string
+ networkConfig:
+ description: |-
+ networkConfig specifies VPC configuration for Private Service Connect.
+ Required for VPC configuration in Private Service Connect deployments.
+ properties:
+ network:
+ description: network is the VPC network name
+ properties:
+ name:
+ description: name is the name of the GCP resource
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ required:
+ - name
+ type: object
+ privateServiceConnectSubnet:
+ description: privateServiceConnectSubnet is the subnet
+ for Private Service Connect endpoints
+ properties:
+ name:
+ description: name is the name of the GCP resource
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - network
+ - privateServiceConnectSubnet
+ type: object
+ project:
+ description: |-
+ project is the GCP project ID.
+ A valid project ID must satisfy the following rules:
+ length: Must be between 6 and 30 characters, inclusive
+ characters: Only lowercase letters (`a-z`), digits (`0-9`), and hyphens (`-`) are allowed
+ start and end: Must begin with a lowercase letter and must not end with a hyphen
+ hyphens: No consecutive hyphens are allowed (e.g., "my--project" is invalid)
+ valid examples: "my-project", "my-project-1", "my-project-123".
+ maxLength: 30
+ minLength: 6
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ x-kubernetes-validations:
+ - message: Project is immutable
+ rule: self == oldSelf
+ region:
+ description: |-
+ region is the GCP region in which the cluster resides.
+ A valid region must satisfy the following rules:
+ format: Must be in the form `-`
+ characters: Only lowercase letters (`a-z`), digits (`0-9`), and a single hyphen (`-`) separator
+ valid examples: "us-central1", "europe-west2"
+ region must not include zone suffixes (e.g., "-a").
+ For a full list of valid regions, see: https://cloud.google.com/compute/docs/regions-zones.
+ maxLength: 63
+ pattern: ^[a-z]+-[a-z0-9]+[0-9]$
+ type: string
+ x-kubernetes-validations:
+ - message: Region is immutable
+ rule: self == oldSelf
+ required:
+ - networkConfig
+ - project
+ - region
+ type: object
+ ibmcloud:
+ description: ibmcloud defines IBMCloud specific settings for components
+ properties:
+ providerType:
+ description: providerType is a specific supported infrastructure
+ provider within IBM Cloud.
+ type: string
+ type: object
+ kubevirt:
+ description: kubevirt defines KubeVirt specific settings for cluster
+ components.
+ properties:
+ baseDomainPassthrough:
+ description: |-
+ baseDomainPassthrough toggles whether or not an automatically
+ generated base domain for the guest cluster should be used that
+ is a subdomain of the management cluster's *.apps DNS.
+
+ For the KubeVirt platform, the basedomain can be autogenerated using
+ the *.apps domain of the management/infra hosting cluster
+ This makes the guest cluster's base domain a subdomain of the
+ hypershift infra/mgmt cluster's base domain.
+
+ Example:
+ Infra/Mgmt cluster's DNS
+ Base: example.com
+ Cluster: mgmt-cluster.example.com
+ Apps: *.apps.mgmt-cluster.example.com
+ KubeVirt Guest cluster's DNS
+ Base: apps.mgmt-cluster.example.com
+ Cluster: guest.apps.mgmt-cluster.example.com
+ Apps: *.apps.guest.apps.mgmt-cluster.example.com
+
+ This is possible using OCP wildcard routes
+ type: boolean
+ x-kubernetes-validations:
+ - message: baseDomainPassthrough is immutable
+ rule: self == oldSelf
+ credentials:
+ description: |-
+ credentials defines the client credentials used when creating KubeVirt virtual machines.
+ Defining credentials is only necessary when the KubeVirt virtual machines are being placed
+ on a cluster separate from the one hosting the Hosted Control Plane components.
+
+ The default behavior when Credentials is not defined is for the KubeVirt VMs to be placed on
+ the same cluster and namespace as the Hosted Control Plane.
+ properties:
+ infraKubeConfigSecret:
+ description: |-
+ infraKubeConfigSecret is a reference to the secret containing the kubeconfig
+ of an external infrastructure cluster for kubevirt provider
+ properties:
+ key:
+ description: key is the key in the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: infraKubeConfigSecret is immutable
+ rule: self == oldSelf
+ infraNamespace:
+ description: |-
+ infraNamespace is the namespace in the external infrastructure cluster
+ where kubevirt resources will be created
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: infraNamespace is immutable
+ rule: self == oldSelf
+ required:
+ - infraNamespace
+ type: object
+ generateID:
+ description: |-
+ generateID is used to uniquely apply a name suffix to resources associated with
+ kubevirt infrastructure resources
+ maxLength: 11
+ type: string
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is immutable once set
+ rule: self == oldSelf
+ storageDriver:
+ description: |-
+ storageDriver defines how the KubeVirt CSI driver exposes StorageClasses on
+ the infra cluster (hosting the VMs) to the guest cluster.
+ properties:
+ manual:
+ description: |-
+ manual is used to explicitly define how the infra storageclasses are
+ mapped to guest storageclasses
+ properties:
+ storageClassMapping:
+ description: |-
+ storageClassMapping maps StorageClasses on the infra cluster hosting
+ the KubeVirt VMs to StorageClasses that are made available within the
+ Guest Cluster.
+
+ NOTE: It is possible that not all capabilities of an infra cluster's
+ storageclass will be present for the corresponding guest clusters storageclass.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestStorageClassName:
+ description: |-
+ guestStorageClassName is the name that the corresponding storageclass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraStorageClassName:
+ description: |-
+ infraStorageClassName is the name of the infra cluster storage class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestStorageClassName
+ - infraStorageClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: storageClassMapping is immutable
+ rule: self == oldSelf
+ volumeSnapshotClassMapping:
+ description: |-
+ volumeSnapshotClassMapping maps VolumeSnapshotClasses on the infra cluster hosting
+ the KubeVirt VMs to VolumeSnapshotClasses that are made available within the
+ Guest Cluster.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestVolumeSnapshotClassName:
+ description: |-
+ guestVolumeSnapshotClassName is the name that the corresponding volumeSnapshotClass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraVolumeSnapshotClassName:
+ description: |-
+ infraVolumeSnapshotClassName is the name of the infra cluster volume snapshot class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestVolumeSnapshotClassName
+ - infraVolumeSnapshotClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: volumeSnapshotClassMapping is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver.Manual is immutable
+ rule: self == oldSelf
+ type:
+ default: Default
+ description: type represents the type of kubevirt csi
+ driver configuration to use
+ enum:
+ - None
+ - Default
+ - Manual
+ type: string
+ x-kubernetes-validations:
+ - message: storageDriver.Type is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is required once set
+ rule: '!has(oldSelf.generateID) || has(self.generateID)'
+ openstack:
+ description: openstack specifies configuration for clusters running
+ on OpenStack.
+ properties:
+ disableExternalNetwork:
+ description: |-
+ disableExternalNetwork specifies whether or not to attempt to connect the cluster
+ to an external network. This allows for the creation of clusters when connecting
+ to an external network is not possible or desirable, e.g. if using a provider network.
+ type: boolean
+ externalNetwork:
+ description: |-
+ externalNetwork is the OpenStack Network to be used to get public internet to the VMs.
+ This option is ignored if DisableExternalNetwork is set to true.
+
+ If ExternalNetwork is defined it must refer to exactly one external network.
+
+ If ExternalNetwork is not defined or is empty the controller will use any
+ existing external network as long as there is only one. It is an
+ error if ExternalNetwork is not defined and there are multiple
+ external networks unless DisableExternalNetwork is also set.
+
+ If ExternalNetwork is not defined and there are no external networks
+ the controller will proceed as though DisableExternalNetwork was set.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ network. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ network to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the network to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the network
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the network to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ identityRef:
+ description: |-
+ identityRef is a reference to a secret holding OpenStack credentials
+ to be used when reconciling the hosted cluster.
+ properties:
+ cloudName:
+ description: cloudName specifies the name of the entry
+ in the clouds.yaml file to use.
+ maxLength: 255
+ type: string
+ name:
+ description: |-
+ name is the name of a secret in the same namespace as the resource being provisioned.
+ The secret must contain a key named `clouds.yaml` which contains an OpenStack clouds.yaml file.
+ The secret may optionally contain a key named `cacert` containing a PEM-encoded CA certificate.
+ maxLength: 255
+ type: string
+ required:
+ - cloudName
+ - name
+ type: object
+ ingressFloatingIP:
+ description: |-
+ ingressFloatingIP is an available floating IP in your OpenStack cluster that will
+ be associated with the OpenShift ingress port.
+ When not specified, an IP address will be assigned randomly by the OpenStack cloud provider.
+ When specified, the floating IP has to be pre-created. If the
+ specified value is not a floating IP or is already claimed, the
+ OpenStack cloud provider won't be able to provision the load
+ balancer.
+ This value must be a valid IPv4 or IPv6 address.
+ maxLength: 45
+ type: string
+ x-kubernetes-validations:
+ - message: floatingIP must be a valid IPv4 or IPv6 address
+ rule: isIP(self)
+ managedSubnets:
+ description: |-
+ managedSubnets describe the OpenStack Subnet to be created. Cluster actuator will create a network,
+ and a subnet with the defined DNSNameservers, AllocationPools and the CIDR defined in the HostedCluster
+ MachineNetwork, and a router connected to the subnet. Currently only one IPv4
+ subnet is supported.
+ items:
+ properties:
+ allocationPools:
+ description: |-
+ allocationPools is an array of AllocationPool objects that will be applied to OpenStack Subnet being created.
+ If set, OpenStack will only allocate these IPs for Machines. It will still be possible to create ports from
+ outside of these ranges manually.
+ items:
+ properties:
+ end:
+ description: end represents the end of the AlloctionPool,
+ that is the highest IP of the pool.
+ maxLength: 255
+ type: string
+ start:
+ description: start represents the start of the
+ AllocationPool, that is the lowest IP of the
+ pool.
+ maxLength: 255
+ type: string
+ required:
+ - end
+ - start
+ type: object
+ maxItems: 10
+ type: array
+ dnsNameservers:
+ description: |-
+ dnsNameservers holds a list of DNS server addresses that will be provided when creating
+ the subnet. These addresses need to have the same IP version as CIDR.
+ items:
+ maxLength: 45
+ type: string
+ maxItems: 10
+ type: array
+ type: object
+ maxItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network specifies an existing network to use if no ManagedSubnets
+ are specified.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ network. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ network to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the network to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the network
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the network to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ networkMTU:
+ description: networkMTU is the MTU for the network.
+ maximum: 9000
+ minimum: 1500
+ type: integer
+ router:
+ description: |-
+ router specifies an existing router to be used if ManagedSubnets are
+ specified. If specified, no new router will be created.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ router. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ router to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the router to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the router
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the router to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ subnets:
+ description: |-
+ subnets specifies existing subnets to use if not ManagedSubnets are
+ specified. All subnets must be in the network specified by Network.
+ There can be zero, one, or two subnets. If no subnets are specified,
+ all subnets in Network will be used. If 2 subnets are specified, one
+ must be IPv4 and the other IPv6.
+ items:
+ description: SubnetParam specifies an OpenStack subnet to
+ use. It may be specified by either ID or filter, but not
+ both.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select the
+ subnet. It must match exactly one subnet.
+ minProperties: 1
+ properties:
+ cidr:
+ description: cidr is the CIDR of the subnet to filter
+ by.
+ maxLength: 45
+ type: string
+ description:
+ description: description is the description of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ gatewayIP:
+ description: gatewayIP is the gateway IP of the
+ subnet to filter by.
+ maxLength: 45
+ type: string
+ ipVersion:
+ description: ipVersion is the IP version of the
+ subnet to filter by.
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ ipv6AddressMode:
+ description: ipv6AddressMode is the IPv6 address
+ mode of the subnet to filter by.
+ maxLength: 255
+ type: string
+ ipv6RAMode:
+ description: ipv6RAMode is the IPv6 RA mode of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the subnet to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the uuid of the subnet. It will not
+ be validated.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ tags:
+ description: tags to set on all resources in cluster which
+ support tags
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - identityRef
+ type: object
+ powervs:
+ description: |-
+ powervs specifies configuration for clusters running on IBMCloud Power VS Service.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ accountID:
+ description: |-
+ accountID is the IBMCloud account id.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the IBMCloud CIS Service Instance's Cloud Resource Name
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ pattern: '^crn:'
+ type: string
+ imageRegistryOperatorCloudCreds:
+ description: |-
+ imageRegistryOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for image registry operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ ingressOperatorCloudCreds:
+ description: |-
+ ingressOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for ingress operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ kubeCloudControllerCreds:
+ description: |
+ kubeCloudControllerCreds is a reference to a secret containing cloud
+ credentials with permissions matching the cloud controller policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ nodePoolManagementCreds:
+ description: |
+ nodePoolManagementCreds is a reference to a secret containing cloud
+ credentials with permissions matching the node pool management policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ region:
+ description: |-
+ region is the IBMCloud region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot image for a given release.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the IBMCloud Resource Group in which the cluster resides.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ serviceInstanceID:
+ description: |-
+ serviceInstanceID is the reference to the Power VS service on which the server instance(VM) will be created.
+ Power VS service is a container for all Power VS instances at a specific geographic region.
+ serviceInstance can be created via IBM Cloud catalog or CLI.
+ ServiceInstanceID is the unique identifier that can be obtained from IBM Cloud UI or IBM Cloud cli.
+
+ More detail about Power VS service instance.
+ https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-creating-power-virtual-server
+
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ storageOperatorCloudCreds:
+ description: |-
+ storageOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for storage operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ subnet:
+ description: |-
+ subnet is the subnet to use for control plane cloud resources.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ name:
+ description: name of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: |-
+ vpc specifies IBM Cloud PowerVS Load Balancing configuration for the control
+ plane.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ description: |-
+ name for VPC to used for all the service load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ region:
+ description: |-
+ region is the IBMCloud region in which VPC gets created, this VPC used for all the ingress traffic
+ into the OCP cluster.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ subnet:
+ description: |-
+ subnet is the subnet to use for load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where load balancer cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - region
+ type: object
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - accountID
+ - cisInstanceCRN
+ - imageRegistryOperatorCloudCreds
+ - ingressOperatorCloudCreds
+ - kubeCloudControllerCreds
+ - nodePoolManagementCreds
+ - region
+ - resourceGroup
+ - serviceInstanceID
+ - storageOperatorCloudCreds
+ - subnet
+ - vpc
+ - zone
+ type: object
+ type:
+ description: type is the type of infrastructure provider for the
+ cluster.
+ enum:
+ - AWS
+ - Azure
+ - IBMCloud
+ - KubeVirt
+ - Agent
+ - PowerVS
+ - None
+ - OpenStack
+ - GCP
+ maxLength: 100
+ type: string
+ x-kubernetes-validations:
+ - message: Type is immutable
+ rule: self == oldSelf
+ required:
+ - type
+ type: object
+ pullSecret:
+ description: pullSecret is a reference to a secret containing the
+ pull secret for the hosted control plane.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ releaseImage:
+ description: releaseImage is the release image applied to the hosted
+ control plane.
+ maxLength: 255
+ type: string
+ secretEncryption:
+ description: |-
+ secretEncryption contains metadata about the kubernetes secret encryption strategy being used for the
+ cluster when applicable.
+ properties:
+ aescbc:
+ description: aescbc defines metadata about the AESCBC secret encryption
+ strategy
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to encrypt
+ new secrets
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - activeKey
+ type: object
+ kms:
+ description: kms defines metadata about the kms secret encryption
+ strategy
+ properties:
+ aws:
+ description: aws defines metadata about the configuration
+ of the AWS KMS Secret Encryption provider
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ auth:
+ description: auth defines metadata about the management
+ of credentials used to interact with AWS KMS
+ properties:
+ awsKms:
+ description: "awsKms is an ARN value referencing a
+ role appropriate for managing the auth via the AWS
+ KMS key.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n \t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"kms:Encrypt\",\n\t\t\t\t\"kms:Decrypt\",\n\t\t\t\t\"kms:ReEncrypt*\",\n\t\t\t\t\"kms:GenerateDataKey*\",\n\t\t\t\t\"kms:DescribeKey\"\n\t\t\t],\n\t\t\t\"Resource\":
+ %q\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - awsKms
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ region:
+ description: region contains the AWS region
+ maxLength: 255
+ type: string
+ required:
+ - activeKey
+ - auth
+ - region
+ type: object
+ azure:
+ description: azure defines metadata about the configuration
+ of the Azure KMS Secret Encryption provider using Azure
+ key vault
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ kms:
+ description: kms is a pre-existing managed identity used
+ to authenticate with Azure KMS.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity must
+ be a valid UUID. It should be 5 groups of hyphen
+ separated hexadecimal characters in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - activeKey
+ - kms
+ type: object
+ ibmcloud:
+ description: ibmcloud defines metadata for the IBM Cloud KMS
+ encryption strategy
+ properties:
+ auth:
+ description: auth defines metadata for how authentication
+ is done with IBM Cloud KMS
+ properties:
+ managed:
+ description: |-
+ managed defines metadata around the service to service authentication strategy for the IBM Cloud
+ KMS system (all provider managed).
+ type: object
+ type:
+ description: type defines the IBM Cloud KMS authentication
+ strategy
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ unmanaged:
+ description: unmanaged defines the auth metadata the
+ customer provides to interact with IBM Cloud KMS
+ properties:
+ credentials:
+ description: |-
+ credentials should reference a secret with a key field of IBMCloudIAMAPIKeySecretKey that contains a apikey to
+ call IBM Cloud KMS APIs
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - credentials
+ type: object
+ required:
+ - type
+ type: object
+ keyList:
+ description: keyList defines the list of keys used for
+ data encryption
+ items:
+ description: IBMCloudKMSKeyEntry defines metadata for
+ an IBM Cloud KMS encryption key
+ properties:
+ correlationID:
+ description: correlationID is an identifier used
+ to track all api call usage from hypershift
+ maxLength: 255
+ type: string
+ crkID:
+ description: crkID is the customer rook key id
+ maxLength: 255
+ type: string
+ instanceID:
+ description: instanceID is the id for the key protect
+ instance
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: |-
+ keyVersion is a unique number associated with the key. The number increments whenever a new
+ key is enabled for data encryption.
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ url:
+ description: url is the url to call key protect
+ apis over
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - correlationID
+ - crkID
+ - instanceID
+ - keyVersion
+ - url
+ type: object
+ maxItems: 100
+ type: array
+ region:
+ description: region is the IBM Cloud region
+ maxLength: 255
+ type: string
+ required:
+ - auth
+ - keyList
+ - region
+ type: object
+ provider:
+ description: provider defines the KMS provider
+ enum:
+ - IBMCloud
+ - AWS
+ - Azure
+ type: string
+ required:
+ - provider
+ type: object
+ type:
+ description: type defines the type of kube secret encryption being
+ used
+ enum:
+ - kms
+ - aescbc
+ type: string
+ required:
+ - type
+ type: object
+ serviceAccountSigningKey:
+ description: |-
+ serviceAccountSigningKey is a reference to a secret containing the private key
+ used by the service account token issuer. The secret is expected to contain
+ a single key named "key". If not specified, a service account signing key will
+ be generated automatically for the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ services:
+ description: |-
+ services defines metadata about how control plane services are published
+ in the management cluster.
+ items:
+ description: |-
+ ServicePublishingStrategyMapping specifies how individual control plane services endpoints are published for consumption.
+ This includes APIServer;OAuthServer;Konnectivity;Ignition.
+ If a given service is not present in this list, it will be exposed publicly by default.
+ properties:
+ service:
+ description: |-
+ service identifies the type of service being published.
+ It can be APIServer;OAuthServer;Konnectivity;Ignition
+ OVNSbDb;OIDC are no-op and kept for backward compatibility.
+ This field is immutable.
+ enum:
+ - APIServer
+ - OAuthServer
+ - OIDC
+ - Konnectivity
+ - Ignition
+ - OVNSbDb
+ type: string
+ servicePublishingStrategy:
+ description: servicePublishingStrategy specifies how to publish
+ a service endpoint.
+ properties:
+ loadBalancer:
+ description: loadBalancer configures exposing a service
+ using a dedicated LoadBalancer.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the LoadBalancer and passed through to consumers of the service.
+ If omitted, the value will be inferred from the corev1.Service Load balancer type .status.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ nodePort:
+ description: nodePort configures exposing a service using
+ a NodePort.
+ properties:
+ address:
+ description: address is the host/ip that the NodePort
+ service is exposed over.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: address must be a valid hostname, IPv4, or
+ IPv6 address
+ rule: self.matches('^(([a-zA-Z0-9][-a-zA-Z0-9]*\\.)+[a-zA-Z]{2,}|localhost)$')
+ || self.matches('^((\\d{1,3}\\.){3}\\d{1,3})$')
+ || self.matches('^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$')
+ port:
+ description: |-
+ port is the port of the NodePort service. If <=0, the port is dynamically
+ assigned when the service is created.
+ format: int32
+ type: integer
+ required:
+ - address
+ type: object
+ route:
+ description: |-
+ route configures exposing a service using a Route through and an ingress controller behind a cloud Load Balancer.
+ The specifics of the setup are platform dependent.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the Route and passed through to consumers of the service.
+ If omitted, the value will be inferred from management ingress.Spec.Domain.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy used for the service.
+ It can be LoadBalancer;NodePort;Route;None;S3
+ enum:
+ - LoadBalancer
+ - NodePort
+ - Route
+ - None
+ - S3
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: nodePort is required when type is NodePort, and forbidden
+ otherwise
+ rule: 'self.type == ''NodePort'' ? has(self.nodePort) : !has(self.nodePort)'
+ - message: only route is allowed when type is Route, and forbidden
+ otherwise
+ rule: 'self.type == ''Route'' ? !has(self.nodePort) && !has(self.loadBalancer)
+ : !has(self.route)'
+ - message: only loadBalancer is required when type is LoadBalancer,
+ and forbidden otherwise
+ rule: 'self.type == ''LoadBalancer'' ? !has(self.nodePort)
+ && !has(self.route) : !has(self.loadBalancer)'
+ - message: None does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''None'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ - message: S3 does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''S3'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ required:
+ - service
+ - servicePublishingStrategy
+ type: object
+ maxItems: 6
+ type: array
+ sshKey:
+ description: sshKey is a reference to a secret containing the SSH
+ key for the hosted control plane.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ tolerations:
+ description: tolerations when specified, define what custom tolerations
+ are added to the hcp pods.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ maxItems: 25
+ type: array
+ updateService:
+ description: |-
+ updateService may be used to specify the preferred upstream update service.
+ By default it will use the appropriate update service for the cluster and region.
+ type: string
+ required:
+ - dns
+ - etcd
+ - infraID
+ - issuerURL
+ - platform
+ - pullSecret
+ - releaseImage
+ - services
+ - sshKey
+ type: object
+ x-kubernetes-validations:
+ - message: spec.services in body should have at least 4 items or 3 for
+ IBMCloud
+ rule: 'self.platform.type == ''IBMCloud'' ? size(self.services) >= 3
+ : size(self.services) >= 4'
+ - message: disableMultiNetwork can only be set to true when networkType
+ is 'Other'
+ rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)
+ || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork)
+ || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork
+ || self.networking.networkType == ''Other'''
+ status:
+ description: status is the status of the HostedControlPlane.
+ properties:
+ conditions:
+ description: |-
+ conditions contains details for one aspect of the current state of the HostedControlPlane.
+ Current condition types are: "Available"
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ configuration:
+ description: configuration contains the cluster configuration status
+ of the HostedCluster
+ properties:
+ authentication:
+ description: |-
+ authentication contains the observed authentication configuration status from the hosted cluster.
+ This field reflects the current state of the cluster authentication including OAuth metadata,
+ OIDC client status, and other authentication-related configurations.
+ properties:
+ integratedOAuthMetadata:
+ description: |-
+ integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for the in-cluster integrated OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ This contains the observed value based on cluster state.
+ An explicitly set value in spec.oauthMetadata has precedence over this field.
+ This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
+ The key "oauthMetadata" is used to locate the data.
+ If the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config-managed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcClients:
+ description: |-
+ oidcClients is where participating operators place the current OIDC client status
+ for OIDC clients that can be customized by the cluster-admin.
+ items:
+ description: |-
+ OIDCClientStatus represents the current state
+ of platform components and how they interact with
+ the configured identity providers.
+ properties:
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component using the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component using the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ conditions:
+ description: |-
+ conditions are used to communicate the state of the `oidcClients` entry.
+
+ Supported conditions include Available, Degraded and Progressing.
+
+ If Available is true, the component is successfully using the configured client.
+ If Degraded is true, that means something has gone wrong trying to handle the client configuration.
+ If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or
+ in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ consumingUsers:
+ description: |-
+ consumingUsers is an optional list of ServiceAccounts requiring
+ read permissions on the `clientSecret` secret.
+
+ consumingUsers must not exceed 5 entries.
+ items:
+ description: ConsumingUser is an alias for string
+ which we add validation to. Currently only service
+ accounts are supported.
+ maxLength: 512
+ minLength: 1
+ pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ maxItems: 5
+ type: array
+ x-kubernetes-list-type: set
+ currentOIDCClients:
+ description: |-
+ currentOIDCClients is an optional list of clients that the component is currently using.
+ Entries must have unique issuerURL/clientID pairs.
+ items:
+ description: |-
+ OIDCClientReference is a reference to a platform component
+ client configuration.
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that specifies the client identifier, from
+ the identity provider, that the platform component is using for authentication
+ requests made to the identity provider.
+
+ clientID must not be empty.
+ minLength: 1
+ type: string
+ issuerURL:
+ description: |-
+ issuerURL is a required field that specifies the URL of the identity
+ provider that this client is configured to make requests against.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ oidcProviderName:
+ description: |-
+ oidcProviderName is a required reference to the 'name' of the identity provider
+ configured in 'oidcProviders' that this client is associated with.
+
+ oidcProviderName must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - clientID
+ - issuerURL
+ - oidcProviderName
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - issuerURL
+ - clientID
+ x-kubernetes-list-type: map
+ required:
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ type: object
+ type: object
+ controlPlaneEndpoint:
+ description: |-
+ controlPlaneEndpoint contains the endpoint information by which
+ external clients can access the control plane. This is populated
+ after the infrastructure is ready.
+ properties:
+ host:
+ description: host is the hostname on which the API server is serving.
+ maxLength: 255
+ type: string
+ port:
+ description: port is the port on which the API server is serving.
+ format: int32
+ type: integer
+ required:
+ - host
+ - port
+ type: object
+ customKubeconfig:
+ description: |-
+ customKubeconfig references an external custom kubeconfig secret.
+ This field is populated in the status when a custom kubeconfig secret has been generated
+ for the hosted cluster. It contains the name and key of the secret located in the
+ hostedCluster namespace. This field is only populated when kubeApiExternalName is set.
+ If this field is removed during a day 2 operation, the referenced secret will be deleted
+ and this field will be removed from the hostedCluster status.
+ properties:
+ key:
+ description: key is the key in the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ externalManagedControlPlane:
+ default: true
+ description: |-
+ externalManagedControlPlane indicates to cluster-api that the control plane
+ is managed by an external service.
+ https://github.com/kubernetes-sigs/cluster-api/blob/65e5385bffd71bf4aad3cf34a537f11b217c7fab/controllers/machine_controller.go#L468
+ type: boolean
+ initialized:
+ default: false
+ description: |-
+ initialized denotes whether or not the control plane has
+ provided a kubeadm-config.
+ Once this condition is marked true, its value is never changed. See the Ready condition for an indication of
+ the current readiness of the cluster's control plane.
+ This satisfies CAPI contract https://github.com/kubernetes-sigs/cluster-api/blob/cd3a694deac89d5ebeb888307deaa61487207aa0/controllers/cluster_controller_phases.go#L238-L252
+ type: boolean
+ kubeConfig:
+ description: |-
+ kubeConfig is a reference to the secret containing the default kubeconfig
+ for this control plane.
+ properties:
+ key:
+ description: key is the key in the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ kubeadminPassword:
+ description: |-
+ kubeadminPassword is a reference to the secret containing the initial kubeadmin password
+ for the guest cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ lastReleaseImageTransitionTime:
+ description: |-
+ lastReleaseImageTransitionTime is the time of the last update to the current
+ releaseImage property.
+
+ Deprecated: Use versionStatus.history[0].startedTime instead.
+ format: date-time
+ type: string
+ nodeCount:
+ description: nodeCount tracks the number of nodes in the HostedControlPlane.
+ type: integer
+ oauthCallbackURLTemplate:
+ description: |-
+ oauthCallbackURLTemplate contains a template for the URL to use as a callback
+ for identity providers. The [identity-provider-name] placeholder must be replaced
+ with the name of an identity provider defined on the HostedCluster.
+ This is populated after the infrastructure is ready.
+ maxLength: 255
+ type: string
+ platform:
+ description: platform contains platform-specific status of the HostedCluster
+ properties:
+ aws:
+ description: aws contains platform-specific status for AWS
+ properties:
+ defaultWorkerSecurityGroupID:
+ description: |-
+ defaultWorkerSecurityGroupID is the ID of a security group created by
+ the control plane operator. It is always added to worker machines in
+ addition to any security groups specified in the NodePool.
+ maxLength: 255
+ type: string
+ type: object
+ type: object
+ ready:
+ default: false
+ description: |-
+ ready denotes that the HostedControlPlane API Server is ready to
+ receive requests
+ This satisfies CAPI contract https://github.com/kubernetes-sigs/cluster-api/blob/cd3a694deac89d5ebeb888307deaa61487207aa0/controllers/cluster_controller_phases.go#L226-L230
+ type: boolean
+ releaseImage:
+ description: |-
+ releaseImage is the release image applied to the hosted control plane.
+
+ Deprecated: Use versionStatus.desired.image instead.
+ maxLength: 255
+ type: string
+ version:
+ description: |-
+ version is the semantic version of the release applied by
+ the hosted control plane operator
+
+ Deprecated: Use versionStatus.desired.version instead.
+ maxLength: 255
+ type: string
+ versionStatus:
+ description: |-
+ versionStatus is the status of the release version applied by the
+ hosted control plane operator.
+ properties:
+ availableUpdates:
+ description: |-
+ availableUpdates contains updates recommended for this
+ cluster. Updates which appear in conditionalUpdates but not in
+ availableUpdates may expose this cluster to known issues. This list
+ may be empty if no updates are recommended, if the update service
+ is unavailable, or if an invalid channel has been specified.
+ items:
+ description: Release represents an OpenShift release image and
+ associated metadata.
+ properties:
+ architecture:
+ description: |-
+ architecture is an optional field that indicates the
+ value of the cluster architecture. In this context cluster
+ architecture means either a single architecture or a multi
+ architecture.
+ Valid values are 'Multi' and empty.
+ enum:
+ - Multi
+ - ""
+ type: string
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ maxItems: 100
+ nullable: true
+ type: array
+ conditionalUpdates:
+ description: |-
+ conditionalUpdates contains the list of updates that may be
+ recommended for this cluster if it meets specific required
+ conditions. Consumers interested in the set of updates that are
+ actually recommended for this cluster should use
+ availableUpdates. This list may be empty if no updates are
+ recommended, if the update service is unavailable, or if an empty
+ or invalid channel has been specified.
+ items:
+ description: |-
+ ConditionalUpdate represents an update which is recommended to some
+ clusters on the version the current cluster is reconciling, but which
+ may not be recommended for the current cluster.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the observations of the conditional update's
+ current status. Known types are:
+ * Recommended, for whether the update is recommended for the current cluster.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in
+ foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ release:
+ description: release is the target of the update.
+ properties:
+ architecture:
+ description: |-
+ architecture is an optional field that indicates the
+ value of the cluster architecture. In this context cluster
+ architecture means either a single architecture or a multi
+ architecture.
+ Valid values are 'Multi' and empty.
+ enum:
+ - Multi
+ - ""
+ type: string
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ risks:
+ description: |-
+ risks represents the range of issues associated with
+ updating to the target release. The cluster-version
+ operator will evaluate all entries, and only recommend the
+ update if there is at least one entry and all entries
+ recommend the update.
+ items:
+ description: |-
+ ConditionalUpdateRisk represents a reason and cluster-state
+ for not recommending a conditional update.
+ properties:
+ matchingRules:
+ description: |-
+ matchingRules is a slice of conditions for deciding which
+ clusters match the risk and which do not. The slice is
+ ordered by decreasing precedence. The cluster-version
+ operator will walk the slice in order, and stop after the
+ first it can successfully evaluate. If no condition can be
+ successfully evaluated, the update will not be recommended.
+ items:
+ description: |-
+ ClusterCondition is a union of typed cluster conditions. The 'type'
+ property determines which of the type-specific properties are relevant.
+ When evaluated on a cluster, the condition may match, not match, or
+ fail to evaluate.
+ properties:
+ promql:
+ description: promql represents a cluster condition
+ based on PromQL.
+ properties:
+ promql:
+ description: |-
+ promql is a PromQL query classifying clusters. This query
+ query should return a 1 in the match case and a 0 in the
+ does-not-match case. Queries which return no time
+ series, or which return values besides 0 or 1, are
+ evaluation failures.
+ type: string
+ required:
+ - promql
+ type: object
+ type:
+ description: |-
+ type represents the cluster-condition type. This defines
+ the members and semantics of any additional properties.
+ enum:
+ - Always
+ - PromQL
+ type: string
+ required:
+ - type
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ message:
+ description: |-
+ message provides additional information about the risk of
+ updating, in the event that matchingRules match the cluster
+ state. This is only to be consumed by humans. It may
+ contain Line Feed characters (U+000A), which should be
+ rendered as new lines.
+ minLength: 1
+ type: string
+ name:
+ description: |-
+ name is the CamelCase reason for not recommending a
+ conditional update, in the event that matchingRules match the
+ cluster state.
+ minLength: 1
+ type: string
+ url:
+ description: url contains information about this risk.
+ format: uri
+ minLength: 1
+ type: string
+ required:
+ - matchingRules
+ - message
+ - name
+ - url
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - release
+ - risks
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-type: atomic
+ desired:
+ description: |-
+ desired is the version that the cluster is reconciling towards.
+ If the cluster is not yet fully initialized desired will be set
+ with the information available, which may be an image or a tag.
+ properties:
+ architecture:
+ description: |-
+ architecture is an optional field that indicates the
+ value of the cluster architecture. In this context cluster
+ architecture means either a single architecture or a multi
+ architecture.
+ Valid values are 'Multi' and empty.
+ enum:
+ - Multi
+ - ""
+ type: string
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ history:
+ description: |-
+ history contains a list of the most recent versions applied to the cluster.
+ This value may be empty during cluster startup, and then will be updated
+ when a new update is being applied. The newest update is first in the
+ list and it is ordered by recency. Updates in the history have state
+ Completed if the rollout completed - if an update was failing or halfway
+ applied the state will be Partial. Only a limited amount of update history
+ is preserved.
+ items:
+ description: UpdateHistory is a single attempted update to the
+ cluster.
+ properties:
+ acceptedRisks:
+ description: |-
+ acceptedRisks records risks which were accepted to initiate the update.
+ For example, it may menition an Upgradeable=False or missing signature
+ that was overriden via desiredUpdate.force, or an update that was
+ initiated despite not being in the availableUpdates set of recommended
+ update targets.
+ type: string
+ completionTime:
+ description: |-
+ completionTime, if set, is when the update was fully applied. The update
+ that is currently being applied will have a null completion time.
+ Completion time will always be set for entries that are not the current
+ update (usually to the started time of the next update).
+ format: date-time
+ nullable: true
+ type: string
+ image:
+ description: |-
+ image is a container image location that contains the update. This value
+ is always populated.
+ type: string
+ startedTime:
+ description: startedTime is the time at which the update
+ was started.
+ format: date-time
+ type: string
+ state:
+ description: |-
+ state reflects whether the update was fully applied. The Partial state
+ indicates the update is not fully applied, while the Completed state
+ indicates the update was successfully rolled out at least once (all
+ parts of the update successfully applied).
+ type: string
+ verified:
+ description: |-
+ verified indicates whether the provided update was properly verified
+ before it was installed. If this is false the cluster may not be trusted.
+ Verified does not cover upgradeable checks that depend on the cluster
+ state at the time when the update target was accepted.
+ type: boolean
+ version:
+ description: |-
+ version is a semantic version identifying the update version. If the
+ requested image does not define a version, or if a failure occurs
+ retrieving the image, this value may be empty.
+ type: string
+ required:
+ - completionTime
+ - image
+ - startedTime
+ - state
+ - verified
+ type: object
+ type: array
+ observedGeneration:
+ description: |-
+ observedGeneration reports which version of the spec is being synced.
+ If this value is not equal to metadata.generation, then the desired
+ and conditions fields may represent a previous version.
+ format: int64
+ type: integer
+ required:
+ - availableUpdates
+ - desired
+ - observedGeneration
+ type: object
+ required:
+ - initialized
+ - ready
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/hostedcontrolplanes-Default.crd.yaml b/cmd/install/assets/hypershift-operator/hostedcontrolplanes-Default.crd.yaml
new file mode 100644
index 00000000000..57f1a725771
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/hostedcontrolplanes-Default.crd.yaml
@@ -0,0 +1,7082 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: Default
+ name: hostedcontrolplanes.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ categories:
+ - cluster-api
+ kind: HostedControlPlane
+ listKind: HostedControlPlaneList
+ plural: hostedcontrolplanes
+ shortNames:
+ - hcp
+ - hcps
+ singular: hostedcontrolplane
+ scope: Namespaced
+ versions:
+ - name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: HostedControlPlane defines the desired state of HostedControlPlane
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the specification for the HostedControlPlane.
+ properties:
+ additionalTrustBundle:
+ description: additionalTrustBundle references a ConfigMap containing
+ a PEM-encoded X.509 certificate bundle
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ auditWebhook:
+ description: |-
+ auditWebhook contains metadata for configuring an audit webhook
+ endpoint for a cluster to process cluster audit events. It references
+ a secret that contains the webhook information for the audit webhook endpoint.
+ It is a secret because if the endpoint has MTLS the kubeconfig will contain client
+ keys. This is currently only supported in IBM Cloud. The kubeconfig needs to be stored
+ in the secret with a secret key name that corresponds to the constant AuditWebhookKubeconfigKey.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ autoscaling:
+ description: |-
+ autoscaling specifies auto-scaling behavior that applies to all NodePools
+ associated with the control plane.
+ properties:
+ balancingIgnoredLabels:
+ description: |-
+ balancingIgnoredLabels sets "--balancing-ignore-label " flag on cluster-autoscaler for each listed label.
+ This option specifies labels that cluster autoscaler should ignore when considering node group similarity.
+ For example, if you have nodes with "topology.ebs.csi.aws.com/zone" label, you can add name of this label here
+ to prevent cluster autoscaler from splitting nodes into different node groups based on its value.
+
+ HyperShift automatically appends platform-specific balancing ignore labels:
+ - AWS: "lifecycle", "k8s.amazonaws.com/eniConfig", "topology.k8s.aws/zone-id"
+ - Azure: "agentpool", "kubernetes.azure.com/agentpool"
+ - Common:
+ - "hypershift.openshift.io/nodePool"
+ - "topology.ebs.csi.aws.com/zone"
+ - "topology.disk.csi.azure.com/zone"
+ - "ibm-cloud.kubernetes.io/worker-id"
+ - "vpc-block-csi-driver-labels"
+ These labels are added by default and do not need to be manually specified.
+ items:
+ maxLength: 317
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-validations:
+ - message: Each balancingIgnoredLabels item must be a valid label
+ key
+ rule: self.all(l, l.matches('^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?[a-zA-Z0-9]([a-zA-Z0-9_.-]{0,61}[a-zA-Z0-9])?$'))
+ expanders:
+ description: |-
+ expanders guide the autoscaler in choosing node groups during scale-out.
+ Sets the order of expanders for scaling out node groups.
+ Options include:
+ * LeastWaste - selects the group with minimal idle CPU and memory after scaling.
+ * Priority - selects the group with the highest user-defined priority.
+ * Random - selects a group randomly.
+ If not specified, `[Priority, LeastWaste]` is the default.
+ Maximum of 3 expanders can be specified.
+ items:
+ description: ExpanderString contains the name of an expander
+ to be used by the cluster autoscaler.
+ enum:
+ - LeastWaste
+ - Priority
+ - Random
+ type: string
+ maxItems: 3
+ minItems: 1
+ type: array
+ maxFreeDifferenceRatioPercent:
+ description: |-
+ maxFreeDifferenceRatioPercent sets the maximum difference ratio for free resources between similar node groups. This parameter controls how strict the similarity check is when comparing node groups for load balancing.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means node groups must have exactly the same free resources to be considered similar (no difference allowed).
+ When set to 100, this means node groups will be considered similar regardless of their free resource differences (any difference allowed).
+ A value between 0 and 100 represents the maximum allowed difference ratio for free resources between node groups to be considered similar.
+ When omitted, the autoscaler defaults to 10%.
+ This affects the "--max-free-difference-ratio" flag on cluster-autoscaler.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ maxNodeProvisionTime:
+ description: |-
+ maxNodeProvisionTime is the maximum time to wait for node provisioning
+ before considering the provisioning to be unsuccessful, expressed as a Go
+ duration string. The default is 15 minutes.
+ maxLength: 100
+ pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
+ type: string
+ maxNodesTotal:
+ description: |-
+ maxNodesTotal is the maximum allowable number of nodes for the Autoscaler scale out to be operational.
+ The autoscaler will not grow the cluster beyond this number.
+ If omitted, the autoscaler will not have a maximum limit.
+ number.
+ format: int32
+ minimum: 0
+ type: integer
+ maxPodGracePeriod:
+ description: |-
+ maxPodGracePeriod is the maximum seconds to wait for graceful pod
+ termination before scaling down a NodePool. The default is 600 seconds.
+ format: int32
+ minimum: 0
+ type: integer
+ podPriorityThreshold:
+ description: |-
+ podPriorityThreshold enables users to schedule "best-effort" pods, which
+ shouldn't trigger autoscaler actions, but only run when there are spare
+ resources available. The default is -10.
+
+ See the following for more details:
+ https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#how-does-cluster-autoscaler-work-with-pod-priority-and-preemption
+ format: int32
+ type: integer
+ scaleDown:
+ description: |-
+ scaleDown configures the behavior of the Cluster Autoscaler scale down operation.
+ This field is only valid when scaling is set to ScaleUpAndScaleDown.
+ properties:
+ delayAfterAddSeconds:
+ description: |-
+ delayAfterAddSeconds sets how long after scale up the scale down evaluation resumes in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after scale up, without any delay.
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterDeleteSeconds:
+ description: |-
+ delayAfterDeleteSeconds sets how long after node deletion, scale down evaluation resumes, defaults to scan-interval.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after node deletion, without any delay.
+ When omitted, the autoscaler defaults to 0s.
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterFailureSeconds:
+ description: |-
+ delayAfterFailureSeconds sets how long after a scale down failure, scale down evaluation resumes.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after a scale down failure, without any delay.
+ When omitted, the autoscaler defaults to 180s (3 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ unneededDurationSeconds:
+ description: |-
+ unneededDurationSeconds establishes how long a node should be unneeded before it is eligible for scale down in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ utilizationThresholdPercent:
+ description: |-
+ utilizationThresholdPercent determines the node utilization level, defined as sum of requested resources divided by capacity, below which a node can be considered for scale down.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means nodes will only be considered for scale down if they are completely idle (0% utilization).
+ When set to 100, this means nodes will be considered for scale down regardless of their utilization level.
+ A value between 0 and 100 represents the utilization threshold below which a node can be considered for scale down.
+ When omitted, the autoscaler defaults to 50%.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ type: object
+ scaling:
+ default: ScaleUpAndScaleDown
+ description: |-
+ scaling defines the scaling behavior for the cluster autoscaler.
+ ScaleUpOnly means the autoscaler will only scale up nodes, never scale down.
+ ScaleUpAndScaleDown means the autoscaler will both scale up and scale down nodes.
+ When set to ScaleUpAndScaleDown, the scaleDown field can be used to configure scale down behavior.
+
+ Note: This field is only supported in OpenShift versions 4.19 and above.
+ enum:
+ - ScaleUpOnly
+ - ScaleUpAndScaleDown
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: scaleDown can only be set when scaling is ScaleUpAndScaleDown
+ rule: 'self.scaling == ''ScaleUpAndScaleDown'' ? true : !has(self.scaleDown)'
+ capabilities:
+ default: {}
+ description: |-
+ capabilities allows for disabling optional components at cluster install time.
+ This field is optional and once set cannot be changed.
+ properties:
+ disabled:
+ description: |-
+ disabled when specified, explicitly disables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+
+ Note: Disabling 'openshift-samples','Insights', 'Console', 'NodeTuning', 'Ingress' are only supported in OpenShift versions 4.20 and above.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Disabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Ingress capability can only be disabled if Console
+ capability is also disabled
+ rule: '!self.exists(cap, cap == ''Ingress'') || self.exists(cap,
+ cap == ''Console'')'
+ enabled:
+ description: |-
+ enabled when specified, explicitly enables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Enabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Capabilities is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Capabilities can not be both enabled and disabled at once.
+ rule: 'has(self.enabled) && has(self.disabled) ? self.enabled.all(e,
+ !(e in self.disabled)) : true'
+ channel:
+ description: |-
+ channel is an identifier for explicitly requesting that a non-default
+ set of updates be applied to this cluster. The default channel will be
+ contain stable updates that are appropriate for production clusters.
+ maxLength: 255
+ type: string
+ clusterID:
+ description: |-
+ clusterID is the unique id that identifies the cluster externally.
+ Making it optional here allows us to keep compatibility with previous
+ versions of the control-plane-operator that have no knowledge of this
+ field.
+ maxLength: 255
+ type: string
+ configuration:
+ description: |-
+ configuration embeds resources that correspond to the openshift configuration API:
+ https://docs.openshift.com/container-platform/4.7/rest_api/config_apis/config-apis-index.html
+ properties:
+ apiServer:
+ description: |-
+ apiServer holds configuration (like serving certificates, client CA and CORS domains)
+ shared by all API servers in the system, among them especially kube-apiserver
+ and openshift-apiserver.
+ properties:
+ additionalCORSAllowedOrigins:
+ description: |-
+ additionalCORSAllowedOrigins lists additional, user-defined regular expressions describing hosts for which the
+ API server allows access using the CORS headers. This may be needed to access the API and the integrated OAuth
+ server from JavaScript applications.
+ The values are regular expressions that correspond to the Golang regular expression language.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ audit:
+ default:
+ profile: Default
+ description: |-
+ audit specifies the settings for audit configuration to be applied to all OpenShift-provided
+ API servers in the cluster.
+ properties:
+ customRules:
+ description: |-
+ customRules specify profiles per group. These profile take precedence over the
+ top-level profile field if they apply. They are evaluation from top to bottom and
+ the first one that matches, applies.
+ items:
+ description: |-
+ AuditCustomRule describes a custom rule for an audit profile that takes precedence over
+ the top-level profile.
+ properties:
+ group:
+ description: group is a name of group a request
+ user must be member of in order to this profile
+ to apply.
+ minLength: 1
+ type: string
+ profile:
+ description: |-
+ profile specifies the name of the desired audit policy configuration to be deployed to
+ all OpenShift-provided API servers in the cluster.
+
+ The following profiles are provided:
+ - Default: the existing default policy.
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ required:
+ - group
+ - profile
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - group
+ x-kubernetes-list-type: map
+ profile:
+ default: Default
+ description: |-
+ profile specifies the name of the desired top-level audit profile to be applied to all requests
+ sent to any of the OpenShift-provided API servers in the cluster (kube-apiserver,
+ openshift-apiserver and oauth-apiserver), with the exception of those requests that match
+ one or more of the customRules.
+
+ The following profiles are provided:
+ - Default: default policy which means MetaData level logging with the exception of events
+ (not logged at all), oauthaccesstokens and oauthauthorizetokens (both logged at RequestBody
+ level).
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ Warning: It is not recommended to disable audit logging by using the `None` profile unless you
+ are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues.
+ If you disable audit logging and a support situation arises, you might need to enable audit logging
+ and reproduce the issue in order to troubleshoot properly.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ type: object
+ clientCA:
+ description: |-
+ clientCA references a ConfigMap containing a certificate bundle for the signers that will be recognized for
+ incoming client certificates in addition to the operator managed signers. If this is empty, then only operator managed signers are valid.
+ You usually only have to set this if you have your own PKI you wish to honor client certificates from.
+ The ConfigMap must exist in the openshift-config namespace and contain the following required fields:
+ - ConfigMap.Data["ca-bundle.crt"] - CA bundle.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ encryption:
+ description: encryption allows the configuration of encryption
+ of resources at the datastore layer.
+ properties:
+ type:
+ description: |-
+ type defines what encryption type should be used to encrypt resources at the datastore layer.
+ When this field is unset (i.e. when it is set to the empty string), identity is implied.
+ The behavior of unset can and will change over time. Even if encryption is enabled by default,
+ the meaning of unset may change to a different encryption type based on changes in best practices.
+
+ When encryption is enabled, all sensitive resources shipped with the platform are encrypted.
+ This list of sensitive resources can and will change over time. The current authoritative list is:
+
+ 1. secrets
+ 2. configmaps
+ 3. routes.route.openshift.io
+ 4. oauthaccesstokens.oauth.openshift.io
+ 5. oauthauthorizetokens.oauth.openshift.io
+ enum:
+ - ""
+ - identity
+ - aescbc
+ - aesgcm
+ type: string
+ type: object
+ servingCerts:
+ description: |-
+ servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates
+ will be used for serving secure traffic.
+ properties:
+ namedCertificates:
+ description: |-
+ namedCertificates references secrets containing the TLS cert info for serving secure traffic to specific hostnames.
+ If no named certificates are provided, or no named certificates match the server name as understood by a client,
+ the defaultServingCertificate will be used.
+ items:
+ description: APIServerNamedServingCert maps a server
+ DNS name, as understood by a client, to a certificate.
+ properties:
+ names:
+ description: |-
+ names is a optional list of explicit DNS names (leading wildcards allowed) that should use this certificate to
+ serve secure traffic. If no names are provided, the implicit names will be extracted from the certificates.
+ Exact names trump over wildcard names. Explicit names defined here trump over extracted implicit names.
+ items:
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-list-type: atomic
+ servingCertificate:
+ description: |-
+ servingCertificate references a kubernetes.io/tls type secret containing the TLS cert info for serving secure traffic.
+ The secret must exist in the openshift-config namespace and contain the following required fields:
+ - Secret.Data["tls.key"] - TLS private key.
+ - Secret.Data["tls.crt"] - TLS certificate.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ tlsSecurityProfile:
+ description: |-
+ tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
+
+ If unset, a default (which may change between releases) is chosen. Note that only Old,
+ Intermediate and Custom profiles are currently supported, and the maximum available
+ minTLSVersion is VersionTLS12.
+ properties:
+ custom:
+ description: |-
+ custom is a user-defined TLS security profile. Be extremely careful using a custom
+ profile as invalid configurations can be catastrophic. An example custom profile
+ looks like this:
+
+ ciphers:
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ minTLSVersion: VersionTLS11
+ nullable: true
+ properties:
+ ciphers:
+ description: |-
+ ciphers is used to specify the cipher algorithms that are negotiated
+ during the TLS handshake. Operators may remove entries their operands
+ do not support. For example, to use DES-CBC3-SHA (yaml):
+
+ ciphers:
+ - DES-CBC3-SHA
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ minTLSVersion:
+ description: |-
+ minTLSVersion is used to specify the minimal version of the TLS protocol
+ that is negotiated during the TLS handshake. For example, to use TLS
+ versions 1.1, 1.2 and 1.3 (yaml):
+
+ minTLSVersion: VersionTLS11
+
+ NOTE: currently the highest minTLSVersion allowed is VersionTLS12
+ enum:
+ - VersionTLS10
+ - VersionTLS11
+ - VersionTLS12
+ - VersionTLS13
+ type: string
+ type: object
+ intermediate:
+ description: |-
+ intermediate is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ minTLSVersion: VersionTLS12
+ nullable: true
+ type: object
+ modern:
+ description: |-
+ modern is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ minTLSVersion: VersionTLS13
+ nullable: true
+ type: object
+ old:
+ description: |-
+ old is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ - DHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-ECDSA-AES128-SHA256
+
+ - ECDHE-RSA-AES128-SHA256
+
+ - ECDHE-ECDSA-AES128-SHA
+
+ - ECDHE-RSA-AES128-SHA
+
+ - ECDHE-ECDSA-AES256-SHA384
+
+ - ECDHE-RSA-AES256-SHA384
+
+ - ECDHE-ECDSA-AES256-SHA
+
+ - ECDHE-RSA-AES256-SHA
+
+ - DHE-RSA-AES128-SHA256
+
+ - DHE-RSA-AES256-SHA256
+
+ - AES128-GCM-SHA256
+
+ - AES256-GCM-SHA384
+
+ - AES128-SHA256
+
+ - AES256-SHA256
+
+ - AES128-SHA
+
+ - AES256-SHA
+
+ - DES-CBC3-SHA
+
+ minTLSVersion: VersionTLS10
+ nullable: true
+ type: object
+ type:
+ description: |-
+ type is one of Old, Intermediate, Modern or Custom. Custom provides
+ the ability to specify individual TLS security profile parameters.
+ Old, Intermediate and Modern are TLS security profiles based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
+
+ The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers
+ are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be
+ reduced.
+
+ Note that the Modern profile is currently not supported because it is not
+ yet well adopted by common software libraries.
+ enum:
+ - Old
+ - Intermediate
+ - Modern
+ - Custom
+ type: string
+ type: object
+ type: object
+ authentication:
+ description: |-
+ authentication specifies cluster-wide settings for authentication (like OAuth and
+ webhook token authenticators).
+ properties:
+ oauthMetadata:
+ description: |-
+ oauthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for an external OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ If oauthMetadata.name is non-empty, this value has precedence
+ over any metadata reference stored in status.
+ The key "oauthMetadata" is used to locate the data.
+ If specified and the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcProviders:
+ description: |-
+ oidcProviders are OIDC identity providers that can issue tokens
+ for this cluster
+ Can only be set if "Type" is set to "OIDC".
+
+ At most one provider can be configured.
+ items:
+ properties:
+ claimMappings:
+ description: |-
+ claimMappings is an optional field that configures the rules to be used by
+ the Kubernetes API server for translating claims in a JWT token, issued
+ by the identity provider, to a cluster identity.
+ properties:
+ extra:
+ description: |-
+ extra is an optional field for configuring the mappings
+ used to construct the extra attribute for the cluster identity.
+ When omitted, no extra attributes will be present on the cluster identity.
+ key values for extra mappings must be unique.
+ A maximum of 64 extra attribute mappings may be provided.
+ items:
+ description: |-
+ ExtraMapping allows specifying a key and CEL expression
+ to evaluate the keys' value. It is used to create additional
+ mappings and attributes added to a cluster identity from
+ a provided authentication token.
+ properties:
+ key:
+ description: |-
+ key is a required field that specifies the string
+ to use as the extra attribute key.
+
+ key must be a domain-prefix path (e.g 'example.org/foo').
+ key must not exceed 510 characters in length.
+ key must contain the '/' character, separating the domain and path characters.
+ key must not be empty.
+
+ The domain portion of the key (string of characters prior to the '/') must be a valid RFC1123 subdomain.
+ It must not exceed 253 characters in length.
+ It must start and end with an alphanumeric character.
+ It must only contain lower case alphanumeric characters and '-' or '.'.
+ It must not use the reserved domains, or be subdomains of, "kubernetes.io", "k8s.io", and "openshift.io".
+
+ The path portion of the key (string of characters after the '/') must not be empty and must consist of at least one
+ alphanumeric character, percent-encoded octets, '-', '.', '_', '~', '!', '$', '&', ''', '(', ')', '*', '+', ',', ';', '=', and ':'.
+ It must not exceed 256 characters in length.
+ maxLength: 510
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: key must contain the '/' character
+ rule: self.contains('/')
+ - message: the domain of the key must consist
+ of only lower case alphanumeric characters,
+ '-' or '.', and must start and end with
+ an alphanumeric character
+ rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
+ - message: the domain of the key must not
+ exceed 253 characters in length
+ rule: self.split('/', 2)[0].size() <= 253
+ - message: the domain 'kubernetes.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'kubernetes.io'
+ - message: the subdomains '*.kubernetes.io'
+ are reserved for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
+ - message: the domain 'k8s.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'k8s.io'
+ - message: the subdomains '*.k8s.io' are reserved
+ for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
+ - message: the domain 'openshift.io' is reserved
+ for OpenShift use
+ rule: self.split('/', 2)[0] != 'openshift.io'
+ - message: the subdomains '*.openshift.io'
+ are reserved for OpenShift use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
+ - message: the path of the key must not be
+ empty and must consist of at least one
+ alphanumeric character, percent-encoded
+ octets, apostrophe, '-', '.', '_', '~',
+ '!', '$', '&', '(', ')', '*', '+', ',',
+ ';', '=', and ':'
+ rule: self.split('/', 2)[1].matches('[A-Za-z0-9/\\-._~%!$&\'()*+;=:]+')
+ - message: the path of the key must not exceed
+ 256 characters in length
+ rule: self.split('/', 2)[1].size() <= 256
+ valueExpression:
+ description: |-
+ valueExpression is a required field to specify the CEL expression to extract
+ the extra attribute value from a JWT token's claims.
+ valueExpression must produce a string or string array value.
+ "", [], and null are treated as the extra mapping not being present.
+ Empty string values within an array are filtered out.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ valueExpression must not exceed 4096 characters in length.
+ valueExpression must not be empty.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ required:
+ - key
+ - valueExpression
+ type: object
+ maxItems: 64
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ groups:
+ description: |-
+ groups is an optional field that configures how the groups of a cluster identity
+ should be constructed from the claims in a JWT token issued
+ by the identity provider.
+ When referencing a claim, if the claim is present in the JWT
+ token, its value must be a list of groups separated by a comma (',').
+ For example - '"example"' and '"exampleOne", "exampleTwo", "exampleThree"' are valid claim values.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix is an optional field that configures the prefix that will be
+ applied to the cluster identity attribute during the process of mapping
+ JWT claims to cluster identity attributes.
+
+ When omitted (""), no prefix is applied to the cluster identity attribute.
+
+ Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains
+ an array of strings "a", "b" and "c", the mapping will result in an
+ array of string "myoidc:a", "myoidc:b" and "myoidc:c".
+ type: string
+ required:
+ - claim
+ type: object
+ uid:
+ description: |-
+ uid is an optional field for configuring the claim mapping
+ used to construct the uid for the cluster identity.
+
+ When using uid.claim to specify the claim it must be a single string value.
+ When using uid.expression the expression must result in a single string value.
+
+ When omitted, this means the user has no opinion and the platform
+ is left to choose a default, which is subject to change over time.
+ The current default is to use the 'sub' claim.
+ properties:
+ claim:
+ description: |-
+ claim is an optional field for specifying the
+ JWT token claim that is used in the mapping.
+ The value of this claim will be assigned to
+ the field in which this mapping is associated.
+
+ Precisely one of claim or expression must be set.
+ claim must not be specified when expression is set.
+ When specified, claim must be at least 1 character in length
+ and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ expression:
+ description: |-
+ expression is an optional field for specifying a
+ CEL expression that produces a string value from
+ JWT token claims.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ Precisely one of claim or expression must be set.
+ expression must not be specified when claim is set.
+ When specified, expression must be at least 1 character in length
+ and must not exceed 4096 characters in length.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: precisely one of claim or expression
+ must be set
+ rule: 'has(self.claim) ? !has(self.expression)
+ : has(self.expression)'
+ username:
+ description: |-
+ username is an optional field that configures how the username of a cluster identity
+ should be constructed from the claims in a JWT token issued by the identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix configures the prefix that should be prepended to the value
+ of the JWT claim.
+
+ prefix must be set when prefixPolicy is set to 'Prefix' and must be unset otherwise.
+ properties:
+ prefixString:
+ description: |-
+ prefixString is a required field that configures the prefix that will
+ be applied to cluster identity username attribute
+ during the process of mapping JWT claims to cluster identity attributes.
+
+ prefixString must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - prefixString
+ type: object
+ prefixPolicy:
+ description: |-
+ prefixPolicy is an optional field that configures how a prefix should be
+ applied to the value of the JWT claim specified in the 'claim' field.
+
+ Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
+
+ When set to 'Prefix', the value specified in the prefix field will be
+ prepended to the value of the JWT claim.
+ The prefix field must be set when prefixPolicy is 'Prefix'.
+
+ When set to 'NoPrefix', no prefix will be prepended to the value
+ of the JWT claim.
+
+ When omitted, this means no opinion and the platform is left to choose
+ any prefixes that are applied which is subject to change over time.
+ Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim
+ when the claim is not 'email'.
+ As an example, consider the following scenario:
+ `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
+ the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
+ and `claim` is set to:
+ - "username": the mapped value will be "https://myoidc.tld#userA"
+ - "email": the mapped value will be "userA@myoidc.tld"
+ enum:
+ - ""
+ - NoPrefix
+ - Prefix
+ type: string
+ required:
+ - claim
+ type: object
+ x-kubernetes-validations:
+ - message: prefix must be set if prefixPolicy is
+ 'Prefix', but must remain unset otherwise
+ rule: 'has(self.prefixPolicy) && self.prefixPolicy
+ == ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
+ > 0) : !has(self.prefix)'
+ type: object
+ claimValidationRules:
+ description: |-
+ claimValidationRules is an optional field that configures the rules to
+ be used by the Kubernetes API server for validating the claims in a JWT
+ token issued by the identity provider.
+
+ Validation rules are joined via an AND operation.
+ items:
+ properties:
+ requiredClaim:
+ description: |-
+ requiredClaim is an optional field that configures the required claim
+ and value that the Kubernetes API server will use to validate if an incoming
+ JWT is valid for this identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the name of the required claim.
+ When taken from the JWT claims, claim must be a string value.
+
+ claim must not be an empty string ("").
+ minLength: 1
+ type: string
+ requiredValue:
+ description: |-
+ requiredValue is a required field that configures the value that 'claim' must
+ have when taken from the incoming JWT claims.
+ If the value in the JWT claims does not match, the token
+ will be rejected for authentication.
+
+ requiredValue must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - claim
+ - requiredValue
+ type: object
+ type:
+ default: RequiredClaim
+ description: |-
+ type is an optional field that configures the type of the validation rule.
+
+ Allowed values are 'RequiredClaim' and omitted (not provided or an empty string).
+
+ When set to 'RequiredClaim', the Kubernetes API server
+ will be configured to validate that the incoming JWT
+ contains the required claim and that its value matches
+ the required value.
+
+ Defaults to 'RequiredClaim'.
+ enum:
+ - RequiredClaim
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ issuer:
+ description: |-
+ issuer is a required field that configures how the platform interacts
+ with the identity provider and how tokens issued from the identity provider
+ are evaluated by the Kubernetes API server.
+ properties:
+ audiences:
+ description: |-
+ audiences is a required field that configures the acceptable audiences
+ the JWT token, issued by the identity provider, must be issued to.
+ At least one of the entries must match the 'aud' claim in the JWT token.
+
+ audiences must contain at least one entry and must not exceed ten entries.
+ items:
+ minLength: 1
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ issuerCertificateAuthority:
+ description: |-
+ issuerCertificateAuthority is an optional field that configures the
+ certificate authority, used by the Kubernetes API server, to validate
+ the connection to the identity provider when fetching discovery information.
+
+ When not specified, the system trust is used.
+
+ When specified, it must reference a ConfigMap in the openshift-config
+ namespace containing the PEM-encoded CA certificates under the 'ca-bundle.crt'
+ key in the data field of the ConfigMap.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ issuerURL:
+ description: |-
+ issuerURL is a required field that configures the URL used to issue tokens
+ by the identity provider.
+ The Kubernetes API server determines how authentication tokens should be handled
+ by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ required:
+ - audiences
+ - issuerURL
+ type: object
+ name:
+ description: |-
+ name is a required field that configures the unique human-readable identifier
+ associated with the identity provider.
+ It is used to distinguish between multiple identity providers
+ and has no impact on token validation or authentication mechanics.
+
+ name must not be an empty string ("").
+ minLength: 1
+ type: string
+ oidcClients:
+ description: |-
+ oidcClients is an optional field that configures how on-cluster,
+ platform clients should request tokens from the identity provider.
+ oidcClients must not exceed 20 entries and entries must have unique namespace/name pairs.
+ items:
+ description: |-
+ OIDCClientConfig configures how platform clients
+ interact with identity providers as an authentication
+ method
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that configures the client identifier, from
+ the identity provider, that the platform component uses for authentication
+ requests made to the identity provider.
+ The identity provider must accept this identifier for platform components
+ to be able to use the identity provider as an authentication mode.
+
+ clientID must not be an empty string ("").
+ minLength: 1
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is an optional field that configures the client secret used
+ by the platform component when making authentication requests to the identity provider.
+
+ When not specified, no client secret will be used when making authentication requests
+ to the identity provider.
+
+ When specified, clientSecret references a Secret in the 'openshift-config'
+ namespace that contains the client secret in the 'clientSecret' key of the '.data' field.
+ The client secret will be used when making authentication requests to the identity provider.
+
+ Public clients do not require a client secret but private
+ clients do require a client secret to work with the identity provider.
+ properties:
+ name:
+ description: name is the metadata.name of
+ the referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component being configured to use the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component being configured to use the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ extraScopes:
+ description: |-
+ extraScopes is an optional field that configures the extra scopes that should
+ be requested by the platform component when making authentication requests to the
+ identity provider.
+ This is useful if you have configured claim mappings that requires specific
+ scopes to be requested beyond the standard OIDC scopes.
+
+ When omitted, no additional scopes are requested.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - clientID
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ required:
+ - issuer
+ - name
+ type: object
+ maxItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ serviceAccountIssuer:
+ description: |-
+ serviceAccountIssuer is the identifier of the bound service account token
+ issuer.
+ The default is https://kubernetes.default.svc
+ WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
+ previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
+ be trusted for a time period chosen by the platform (currently set to 24h).
+ This time period is subject to change over time.
+ This allows internal components to transition to use new service account issuer without service distruption.
+ type: string
+ type:
+ description: |-
+ type identifies the cluster managed, user facing authentication mode in use.
+ Specifically, it manages the component that responds to login attempts.
+ The default is IntegratedOAuth.
+ enum:
+ - ""
+ - None
+ - IntegratedOAuth
+ - OIDC
+ type: string
+ webhookTokenAuthenticator:
+ description: |-
+ webhookTokenAuthenticator configures a remote token reviewer.
+ These remote authentication webhooks can be used to verify bearer tokens
+ via the tokenreviews.authentication.k8s.io REST API. This is required to
+ honor bearer tokens that are provisioned by an external authentication service.
+
+ Can only be set if "Type" is set to "None".
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig references a secret that contains kube config file data which
+ describes how to access the remote webhook service.
+ The namespace for the referenced secret is openshift-config.
+
+ For further details, see:
+
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - kubeConfig
+ type: object
+ webhookTokenAuthenticators:
+ description: webhookTokenAuthenticators is DEPRECATED, setting
+ it has no effect.
+ items:
+ description: |-
+ deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
+ It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig contains kube config file data which describes how to access the remote webhook service.
+ For further details, see:
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ The namespace for this secret is determined by the point of use.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ featureGate:
+ description: featureGate holds cluster-wide information about
+ feature gates.
+ properties:
+ customNoUpgrade:
+ description: |-
+ customNoUpgrade allows the enabling or disabling of any feature. Turning this feature set on IS NOT SUPPORTED, CANNOT BE UNDONE, and PREVENTS UPGRADES.
+ Because of its nature, this setting cannot be validated. If you have any typos or accidentally apply invalid combinations
+ your cluster may fail in an unrecoverable way. featureSet must equal "CustomNoUpgrade" must be set to use this field.
+ nullable: true
+ properties:
+ disabled:
+ description: disabled is a list of all feature gates that
+ you want to force off
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ enabled:
+ description: enabled is a list of all feature gates that
+ you want to force on
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ type: object
+ featureSet:
+ description: |-
+ featureSet changes the list of features in the cluster. The default is empty. Be very careful adjusting this setting.
+ Turning on or off features may cause irreversible changes in your cluster which cannot be undone.
+ enum:
+ - CustomNoUpgrade
+ - DevPreviewNoUpgrade
+ - TechPreviewNoUpgrade
+ - ""
+ type: string
+ x-kubernetes-validations:
+ - message: CustomNoUpgrade may not be changed
+ rule: 'oldSelf == ''CustomNoUpgrade'' ? self == ''CustomNoUpgrade''
+ : true'
+ - message: TechPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''TechPreviewNoUpgrade'' ? self == ''TechPreviewNoUpgrade''
+ : true'
+ - message: DevPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''DevPreviewNoUpgrade'' ? self == ''DevPreviewNoUpgrade''
+ : true'
+ type: object
+ image:
+ description: |-
+ image governs policies related to imagestream imports and runtime configuration
+ for external registries. It allows cluster admins to configure which registries
+ OpenShift is allowed to import images from, extra CA trust bundles for external
+ registries, and policies to block or allow registry hostnames.
+ When exposing OpenShift's image registry to the public, this also lets cluster
+ admins specify the external hostname.
+ This input will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ additionalTrustedCA:
+ description: |-
+ additionalTrustedCA is a reference to a ConfigMap containing additional CAs that
+ should be trusted during imagestream import, pod image pull, build image pull, and
+ imageregistry pullthrough.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ allowedRegistriesForImport:
+ description: |-
+ allowedRegistriesForImport limits the container image registries that normal users may import
+ images from. Set this list to the registries that you trust to contain valid Docker
+ images and that you want applications to be able to import from. Users with
+ permission to create Images or ImageStreamMappings via the API are not affected by
+ this policy - typically only administrators or system integrations will have those
+ permissions.
+ items:
+ description: |-
+ RegistryLocation contains a location of the registry specified by the registry domain
+ name. The domain name might include wildcards, like '*' or '??'.
+ properties:
+ domainName:
+ description: |-
+ domainName specifies a domain name for the registry
+ In case the registry use non-standard (80 or 443) port, the port should be included
+ in the domain name as well.
+ type: string
+ insecure:
+ description: |-
+ insecure indicates whether the registry is secure (https) or insecure (http)
+ By default (if not specified) the registry is assumed as secure.
+ type: boolean
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalRegistryHostnames:
+ description: |-
+ externalRegistryHostnames provides the hostnames for the default external image
+ registry. The external hostname should be set only when the image registry
+ is exposed externally. The first value is used in 'publicDockerImageRepository'
+ field in ImageStreams. The value must be in "hostname[:port]" format.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ registrySources:
+ description: |-
+ registrySources contains configuration that determines how the container runtime
+ should treat individual registries when accessing images for builds+pods. (e.g.
+ whether or not to allow insecure access). It does not contain configuration for the
+ internal cluster registry.
+ properties:
+ allowedRegistries:
+ description: |-
+ allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ blockedRegistries:
+ description: |-
+ blockedRegistries cannot be used for image pull and push actions. All other registries are permitted.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ containerRuntimeSearchRegistries:
+ description: |-
+ containerRuntimeSearchRegistries are registries that will be searched when pulling images that do not have fully qualified
+ domains in their pull specs. Registries will be searched in the order provided in the list.
+ Note: this search list only works with the container runtime, i.e CRI-O. Will NOT work with builds or imagestream imports.
+ format: hostname
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ insecureRegistries:
+ description: insecureRegistries are registries which do
+ not have a valid TLS certificates or only support HTTP
+ connections.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-validations:
+ - message: Only one of blockedRegistries or allowedRegistries
+ may be set
+ rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
+ : true'
+ type: object
+ ingress:
+ description: |-
+ ingress holds cluster-wide information about ingress, including the default ingress domain
+ used for routes.
+ properties:
+ appsDomain:
+ description: |-
+ appsDomain is an optional domain to use instead of the one specified
+ in the domain field when a Route is created without specifying an explicit
+ host. If appsDomain is nonempty, this value is used to generate default
+ host values for Route. Unlike domain, appsDomain may be modified after
+ installation.
+ This assumes a new ingresscontroller has been setup with a wildcard
+ certificate.
+ type: string
+ componentRoutes:
+ description: |-
+ componentRoutes is an optional list of routes that are managed by OpenShift components
+ that a cluster-admin is able to configure the hostname and serving certificate for.
+ The namespace and name of each route in this list should match an existing entry in the
+ status.componentRoutes list.
+
+ To determine the set of configurable Routes, look at namespace and name of entries in the
+ .status.componentRoutes list, where participating operators write the status of
+ configurable routes.
+ items:
+ description: ComponentRouteSpec allows for configuration
+ of a route's hostname and serving certificate.
+ properties:
+ hostname:
+ description: hostname is the hostname that should be
+ used by the route.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ servingCertKeyPairSecret:
+ description: |-
+ servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
+ The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
+ If the custom hostname uses the default routing suffix of the cluster,
+ the Secret specification for a serving certificate will not be needed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - hostname
+ - name
+ - namespace
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ domain:
+ description: |-
+ domain is used to generate a default host name for a route when the
+ route's host name is empty. The generated host name will follow this
+ pattern: "..".
+
+ It is also used as the default wildcard domain suffix for ingress. The
+ default ingresscontroller domain will follow this pattern: "*.".
+
+ Once set, changing domain is not currently supported.
+ type: string
+ loadBalancer:
+ description: |-
+ loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
+ provider of the current cluster and are required for Ingress Controller to work on OpenShift.
+ properties:
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for the ingress load balancers.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains settings specific to the
+ Amazon Web Services infrastructure provider.
+ properties:
+ type:
+ description: |-
+ type allows user to set a load balancer type.
+ When this field is set the default ingresscontroller will get created using the specified LBType.
+ If this field is not set then the default ingress controller of LBType Classic will be created.
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - NLB
+ - Classic
+ type: string
+ required:
+ - type
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
+ "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
+ and must handle unrecognized platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ type: object
+ type: object
+ requiredHSTSPolicies:
+ description: |-
+ requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
+ matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
+ Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
+ annotation, and affect route admission.
+
+ A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
+ "haproxy.router.openshift.io/hsts_header"
+ E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
+
+ - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
+ is rejected.
+ - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
+ determines the route's admission status.
+ - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then it may use any HSTS Policy annotation.
+
+ The HSTS policy configuration may be changed after routes have already been created. An update to a previously
+ admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
+ However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
+
+ Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
+ items:
+ properties:
+ domainPatterns:
+ description: |-
+ domainPatterns is a list of domains for which the desired HSTS annotations are required.
+ If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
+ the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
+
+ The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
+ foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ includeSubDomainsPolicy:
+ description: |-
+ includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
+ domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
+ - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ enum:
+ - RequireIncludeSubDomains
+ - RequireNoIncludeSubDomains
+ - NoOpinion
+ type: string
+ maxAge:
+ description: |-
+ maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
+ If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
+ If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
+ maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
+ policy will eventually expire on that client.
+ properties:
+ largestMaxAge:
+ description: |-
+ The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ This value can be left unspecified, in which case no upper limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ smallestMaxAge:
+ description: |-
+ The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
+ tool for administrators to quickly correct mistakes.
+ This value can be left unspecified, in which case no lower limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ type: object
+ namespaceSelector:
+ description: |-
+ namespaceSelector specifies a label selector such that the policy applies only to those routes that
+ are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
+ Defaults to the empty LabelSelector, which matches everything.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label
+ selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the
+ selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ preloadPolicy:
+ description: |-
+ preloadPolicy directs the client to include hosts in its host preload list so that
+ it never needs to do an initial load to get the HSTS header (note that this is not defined
+ in RFC 6797 and is therefore client implementation-dependent).
+ enum:
+ - RequirePreload
+ - RequireNoPreload
+ - NoOpinion
+ type: string
+ required:
+ - domainPatterns
+ type: object
+ type: array
+ type: object
+ network:
+ description: |-
+ network holds cluster-wide information about the network. It is used to configure the desired network configuration, such as: IP address pools for services/pod IPs, network plugin, etc.
+ Please view network.spec for an explanation on what applies when configuring this resource.
+ properties:
+ clusterNetwork:
+ description: |-
+ IP address pool to use for pod IPs.
+ This field is immutable after installation.
+ items:
+ description: |-
+ ClusterNetworkEntry is a contiguous block of IP addresses from which pod IPs
+ are allocated.
+ properties:
+ cidr:
+ description: The complete block for pod IPs.
+ type: string
+ hostPrefix:
+ description: |-
+ The size (prefix) of block to allocate to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalIP:
+ description: |-
+ externalIP defines configuration for controllers that
+ affect Service.ExternalIP. If nil, then ExternalIP is
+ not allowed to be set.
+ properties:
+ autoAssignCIDRs:
+ description: |-
+ autoAssignCIDRs is a list of CIDRs from which to automatically assign
+ Service.ExternalIP. These are assigned when the service is of type
+ LoadBalancer. In general, this is only useful for bare-metal clusters.
+ In Openshift 3.x, this was misleadingly called "IngressIPs".
+ Automatically assigned External IPs are not affected by any
+ ExternalIPPolicy rules.
+ Currently, only one entry may be provided.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ policy:
+ description: |-
+ policy is a set of restrictions applied to the ExternalIP field.
+ If nil or empty, then ExternalIP is not allowed to be set.
+ properties:
+ allowedCIDRs:
+ description: allowedCIDRs is the list of allowed CIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ rejectedCIDRs:
+ description: |-
+ rejectedCIDRs is the list of disallowed CIDRs. These take precedence
+ over allowedCIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkDiagnostics:
+ description: |-
+ networkDiagnostics defines network diagnostics configuration.
+
+ Takes precedence over spec.disableNetworkDiagnostics in network.operator.openshift.io.
+ If networkDiagnostics is not specified or is empty,
+ and the spec.disableNetworkDiagnostics flag in network.operator.openshift.io is set to true,
+ the network diagnostics feature will be disabled.
+ properties:
+ mode:
+ description: |-
+ mode controls the network diagnostics mode
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is All.
+ enum:
+ - ""
+ - All
+ - Disabled
+ type: string
+ sourcePlacement:
+ description: |-
+ sourcePlacement controls the scheduling of network diagnostics source deployment
+
+ See NetworkDiagnosticsSourcePlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is an empty list.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ targetPlacement:
+ description: |-
+ targetPlacement controls the scheduling of network diagnostics target daemonset
+
+ See NetworkDiagnosticsTargetPlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `- operator: "Exists"` which means that all taints are tolerated.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkType:
+ description: |-
+ networkType is the plugin that is to be deployed (e.g. OVNKubernetes).
+ This should match a value that the cluster-network-operator understands,
+ or else no networking will be installed.
+ Currently supported values are:
+ - OVNKubernetes
+ This field is immutable after installation.
+ type: string
+ serviceNetwork:
+ description: |-
+ IP address pool for services.
+ Currently, we only support a single entry here.
+ This field is immutable after installation.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceNodePortRange:
+ description: |-
+ The port range allowed for Services of type NodePort.
+ If not specified, the default of 30000-32767 will be used.
+ Such Services without a NodePort specified will have one
+ automatically allocated from this range.
+ This parameter can be updated after the cluster is
+ installed.
+ pattern: ^([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])-([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot set networkDiagnostics.sourcePlacement and networkDiagnostics.targetPlacement
+ when networkDiagnostics.mode is Disabled
+ rule: '!has(self.networkDiagnostics) || !has(self.networkDiagnostics.mode)
+ || self.networkDiagnostics.mode!=''Disabled'' || !has(self.networkDiagnostics.sourcePlacement)
+ && !has(self.networkDiagnostics.targetPlacement)'
+ oauth:
+ description: |-
+ oauth holds cluster-wide information about OAuth.
+ It is used to configure the integrated OAuth server.
+ This configuration is only honored when the top level Authentication config has type set to IntegratedOAuth.
+ properties:
+ identityProviders:
+ description: |-
+ identityProviders is an ordered list of ways for a user to identify themselves.
+ When this list is empty, no identities are provisioned for users.
+ items:
+ description: IdentityProvider provides identities for users
+ authenticating using credentials
+ properties:
+ basicAuth:
+ description: basicAuth contains configuration options
+ for the BasicAuth IdP
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ github:
+ description: github enables user authentication using
+ GitHub credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ This can only be configured when hostname is set to a non-empty value.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostname:
+ description: |-
+ hostname is the optional domain (e.g. "mycompany.com") for use with a hosted instance of
+ GitHub Enterprise.
+ It must match the GitHub Enterprise settings value configured at /setup/settings#hostname.
+ type: string
+ organizations:
+ description: organizations optionally restricts
+ which organizations are allowed to log in
+ items:
+ type: string
+ type: array
+ teams:
+ description: teams optionally restricts which teams
+ are allowed to log in. Format is /.
+ items:
+ type: string
+ type: array
+ type: object
+ gitlab:
+ description: gitlab enables user authentication using
+ GitLab credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the oauth server base URL
+ type: string
+ type: object
+ google:
+ description: google enables user authentication using
+ Google credentials
+ properties:
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostedDomain:
+ description: hostedDomain is the optional Google
+ App domain (e.g. "mycompany.com") to restrict
+ logins to
+ type: string
+ type: object
+ htpasswd:
+ description: htpasswd enables user authentication using
+ an HTPasswd file to validate credentials
+ properties:
+ fileData:
+ description: |-
+ fileData is a required reference to a secret by name containing the data to use as the htpasswd file.
+ The key "htpasswd" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ If the specified htpasswd data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ keystone:
+ description: keystone enables user authentication using
+ keystone password credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ domainName:
+ description: domainName is required for keystone
+ v3
+ type: string
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ ldap:
+ description: ldap enables user authentication using
+ LDAP credentials
+ properties:
+ attributes:
+ description: attributes maps LDAP attributes to
+ identities
+ properties:
+ email:
+ description: |-
+ email is the list of attributes whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ id:
+ description: |-
+ id is the list of attributes whose values should be used as the user ID. Required.
+ First non-empty attribute is used. At least one attribute is required. If none of the listed
+ attribute have a value, authentication fails.
+ LDAP standard identity attribute is "dn"
+ items:
+ type: string
+ type: array
+ name:
+ description: |-
+ name is the list of attributes whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ LDAP standard display name attribute is "cn"
+ items:
+ type: string
+ type: array
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of attributes whose values should be used as the preferred username.
+ LDAP standard login attribute is "uid"
+ items:
+ type: string
+ type: array
+ type: object
+ bindDN:
+ description: bindDN is an optional DN to bind with
+ during the search phase.
+ type: string
+ bindPassword:
+ description: |-
+ bindPassword is an optional reference to a secret by name
+ containing a password to bind with during the search phase.
+ The key "bindPassword" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ insecure:
+ description: |-
+ insecure, if true, indicates the connection should not use TLS
+ WARNING: Should not be set to `true` with the URL scheme "ldaps://" as "ldaps://" URLs always
+ attempt to connect using TLS, even when `insecure` is set to `true`
+ When `true`, "ldap://" URLS connect insecurely. When `false`, "ldap://" URLs are upgraded to
+ a TLS connection using StartTLS as specified in https://tools.ietf.org/html/rfc2830.
+ type: boolean
+ url:
+ description: |-
+ url is an RFC 2255 URL which specifies the LDAP search parameters to use.
+ The syntax of the URL is:
+ ldap://host:port/basedn?attribute?scope?filter
+ type: string
+ type: object
+ mappingMethod:
+ description: |-
+ mappingMethod determines how identities from this provider are mapped to users
+ Defaults to "claim"
+ type: string
+ name:
+ description: |-
+ name is used to qualify the identities returned by this provider.
+ - It MUST be unique and not shared by any other identity provider used
+ - It MUST be a valid path segment: name cannot equal "." or ".." or contain "/" or "%" or ":"
+ Ref: https://godoc.org/github.com/openshift/origin/pkg/user/apis/user/validation#ValidateIdentityProviderName
+ type: string
+ openID:
+ description: openID enables user authentication using
+ OpenID credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ claims:
+ description: claims mappings
+ properties:
+ email:
+ description: |-
+ email is the list of claims whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ groups:
+ description: |-
+ groups is the list of claims value of which should be used to synchronize groups
+ from the OIDC provider to OpenShift for the user.
+ If multiple claims are specified, the first one with a non-empty value is used.
+ items:
+ description: |-
+ OpenIDClaim represents a claim retrieved from an OpenID provider's tokens or userInfo
+ responses
+ minLength: 1
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: |-
+ name is the list of claims whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of claims whose values should be used as the preferred username.
+ If unspecified, the preferred username is determined from the value of the sub claim
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ extraAuthorizeParameters:
+ additionalProperties:
+ type: string
+ description: extraAuthorizeParameters are any custom
+ parameters to add to the authorize request.
+ type: object
+ extraScopes:
+ description: extraScopes are any scopes to request
+ in addition to the standard "openid" scope.
+ items:
+ type: string
+ type: array
+ issuer:
+ description: |-
+ issuer is the URL that the OpenID Provider asserts as its Issuer Identifier.
+ It must use the https scheme with no query or fragment component.
+ type: string
+ type: object
+ requestHeader:
+ description: requestHeader enables user authentication
+ using request header credentials
+ properties:
+ ca:
+ description: |-
+ ca is a required reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ Specifically, it allows verification of incoming requests to prevent header spoofing.
+ The key "ca.crt" is used to locate the data.
+ If the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ challengeURL:
+ description: |-
+ challengeURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect WWW-Authenticate challenges will be
+ redirected here.
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when challenge is set to true.
+ type: string
+ clientCommonNames:
+ description: |-
+ clientCommonNames is an optional list of common names to require a match from. If empty, any
+ client certificate validated against the clientCA bundle is considered authoritative.
+ items:
+ type: string
+ type: array
+ emailHeaders:
+ description: emailHeaders is the set of headers
+ to check for the email address
+ items:
+ type: string
+ type: array
+ headers:
+ description: headers is the set of headers to check
+ for identity information
+ items:
+ type: string
+ type: array
+ loginURL:
+ description: |-
+ loginURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect interactive logins will be redirected here
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when login is set to true.
+ type: string
+ nameHeaders:
+ description: nameHeaders is the set of headers to
+ check for the display name
+ items:
+ type: string
+ type: array
+ preferredUsernameHeaders:
+ description: preferredUsernameHeaders is the set
+ of headers to check for the preferred username
+ items:
+ type: string
+ type: array
+ type: object
+ type:
+ description: type identifies the identity provider type
+ for this entry.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ templates:
+ description: templates allow you to customize pages like the
+ login page.
+ properties:
+ error:
+ description: |-
+ error is the name of a secret that specifies a go template to use to render error pages
+ during the authentication or grant flow.
+ The key "errors.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default error page is used.
+ If the specified template is not valid, the default error page is used.
+ If unspecified, the default error page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ login:
+ description: |-
+ login is the name of a secret that specifies a go template to use to render the login page.
+ The key "login.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default login page is used.
+ If the specified template is not valid, the default login page is used.
+ If unspecified, the default login page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ providerSelection:
+ description: |-
+ providerSelection is the name of a secret that specifies a go template to use to render
+ the provider selection page.
+ The key "providers.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default provider selection page is used.
+ If the specified template is not valid, the default provider selection page is used.
+ If unspecified, the default provider selection page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ tokenConfig:
+ description: tokenConfig contains options for authorization
+ and access tokens
+ properties:
+ accessTokenInactivityTimeout:
+ description: |-
+ accessTokenInactivityTimeout defines the token inactivity timeout
+ for tokens granted by any client.
+ The value represents the maximum amount of time that can occur between
+ consecutive uses of the token. Tokens become invalid if they are not
+ used within this temporal window. The user will need to acquire a new
+ token to regain access once a token times out. Takes valid time
+ duration string such as "5m", "1.5h" or "2h45m". The minimum allowed
+ value for duration is 300s (5 minutes). If the timeout is configured
+ per client, then that value takes precedence. If the timeout value is
+ not specified and the client does not override the value, then tokens
+ are valid until their lifetime.
+
+ WARNING: existing tokens' timeout will not be affected (lowered) by changing this value
+ type: string
+ accessTokenInactivityTimeoutSeconds:
+ description: 'accessTokenInactivityTimeoutSeconds - DEPRECATED:
+ setting this field has no effect.'
+ format: int32
+ type: integer
+ accessTokenMaxAgeSeconds:
+ description: accessTokenMaxAgeSeconds defines the maximum
+ age of access tokens
+ format: int32
+ type: integer
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: spec.configuration.oauth.tokenConfig.accessTokenInactivityTimeout
+ minimum acceptable token timeout value is 300 seconds
+ rule: '!has(self.tokenConfig) || !has(self.tokenConfig.accessTokenInactivityTimeout)
+ || duration(self.tokenConfig.accessTokenInactivityTimeout).getSeconds()
+ >= 300'
+ operatorhub:
+ description: |-
+ operatorhub specifies the configuration for the Operator Lifecycle Manager in the HostedCluster. This is only configured at deployment time but the controller are not reconcilling over it.
+ The OperatorHub configuration will be constantly reconciled if catalog placement is management, but only on cluster creation otherwise.
+ properties:
+ disableAllDefaultSources:
+ description: |-
+ disableAllDefaultSources allows you to disable all the default hub
+ sources. If this is true, a specific entry in sources can be used to
+ enable a default source. If this is false, a specific entry in
+ sources can be used to disable or enable a default source.
+ type: boolean
+ sources:
+ description: |-
+ sources is the list of default hub sources and their configuration.
+ If the list is empty, it implies that the default hub sources are
+ enabled on the cluster unless disableAllDefaultSources is true.
+ If disableAllDefaultSources is true and sources is not empty,
+ the configuration present in sources will take precedence. The list of
+ default hub sources and their current state will always be reflected in
+ the status block.
+ items:
+ description: HubSource is used to specify the hub source
+ and its configuration
+ properties:
+ disabled:
+ description: disabled is used to disable a default hub
+ source on cluster
+ type: boolean
+ name:
+ description: name is the name of one of the default
+ hub sources
+ maxLength: 253
+ minLength: 1
+ type: string
+ type: object
+ type: array
+ type: object
+ proxy:
+ description: |-
+ proxy holds cluster-wide information on how to configure default proxies for the cluster.
+ This affects traffic flowing from the hosted cluster data plane.
+ The controllers will generate a machineConfig with the proxy config for the cluster.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ httpProxy:
+ description: httpProxy is the URL of the proxy for HTTP requests. Empty
+ means unset and will not result in an env var.
+ type: string
+ httpsProxy:
+ description: httpsProxy is the URL of the proxy for HTTPS
+ requests. Empty means unset and will not result in an env
+ var.
+ type: string
+ noProxy:
+ description: |-
+ noProxy is a comma-separated list of hostnames and/or CIDRs and/or IPs for which the proxy should not be used.
+ Empty means unset and will not result in an env var.
+ type: string
+ readinessEndpoints:
+ description: readinessEndpoints is a list of endpoints used
+ to verify readiness of the proxy.
+ items:
+ type: string
+ type: array
+ trustedCA:
+ description: |-
+ trustedCA is a reference to a ConfigMap containing a CA certificate bundle.
+ The trustedCA field should only be consumed by a proxy validator. The
+ validator is responsible for reading the certificate bundle from the required
+ key "ca-bundle.crt", merging it with the system default trust bundle,
+ and writing the merged trust bundle to a ConfigMap named "trusted-ca-bundle"
+ in the "openshift-config-managed" namespace. Clients that expect to make
+ proxy connections must use the trusted-ca-bundle for all HTTPS requests to
+ the proxy, and may use the trusted-ca-bundle for non-proxy HTTPS requests as
+ well.
+
+ The namespace for the ConfigMap referenced by trustedCA is
+ "openshift-config". Here is an example ConfigMap (in yaml):
+
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: user-ca-bundle
+ namespace: openshift-config
+ data:
+ ca-bundle.crt: |
+ -----BEGIN CERTIFICATE-----
+ Custom CA certificate bundle.
+ -----END CERTIFICATE-----
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ scheduler:
+ description: |-
+ scheduler holds cluster-wide config information to run the Kubernetes Scheduler
+ and influence its placement decisions. The canonical name for this config is `cluster`.
+ properties:
+ defaultNodeSelector:
+ description: |-
+ defaultNodeSelector helps set the cluster-wide default node selector to
+ restrict pod placement to specific nodes. This is applied to the pods
+ created in all namespaces and creates an intersection with any existing
+ nodeSelectors already set on a pod, additionally constraining that pod's selector.
+ For example,
+ defaultNodeSelector: "type=user-node,region=east" would set nodeSelector
+ field in pod spec to "type=user-node,region=east" to all pods created
+ in all namespaces. Namespaces having project-wide node selectors won't be
+ impacted even if this field is set. This adds an annotation section to
+ the namespace.
+ For example, if a new namespace is created with
+ node-selector='type=user-node,region=east',
+ the annotation openshift.io/node-selector: type=user-node,region=east
+ gets added to the project. When the openshift.io/node-selector annotation
+ is set on the project the value is used in preference to the value we are setting
+ for defaultNodeSelector field.
+ For instance,
+ openshift.io/node-selector: "type=user-node,region=west" means
+ that the default of "type=user-node,region=east" set in defaultNodeSelector
+ would not be applied.
+ type: string
+ mastersSchedulable:
+ description: |-
+ mastersSchedulable allows masters nodes to be schedulable. When this flag is
+ turned on, all the master nodes in the cluster will be made schedulable,
+ so that workload pods can run on them. The default value for this field is false,
+ meaning none of the master nodes are schedulable.
+ Important Note: Once the workload pods start running on the master nodes,
+ extreme care must be taken to ensure that cluster-critical control plane components
+ are not impacted.
+ Please turn on this field after doing due diligence.
+ type: boolean
+ policy:
+ description: |-
+ DEPRECATED: the scheduler Policy API has been deprecated and will be removed in a future release.
+ policy is a reference to a ConfigMap containing scheduler policy which has
+ user specified predicates and priorities. If this ConfigMap is not available
+ scheduler will default to use DefaultAlgorithmProvider.
+ The namespace for this configmap is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ profile:
+ description: |-
+ profile sets which scheduling profile should be set in order to configure scheduling
+ decisions for new pods.
+
+ Valid values are "LowNodeUtilization", "HighNodeUtilization", "NoScoring"
+ Defaults to "LowNodeUtilization"
+ enum:
+ - ""
+ - LowNodeUtilization
+ - HighNodeUtilization
+ - NoScoring
+ type: string
+ profileCustomizations:
+ description: profileCustomizations contains configuration
+ for modifying the default behavior of existing scheduler
+ profiles.
+ properties:
+ dynamicResourceAllocation:
+ description: |-
+ dynamicResourceAllocation allows to enable or disable dynamic resource allocation within the scheduler.
+ Dynamic resource allocation is an API for requesting and sharing resources between pods and containers inside a pod.
+ Third-party resource drivers are responsible for tracking and allocating resources.
+ Different kinds of resources support arbitrary parameters for defining requirements and initialization.
+ Valid values are Enabled, Disabled and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default,
+ which is subject to change over time.
+ The current default is Disabled.
+ enum:
+ - ""
+ - Enabled
+ - Disabled
+ type: string
+ type: object
+ type: object
+ type: object
+ controlPlaneReleaseImage:
+ description: |-
+ controlPlaneReleaseImage specifies the desired OCP release payload for
+ control plane components running on the management cluster.
+ If not defined, ReleaseImage is used
+ maxLength: 255
+ type: string
+ controllerAvailabilityPolicy:
+ default: HighlyAvailable
+ description: |-
+ controllerAvailabilityPolicy specifies the availability policy applied to
+ critical control plane components. The default value is SingleReplica.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ x-kubernetes-validations:
+ - message: ControllerAvailabilityPolicy is immutable
+ rule: self == oldSelf
+ dns:
+ description: dns is the DNS configuration for the cluster.
+ properties:
+ baseDomain:
+ description: |-
+ baseDomain is the base domain of the hosted cluster.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Once set, this field is immutable.
+ When the value is the empty string "", the controller might default to a value depending on the platform.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomain must be a valid domain name (e.g., example,
+ example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomain is immutable
+ rule: oldSelf == "" || self == oldSelf
+ baseDomainPrefix:
+ description: |-
+ baseDomainPrefix is the base domain prefix for the hosted cluster ingress.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Set baseDomainPrefix to an empty string "", if you don't want a prefix at all (not even hostedCluster.name) to be prepended to baseDomain.
+ This field is immutable.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomainPrefix must be a valid domain name (e.g.,
+ example, example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomainPrefix is immutable
+ rule: self == oldSelf
+ privateZoneID:
+ description: |-
+ privateZoneID is the Hosted Zone ID where all the DNS records that are only available internally to the cluster exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: privateZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ publicZoneID:
+ description: |-
+ publicZoneID is the Hosted Zone ID where all the DNS records that are publicly accessible to the internet exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: publicZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ required:
+ - baseDomain
+ type: object
+ etcd:
+ description: |-
+ etcd contains metadata about the etcd cluster the hypershift managed Openshift control plane components
+ use to store data.
+ properties:
+ managed:
+ description: managed specifies the behavior of an etcd cluster
+ managed by HyperShift.
+ properties:
+ storage:
+ description: storage specifies how etcd data is persisted.
+ properties:
+ persistentVolume:
+ description: |-
+ persistentVolume is the configuration for PersistentVolume etcd storage.
+ With this implementation, a PersistentVolume will be allocated for every
+ etcd member (either 1 or 3 depending on the HostedCluster control plane
+ availability configuration).
+ properties:
+ size:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 8Gi
+ description: |-
+ size is the minimum size of the data volume for each etcd member.
+ Default is 8Gi.
+ This field is immutable
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ x-kubernetes-validations:
+ - message: Etcd PV storage size is immutable
+ rule: self == oldSelf
+ storageClassName:
+ description: |-
+ storageClassName is the StorageClass of the data volume for each etcd member.
+ See https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: storageClassName is immutable
+ rule: self == oldSelf
+ type: object
+ restoreSnapshotURL:
+ description: |-
+ restoreSnapshotURL allows an optional URL to be provided where
+ an etcd snapshot can be downloaded, for example a pre-signed URL
+ referencing a storage service.
+ This snapshot will be restored on initial startup, only when the etcd PV
+ is empty.
+ items:
+ maxLength: 1024
+ type: string
+ maxItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: RestoreSnapshotURL shouldn't contain more than
+ 1 entry
+ rule: self.size() <= 1
+ type:
+ description: |-
+ type is the kind of persistent storage implementation to use for etcd.
+ Only PersistentVolume is supported at the moment.
+ enum:
+ - PersistentVolume
+ type: string
+ required:
+ - type
+ type: object
+ required:
+ - storage
+ type: object
+ managementType:
+ description: |-
+ managementType defines how the etcd cluster is managed.
+ This can be either Managed or Unmanaged.
+ This field is immutable.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ x-kubernetes-validations:
+ - message: managementType is immutable
+ rule: self == oldSelf
+ unmanaged:
+ description: |-
+ unmanaged specifies configuration which enables the control plane to
+ integrate with an externally managed etcd cluster.
+ properties:
+ endpoint:
+ description: |-
+ endpoint is the full etcd cluster client endpoint URL. For example:
+
+ https://etcd-client:2379
+
+ If the URL uses an HTTPS scheme, the TLS field is required.
+ maxLength: 255
+ pattern: ^https://
+ type: string
+ tls:
+ description: tls specifies TLS configuration for HTTPS etcd
+ client endpoints.
+ properties:
+ clientSecret:
+ description: |-
+ clientSecret refers to a secret for client mTLS authentication with the etcd cluster. It
+ may have the following key/value pairs:
+
+ etcd-client-ca.crt: Certificate Authority value
+ etcd-client.crt: Client certificate value
+ etcd-client.key: Client certificate key value
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - clientSecret
+ type: object
+ required:
+ - endpoint
+ - tls
+ type: object
+ required:
+ - managementType
+ type: object
+ x-kubernetes-validations:
+ - message: Only managed configuration must be set when managementType
+ is Managed
+ rule: 'self.managementType == ''Managed'' ? has(self.managed) :
+ !has(self.managed)'
+ - message: Only unmanaged configuration must be set when managementType
+ is Unmanaged
+ rule: 'self.managementType == ''Unmanaged'' ? has(self.unmanaged)
+ : !has(self.unmanaged)'
+ fips:
+ description: fips specifies if the nodes for the cluster will be running
+ in FIPS mode
+ type: boolean
+ imageContentSources:
+ description: imageContentSources lists sources/repositories for the
+ release-image content.
+ items:
+ description: |-
+ ImageContentSource specifies image mirrors that can be used by cluster nodes
+ to pull content. For cluster workloads, if a container image registry host of
+ the pullspec matches Source then one of the Mirrors are substituted as hosts
+ in the pullspec and tried in order to fetch the image.
+ properties:
+ mirrors:
+ description: mirrors are one or more repositories that may also
+ contain the same images.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 255
+ type: array
+ x-kubernetes-list-type: set
+ source:
+ description: |-
+ source is the repository that users refer to, e.g. in image pull
+ specifications.
+ maxLength: 255
+ type: string
+ required:
+ - source
+ type: object
+ maxItems: 255
+ type: array
+ infraID:
+ description: infraID is the unique id that identifies the cluster
+ internally.
+ maxLength: 255
+ type: string
+ infrastructureAvailabilityPolicy:
+ default: SingleReplica
+ description: |-
+ infrastructureAvailabilityPolicy specifies the availability policy applied
+ to infrastructure services which run on cluster nodes. The default value is
+ SingleReplica.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ issuerURL:
+ description: |-
+ issuerURL is an OIDC issuer URL which is used as the issuer in all
+ ServiceAccount tokens generated by the control plane API server. The
+ default value is kubernetes.default.svc, which only works for in-cluster
+ validation.
+ maxLength: 255
+ type: string
+ kubeAPIServerDNSName:
+ description: |-
+ kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
+ When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
+ If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
+ The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
+ This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
+ access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
+ for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ kubeconfig:
+ description: kubeconfig specifies the name and key for the kubeconfig
+ secret
+ properties:
+ key:
+ description: key is the key in the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: |-
+ labels when specified, define what custom labels are added to the hcp pods.
+ Changing this day 2 will cause a rollout of all hcp pods.
+ Duplicate keys are not supported. If duplicate keys are defined, only the last key/value pair is preserved.
+ Valid values are those in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
+
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(key) <= 317 && key.matches('^(([A-Za-z0-9]+(\\.[A-Za-z0-9]+)?)*[A-Za-z0-9]\\/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$'))`, message="label key must have two segments: an optional prefix and name, separated by a slash (/). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (_), dots (.), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (.), not longer than 253 characters in total, followed by a slash (/)"
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(self[key]) <= 63 && self[key].matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$'))`, message="label value must be 63 characters or less (can be empty), consist of alphanumeric characters, dashes (-), underscores (_) or dots (.), and begin and end with an alphanumeric character"
+ maxProperties: 20
+ type: object
+ networking:
+ description: |-
+ networking specifies network configuration for the cluster.
+ Temporarily optional for backward compatibility, required in future releases.
+ properties:
+ apiServer:
+ description: |-
+ apiServer contains advanced network settings for the API server that affect
+ how the APIServer is exposed inside a hosted cluster node.
+ properties:
+ advertiseAddress:
+ description: |-
+ advertiseAddress is the address that pods within the nodes will use to talk to the API
+ server. This is an address associated with the loopback adapter of each
+ node. If not specified, the controller will take default values.
+ The default values will be set as 172.20.0.1 or fd00::1.
+ This value is immutable.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: advertiseAddress is immutable
+ rule: self == oldSelf
+ allowedCIDRBlocks:
+ description: |-
+ allowedCIDRBlocks is an allow list of CIDR blocks that can access the APIServer.
+ If not specified, traffic is allowed from all addresses.
+ This field is enforced for ARO (Azure Red Hat OpenShift) via the shared-ingress HAProxy.
+ For platforms other than ARO, the enforcement depends on whether the underlying cloud provider supports the Service LoadBalancerSourceRanges field.
+ If the platform does not support LoadBalancerSourceRanges, this field may have no effect.
+ items:
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ maxItems: 500
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the port at which the APIServer is exposed inside a node. Other
+ pods using host networking cannot listen on this port.
+ If omitted 6443 is used.
+ This is useful to choose a port other than the default one which might interfere with customer environments e.g. https://github.com/openshift/hypershift/pull/356.
+ Setting this to 443 is possible only for backward compatibility reasons and it's discouraged.
+ Doing so, it would result in the controller overriding the KAS endpoint in the guest cluster having a discrepancy with the KAS Pod and potentially causing temporarily network failures.
+ This value is immutable.
+ format: int32
+ type: integer
+ x-kubernetes-validations:
+ - message: port is immutable
+ rule: self == oldSelf
+ type: object
+ clusterNetwork:
+ default:
+ - cidr: 10.132.0.0/14
+ description: |-
+ clusterNetwork is the list of IP address pools for pods.
+ Defaults to cidr: "10.132.0.0/14".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: |-
+ ClusterNetworkEntry is a single IP address block for pod IP blocks. IP blocks
+ are allocated with size 2^HostSubnetLength.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ hostPrefix:
+ description: |-
+ hostPrefix is the prefix size to allocate to each node from the CIDR.
+ For example, 24 would allocate 2^(32-24)=2^8=256 addresses to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ type: integer
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: clusterNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ machineNetwork:
+ description: |-
+ machineNetwork is the list of IP address pools for machines.
+ This might be used among other things to generate appropriate networking security groups in some clouds providers.
+ Currently only one entry or two for dual stack is supported.
+ This field is immutable.
+ items:
+ description: MachineNetworkEntry is a single IP address block
+ for node IP blocks.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for machines
+ within the cluster.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: machineNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ networkType:
+ default: OVNKubernetes
+ description: |-
+ networkType specifies the SDN provider used for cluster networking.
+ Defaults to OVNKubernetes.
+ This field is required and immutable.
+ kubebuilder:validation:XValidation:rule="self == oldSelf", message="networkType is immutable"
+ enum:
+ - OpenShiftSDN
+ - Calico
+ - OVNKubernetes
+ - Other
+ type: string
+ serviceNetwork:
+ default:
+ - cidr: 172.31.0.0/16
+ description: |-
+ serviceNetwork is the list of IP address pools for services.
+ Defaults to cidr: "172.31.0.0/16".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: ServiceNetworkEntry is a single IP address block
+ for the service network.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for services
+ within the cluster in CIDR format (e.g., 192.168.1.0/24
+ or 2001:0db8::/64)
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: serviceNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+ must be unique and non-overlapping
+ rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
+ c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
+ self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
+ self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
+ self.serviceNetwork.all(s, c.cidr != s.cidr)))))
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: nodeSelector when specified, must be true for the pods
+ managed by the HostedCluster to be scheduled.
+ type: object
+ olmCatalogPlacement:
+ default: management
+ description: |-
+ olmCatalogPlacement specifies the placement of OLM catalog components. By default,
+ this is set to management and OLM catalog components are deployed onto the management
+ cluster. If set to guest, the OLM catalog components will be deployed onto the guest
+ cluster.
+ enum:
+ - management
+ - guest
+ type: string
+ operatorConfiguration:
+ description: operatorConfiguration specifies configuration for individual
+ OCP operators in the cluster.
+ properties:
+ clusterNetworkOperator:
+ description: clusterNetworkOperator specifies the configuration
+ for the Cluster Network Operator in the hosted cluster.
+ properties:
+ disableMultiNetwork:
+ default: false
+ description: |-
+ disableMultiNetwork when set to true disables the Multus CNI plugin and related components
+ in the hosted cluster. This prevents the installation of multus daemon sets in the
+ guest cluster and the multus-admission-controller in the management cluster.
+ Default is false (Multus is enabled).
+ This field is immutable.
+ This field can only be set to true when NetworkType is "Other". Setting it to true
+ with any other NetworkType will result in a validation error during cluster creation.
+ type: boolean
+ x-kubernetes-validations:
+ - message: disableMultiNetwork is immutable
+ rule: self == oldSelf
+ ovnKubernetesConfig:
+ description: |-
+ ovnKubernetesConfig holds OVN-Kubernetes specific configuration.
+ This is only consumed when NetworkType is OVNKubernetes.
+ minProperties: 1
+ properties:
+ ipv4:
+ description: |-
+ ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
+ this means no opinions and the default configuration is used. Check individual
+ fields within ipv4 for details of default values.
+ minProperties: 1
+ properties:
+ internalJoinSubnet:
+ description: |-
+ internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the
+ default one is being already used by something else. It must not overlap with
+ any other subnet being used by OpenShift or by the node network. The size of the
+ subnet must be larger than the number of nodes.
+ The current default value is 100.64.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ (e.g., 192.168.1.1/24)
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ internalTransitSwitchSubnet:
+ description: |-
+ internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally
+ by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect
+ architecture that connects the cluster routers on each node together to enable
+ east west traffic. The subnet chosen should not overlap with other networks
+ specified for OVN-Kubernetes as well as other networks used on the host.
+ When omitted, this means no opinion and the platform is left to choose a reasonable
+ default which is subject to change over time.
+ The current default subnet is 100.88.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: internalJoinSubnet and internalTransitSwitchSubnet
+ must not be the same
+ rule: '!has(self.ipv4) || !has(self.ipv4.internalJoinSubnet)
+ || !has(self.ipv4.internalTransitSwitchSubnet) || self.ipv4.internalJoinSubnet
+ != self.ipv4.internalTransitSwitchSubnet'
+ type: object
+ ingressOperator:
+ description: |-
+ ingressOperator specifies the configuration for the Ingress Operator in the hosted cluster.
+ This allows configuring how the default ingress controller endpoints are published.
+ properties:
+ endpointPublishingStrategy:
+ description: |-
+ endpointPublishingStrategy is used to publish the default ingress controller endpoints.
+
+ The endpoint publishing strategy is determined by the following precedence order:
+ 1. User-specified endpointPublishingStrategy (highest priority) - if this field is set,
+ it takes precedence over all other configuration methods
+ 2. Platform-specific defaults with annotation overrides - if no user strategy is set,
+ the platform type determines the default strategy, which can be further modified by:
+ - hypershift.openshift.io/private-ingress-controller annotation (sets PrivateStrategyType)
+ - hypershift.openshift.io/ingress-controller-load-balancer-scope annotation (sets LoadBalancerScope)
+ 3. Generic LoadBalancer fallback - if the platform is not recognized, defaults to
+ LoadBalancerService with External scope
+
+ Platform-specific defaults when endpointPublishingStrategy is not set:
+ - AWS: LoadBalancerService with External scope (or NLB if configured)
+ - Azure, GCP: LoadBalancerService with External scope
+ - IBMCloud: LoadBalancerService with External scope (or NodePort for UPI)
+ - None: HostNetwork
+ - KubeVirt: NodePortService
+ - OpenStack: LoadBalancerService with External scope and optional FloatingIP
+ - Other platforms: LoadBalancerService with External scope
+
+ See the OpenShift Ingress Operator EndpointPublishingStrategy type for the full specification:
+ https://github.com/openshift/api/blob/master/operator/v1/types_ingress.go
+ properties:
+ hostNetwork:
+ description: |-
+ hostNetwork holds parameters for the HostNetwork endpoint publishing
+ strategy. Present only if type is HostNetwork.
+ properties:
+ httpPort:
+ default: 80
+ description: |-
+ httpPort is the port on the host which should be used to listen for
+ HTTP requests. This field should be set when port 80 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 80.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ httpsPort:
+ default: 443
+ description: |-
+ httpsPort is the port on the host which should be used to listen for
+ HTTPS requests. This field should be set when port 443 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 443.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ statsPort:
+ default: 1936
+ description: |-
+ statsPort is the port on the host where the stats from the router are
+ published. The value should not coincide with the NodePort range of the
+ cluster. If an external load balancer is configured to forward connections
+ to this IngressController, the load balancer should use this port for
+ health checks. The load balancer can send HTTP probes on this port on a
+ given node, with the path /healthz/ready to determine if the ingress
+ controller is ready to receive traffic on the node. For proper operation
+ the load balancer must not forward traffic to a node until the health
+ check reports ready. The load balancer should also stop forwarding requests
+ within a maximum of 45 seconds after /healthz/ready starts reporting
+ not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with
+ a threshold of two successful or failed requests to become healthy or
+ unhealthy respectively, are well-tested values. When the value is 0 or
+ is not specified it defaults to 1936.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ type: object
+ loadBalancer:
+ description: |-
+ loadBalancer holds parameters for the load balancer. Present only if
+ type is LoadBalancerService.
+ properties:
+ allowedSourceRanges:
+ description: |-
+ allowedSourceRanges specifies an allowlist of IP address ranges to which
+ access to the load balancer should be restricted. Each range must be
+ specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is
+ specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default,
+ which allows all source addresses.
+
+ To facilitate migration from earlier versions of OpenShift that did
+ not have the allowedSourceRanges field, you may set the
+ service.beta.kubernetes.io/load-balancer-source-ranges annotation on
+ the "router-" service in the
+ "openshift-ingress" namespace, and this annotation will take
+ effect if allowedSourceRanges is empty on OpenShift 4.12.
+ items:
+ description: |-
+ CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8"
+ or "fd00::/8").
+ pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)
+ type: string
+ nullable: true
+ type: array
+ x-kubernetes-list-type: atomic
+ dnsManagementPolicy:
+ default: Managed
+ description: |-
+ dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record
+ associated with the load balancer service will be managed by
+ the ingress operator. It defaults to Managed.
+ Valid values are: Managed and Unmanaged.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ providerParameters:
+ description: |-
+ providerParameters holds desired load balancer information specific to
+ the underlying infrastructure provider.
+
+ If empty, defaults will be applied. See specific providerParameters
+ fields for details about their defaults.
+ properties:
+ aws:
+ description: |-
+ aws provides configuration settings that are specific to AWS
+ load balancers.
+
+ If empty, defaults will be applied. See specific aws fields for
+ details about their defaults.
+ properties:
+ classicLoadBalancer:
+ description: |-
+ classicLoadBalancerParameters holds configuration parameters for an AWS
+ classic load balancer. Present only if type is Classic.
+ properties:
+ connectionIdleTimeout:
+ description: |-
+ connectionIdleTimeout specifies the maximum time period that a
+ connection may be idle before the load balancer closes the
+ connection. The value must be parseable as a time duration value;
+ see . A nil or zero value
+ means no opinion, in which case a default value is used. The default
+ value for this field is 60s. This default is subject to change.
+ format: duration
+ type: string
+ type: object
+ networkLoadBalancer:
+ description: |-
+ networkLoadBalancerParameters holds configuration parameters for an AWS
+ network load balancer. Present only if type is NLB.
+ type: object
+ type:
+ description: |-
+ type is the type of AWS load balancer to instantiate for an ingresscontroller.
+
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - Classic
+ - NLB
+ type: string
+ required:
+ - type
+ type: object
+ gcp:
+ description: |-
+ gcp provides configuration settings that are specific to GCP
+ load balancers.
+
+ If empty, defaults will be applied. See specific gcp fields for
+ details about their defaults.
+ properties:
+ clientAccess:
+ description: |-
+ clientAccess describes how client access is restricted for internal
+ load balancers.
+
+ Valid values are:
+ * "Global": Specifying an internal load balancer with Global client access
+ allows clients from any region within the VPC to communicate with the load
+ balancer.
+
+ https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access
+
+ * "Local": Specifying an internal load balancer with Local client access
+ means only clients within the same region (and VPC) as the GCP load balancer
+ can communicate with the load balancer. Note that this is the default behavior.
+
+ https://cloud.google.com/load-balancing/docs/internal#client_access
+ enum:
+ - Global
+ - Local
+ type: string
+ type: object
+ ibm:
+ description: |-
+ ibm provides configuration settings that are specific to IBM Cloud
+ load balancers.
+
+ If empty, defaults will be applied. See specific ibm fields for
+ details about their defaults.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the load balancer uses PROXY protocol to forward connections to
+ the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features:
+ "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas"
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ Valid values for protocol are TCP, PROXY and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is TCP, without the proxy protocol enabled.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ openstack:
+ description: |-
+ openstack provides configuration settings that are specific to OpenStack
+ load balancers.
+
+ If empty, defaults will be applied. See specific openstack fields for
+ details about their defaults.
+ properties:
+ floatingIP:
+ description: |-
+ floatingIP specifies the IP address that the load balancer will use.
+ When not specified, an IP address will be assigned randomly by the OpenStack cloud provider.
+ When specified, the floating IP has to be pre-created. If the
+ specified value is not a floating IP or is already claimed, the
+ OpenStack cloud provider won't be able to provision the load
+ balancer.
+ This field may only be used if the IngressController has External scope.
+ This value must be a valid IPv4 or IPv6 address.
+ type: string
+ x-kubernetes-validations:
+ - message: floatingIP must be a valid IPv4
+ or IPv6 address
+ rule: isIP(self)
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the load balancer.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix",
+ "OpenStack", and "VSphere".
+ enum:
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Nutanix
+ - OpenStack
+ - VSphere
+ - IBM
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: openstack is not permitted when type is
+ not OpenStack
+ rule: 'has(self.type) && self.type == ''OpenStack''
+ ? true : !has(self.openstack)'
+ scope:
+ description: |-
+ scope indicates the scope at which the load balancer is exposed.
+ Possible values are "External" and "Internal".
+ enum:
+ - Internal
+ - External
+ type: string
+ required:
+ - dnsManagementPolicy
+ - scope
+ type: object
+ x-kubernetes-validations:
+ - message: cannot specify a floating ip when scope is
+ internal
+ rule: '!has(self.scope) || self.scope != ''Internal''
+ || !has(self.providerParameters) || !has(self.providerParameters.openstack)
+ || !has(self.providerParameters.openstack.floatingIP)
+ || self.providerParameters.openstack.floatingIP ==
+ ""'
+ nodePort:
+ description: |-
+ nodePort holds parameters for the NodePortService endpoint publishing strategy.
+ Present only if type is NodePortService.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ private:
+ description: |-
+ private holds parameters for the Private endpoint publishing
+ strategy. Present only if type is Private.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy to use. Valid values are:
+
+ * LoadBalancerService
+
+ Publishes the ingress controller using a Kubernetes LoadBalancer Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A LoadBalancer Service is created to publish the deployment.
+
+ See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
+
+ If domain is set, a wildcard DNS record will be managed to point at the
+ LoadBalancer Service's external name. DNS records are managed only in DNS
+ zones defined by dns.config.openshift.io/cluster .spec.publicZone and
+ .spec.privateZone.
+
+ Wildcard DNS management is currently supported only on the AWS, Azure,
+ and GCP platforms.
+
+ * HostNetwork
+
+ Publishes the ingress controller on node ports where the ingress controller
+ is deployed.
+
+ In this configuration, the ingress controller deployment uses host
+ networking, bound to node ports 80 and 443. The user is responsible for
+ configuring an external load balancer to publish the ingress controller via
+ the node ports.
+
+ * Private
+
+ Does not publish the ingress controller.
+
+ In this configuration, the ingress controller deployment uses container
+ networking, and is not explicitly published. The user must manually publish
+ the ingress controller.
+
+ * NodePortService
+
+ Publishes the ingress controller using a Kubernetes NodePort Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A NodePort Service is created to publish the deployment. The
+ specific node ports are dynamically allocated by OpenShift; however, to
+ support static port allocations, user changes to the node port
+ field of the managed NodePort Service will preserved.
+ enum:
+ - LoadBalancerService
+ - HostNetwork
+ - Private
+ - NodePortService
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-preserve-unknown-fields: true
+ type: object
+ type: object
+ pausedUntil:
+ description: |-
+ pausedUntil is a field that can be used to pause reconciliation on a resource.
+ Either a date can be provided in RFC3339 format or a boolean. If a date is
+ provided: reconciliation is paused on the resource until that date. If the boolean true is
+ provided: reconciliation is paused on the resource until the field is removed.
+ maxLength: 255
+ type: string
+ platform:
+ description: platform is the platform configuration for the cluster.
+ properties:
+ agent:
+ description: agent specifies configuration for agent-based installations.
+ properties:
+ agentNamespace:
+ description: agentNamespace is the namespace where to search
+ for Agents for this cluster
+ maxLength: 63
+ type: string
+ required:
+ - agentNamespace
+ type: object
+ aws:
+ description: aws specifies configuration for clusters running
+ on Amazon Web Services.
+ properties:
+ additionalAllowedPrincipals:
+ description: |-
+ additionalAllowedPrincipals specifies a list of additional allowed principal ARNs
+ to be added to the hosted control plane's VPC Endpoint Service to enable additional
+ VPC Endpoint connection requests to be automatically accepted.
+ See https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html
+ for more details around VPC Endpoint Service allowed principals.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 25
+ type: array
+ cloudProviderConfig:
+ description: |-
+ cloudProviderConfig specifies AWS networking configuration for the control
+ plane.
+ This is mainly used for cloud provider controller config:
+ https://github.com/kubernetes/kubernetes/blob/f5be5052e3d0808abb904aebd3218fe4a5c2dd82/staging/src/k8s.io/legacy-cloud-providers/aws/aws.go#L1347-L1364
+ properties:
+ subnet:
+ description: subnet is the subnet to use for control plane
+ cloud resources.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify
+ an AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for
+ the filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: vpc is the VPC to use for control plane cloud
+ resources.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ maxLength: 255
+ type: string
+ required:
+ - vpc
+ type: object
+ endpointAccess:
+ default: Public
+ description: |-
+ endpointAccess specifies the publishing scope of cluster endpoints. The
+ default is Public.
+ enum:
+ - Public
+ - PublicAndPrivate
+ - Private
+ type: string
+ multiArch:
+ default: false
+ description: |-
+ multiArch specifies whether the Hosted Cluster will be expected to support NodePools with different
+ CPU architectures, i.e., supporting arm64 NodePools and supporting amd64 NodePools on the same Hosted Cluster.
+ Deprecated: This field is no longer used. The HyperShift Operator now performs multi-arch validations
+ automatically despite the platform type. The HyperShift Operator will set HostedCluster.Status.PayloadArch based
+ on the HostedCluster release image. This field is used by the NodePool controller to validate the
+ NodePool.Spec.Arch is supported.
+ type: boolean
+ region:
+ description: |-
+ region is the AWS region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot AMI for a given release.
+ maxLength: 255
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created
+ for the cluster. See
+ https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for
+ information on tagging AWS resources. AWS supports a maximum of 50 tags per
+ resource. OpenShift reserves 25 tags for its use, leaving 25 tags available
+ for the user.
+ Changes to this field will be propagated in-place to AWS resources (VPC Endpoints, EC2 instances, initial EBS volumes and default/endpoint security groups).
+ These tags will be propagated to the infrastructure CR in the guest cluster, where other OCP operators might choose to honor this input to reconcile AWS resources created by them.
+ Please consult the official documentation for a list of all AWS resources that support in-place tag updates.
+ These take precedence over tags defined out of band (i.e., tags added manually or by other tools outside of HyperShift) in AWS in case of conflicts.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ value:
+ description: |-
+ value is the value of the tag.
+
+ Some AWS service do not support empty values. Since tags are added to
+ resources in many services, the length of the tag value must meet the
+ requirements of all services.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ rolesRef:
+ description: |-
+ rolesRef contains references to various AWS IAM roles required to enable
+ integrations such as OIDC.
+ properties:
+ controlPlaneOperatorARN:
+ description: "controlPlaneOperatorARN is an ARN value
+ referencing a role appropriate for the Control Plane
+ Operator.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"arn:aws:route53:::%s\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ imageRegistryARN:
+ description: "imageRegistryARN is an ARN value referencing
+ a role appropriate for the Image Registry Operator.\n\nThe
+ following is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"s3:CreateBucket\",\n\t\t\t\t\"s3:DeleteBucket\",\n\t\t\t\t\"s3:PutBucketTagging\",\n\t\t\t\t\"s3:GetBucketTagging\",\n\t\t\t\t\"s3:PutBucketPublicAccessBlock\",\n\t\t\t\t\"s3:GetBucketPublicAccessBlock\",\n\t\t\t\t\"s3:PutEncryptionConfiguration\",\n\t\t\t\t\"s3:GetEncryptionConfiguration\",\n\t\t\t\t\"s3:PutLifecycleConfiguration\",\n\t\t\t\t\"s3:GetLifecycleConfiguration\",\n\t\t\t\t\"s3:GetBucketLocation\",\n\t\t\t\t\"s3:ListBucket\",\n\t\t\t\t\"s3:GetObject\",\n\t\t\t\t\"s3:PutObject\",\n\t\t\t\t\"s3:DeleteObject\",\n\t\t\t\t\"s3:ListBucketMultipartUploads\",\n\t\t\t\t\"s3:AbortMultipartUpload\",\n\t\t\t\t\"s3:ListMultipartUploadParts\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing a
+ role appropriate for the Ingress Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"elasticloadbalancing:DescribeLoadBalancers\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"route53:ListHostedZones\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ [\n\t\t\t\t\"arn:aws:route53:::PUBLIC_ZONE_ID\",\n\t\t\t\t\"arn:aws:route53:::PRIVATE_ZONE_ID\"\n\t\t\t]\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ kubeCloudControllerARN:
+ description: |-
+ kubeCloudControllerARN is an ARN value referencing a role appropriate for the KCM/KCC.
+ Source: https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies
+
+ The following is an example of a valid policy document:
+
+ {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Action": [
+ "autoscaling:DescribeAutoScalingGroups",
+ "autoscaling:DescribeLaunchConfigurations",
+ "autoscaling:DescribeTags",
+ "ec2:DescribeAvailabilityZones",
+ "ec2:DescribeInstances",
+ "ec2:DescribeImages",
+ "ec2:DescribeRegions",
+ "ec2:DescribeRouteTables",
+ "ec2:DescribeSecurityGroups",
+ "ec2:DescribeSubnets",
+ "ec2:DescribeVolumes",
+ "ec2:CreateSecurityGroup",
+ "ec2:CreateTags",
+ "ec2:CreateVolume",
+ "ec2:ModifyInstanceAttribute",
+ "ec2:ModifyVolume",
+ "ec2:AttachVolume",
+ "ec2:AuthorizeSecurityGroupIngress",
+ "ec2:CreateRoute",
+ "ec2:DeleteRoute",
+ "ec2:DeleteSecurityGroup",
+ "ec2:DeleteVolume",
+ "ec2:DetachVolume",
+ "ec2:RevokeSecurityGroupIngress",
+ "ec2:DescribeVpcs",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:AttachLoadBalancerToSubnets",
+ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancerPolicy",
+ "elasticloadbalancing:CreateLoadBalancerListeners",
+ "elasticloadbalancing:ConfigureHealthCheck",
+ "elasticloadbalancing:DeleteLoadBalancer",
+ "elasticloadbalancing:DeleteLoadBalancerListeners",
+ "elasticloadbalancing:DescribeLoadBalancers",
+ "elasticloadbalancing:DescribeLoadBalancerAttributes",
+ "elasticloadbalancing:DetachLoadBalancerFromSubnets",
+ "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
+ "elasticloadbalancing:ModifyLoadBalancerAttributes",
+ "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
+ "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:CreateListener",
+ "elasticloadbalancing:CreateTargetGroup",
+ "elasticloadbalancing:DeleteListener",
+ "elasticloadbalancing:DeleteTargetGroup",
+ "elasticloadbalancing:DeregisterTargets",
+ "elasticloadbalancing:DescribeListeners",
+ "elasticloadbalancing:DescribeLoadBalancerPolicies",
+ "elasticloadbalancing:DescribeTargetGroups",
+ "elasticloadbalancing:DescribeTargetHealth",
+ "elasticloadbalancing:ModifyListener",
+ "elasticloadbalancing:ModifyTargetGroup",
+ "elasticloadbalancing:RegisterTargets",
+ "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
+ "iam:CreateServiceLinkedRole",
+ "kms:DescribeKey"
+ ],
+ "Resource": [
+ "*"
+ ],
+ "Effect": "Allow"
+ }
+ ]
+ }
+ maxLength: 2048
+ type: string
+ networkARN:
+ description: "networkARN is an ARN value referencing a
+ role appropriate for the Network Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:DescribeInstances\",\n
+ \ \"ec2:DescribeInstanceStatus\",\n \"ec2:DescribeInstanceTypes\",\n
+ \ \"ec2:UnassignPrivateIpAddresses\",\n \"ec2:AssignPrivateIpAddresses\",\n
+ \ \"ec2:UnassignIpv6Addresses\",\n \"ec2:AssignIpv6Addresses\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeNetworkInterfaces\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ nodePoolManagementARN:
+ description: "nodePoolManagementARN is an ARN value referencing
+ a role appropriate for the CAPI Controller.\n\nThe following
+ is an example of a valid policy document:\n\n{\n \"Version\":
+ \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\":
+ [\n \"ec2:AssociateRouteTable\",\n \"ec2:AttachInternetGateway\",\n
+ \ \"ec2:AuthorizeSecurityGroupIngress\",\n \"ec2:CreateInternetGateway\",\n
+ \ \"ec2:CreateNatGateway\",\n \"ec2:CreateRoute\",\n
+ \ \"ec2:CreateRouteTable\",\n \"ec2:CreateSecurityGroup\",\n
+ \ \"ec2:CreateSubnet\",\n \"ec2:CreateTags\",\n
+ \ \"ec2:DeleteInternetGateway\",\n \"ec2:DeleteNatGateway\",\n
+ \ \"ec2:DeleteRouteTable\",\n \"ec2:DeleteSecurityGroup\",\n
+ \ \"ec2:DeleteSubnet\",\n \"ec2:DeleteTags\",\n
+ \ \"ec2:DescribeAccountAttributes\",\n \"ec2:DescribeAddresses\",\n
+ \ \"ec2:DescribeAvailabilityZones\",\n \"ec2:DescribeImages\",\n
+ \ \"ec2:DescribeInstances\",\n \"ec2:DescribeInternetGateways\",\n
+ \ \"ec2:DescribeNatGateways\",\n \"ec2:DescribeNetworkInterfaces\",\n
+ \ \"ec2:DescribeNetworkInterfaceAttribute\",\n
+ \ \"ec2:DescribeRouteTables\",\n \"ec2:DescribeSecurityGroups\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeVpcs\",\n
+ \ \"ec2:DescribeVpcAttribute\",\n \"ec2:DescribeVolumes\",\n
+ \ \"ec2:DetachInternetGateway\",\n \"ec2:DisassociateRouteTable\",\n
+ \ \"ec2:DisassociateAddress\",\n \"ec2:ModifyInstanceAttribute\",\n
+ \ \"ec2:ModifyNetworkInterfaceAttribute\",\n \"ec2:ModifySubnetAttribute\",\n
+ \ \"ec2:RevokeSecurityGroupIngress\",\n \"ec2:RunInstances\",\n
+ \ \"ec2:TerminateInstances\",\n \"tag:GetResources\",\n
+ \ \"ec2:CreateLaunchTemplate\",\n \"ec2:CreateLaunchTemplateVersion\",\n
+ \ \"ec2:DescribeLaunchTemplates\",\n \"ec2:DescribeLaunchTemplateVersions\",\n
+ \ \"ec2:DeleteLaunchTemplate\",\n \"ec2:DeleteLaunchTemplateVersions\"\n
+ \ ],\n \"Resource\": [\n \"*\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n {\n \"Condition\":
+ {\n \"StringLike\": {\n \"iam:AWSServiceName\":
+ \"elasticloadbalancing.amazonaws.com\"\n }\n },\n
+ \ \"Action\": [\n \"iam:CreateServiceLinkedRole\"\n
+ \ ],\n \"Resource\": [\n \"arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing\"\n
+ \ ],\n \"Effect\": \"Allow\"\n },\n {\n \"Action\":
+ [\n \"iam:PassRole\"\n ],\n \"Resource\":
+ [\n \"arn:*:iam::*:role/*-worker-role\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n\t {\n\t \t\"Effect\":
+ \"Allow\",\n\t \t\"Action\": [\n\t \t\t\"kms:Decrypt\",\n\t
+ \ \t\t\"kms:ReEncrypt\",\n\t \t\t\"kms:GenerateDataKeyWithoutPlainText\",\n\t
+ \ \t\t\"kms:DescribeKey\"\n\t \t],\n\t \t\"Resource\":
+ \"*\"\n\t },\n\t {\n\t \t\"Effect\": \"Allow\",\n\t
+ \ \t\"Action\": [\n\t \t\t\"kms:CreateGrant\"\n\t \t],\n\t
+ \ \t\"Resource\": \"*\",\n\t \t\"Condition\": {\n\t
+ \ \t\t\"Bool\": {\n\t \t\t\t\"kms:GrantIsForAWSResource\":
+ true\n\t \t\t}\n\t \t}\n\t }\n ]\n}"
+ maxLength: 2048
+ type: string
+ storageARN:
+ description: "storageARN is an ARN value referencing a
+ role appropriate for the Storage Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:AttachVolume\",\n\t\t\t\t\"ec2:CreateSnapshot\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"ec2:CreateVolume\",\n\t\t\t\t\"ec2:DeleteSnapshot\",\n\t\t\t\t\"ec2:DeleteTags\",\n\t\t\t\t\"ec2:DeleteVolume\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeSnapshots\",\n\t\t\t\t\"ec2:DescribeTags\",\n\t\t\t\t\"ec2:DescribeVolumes\",\n\t\t\t\t\"ec2:DescribeVolumesModifications\",\n\t\t\t\t\"ec2:DetachVolume\",\n\t\t\t\t\"ec2:ModifyVolume\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - controlPlaneOperatorARN
+ - imageRegistryARN
+ - ingressARN
+ - kubeCloudControllerARN
+ - networkARN
+ - nodePoolManagementARN
+ - storageARN
+ type: object
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints specifies optional custom endpoints which will override
+ the default service endpoint of specific AWS Services.
+
+ There must be only one ServiceEndpoint for a given service name.
+ items:
+ description: |-
+ AWSServiceEndpoint stores the configuration for services to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ This must be provided and cannot be empty.
+ maxLength: 255
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 50
+ type: array
+ sharedVPC:
+ description: |-
+ sharedVPC contains fields that must be specified if the HostedCluster must use a VPC that is
+ created in a different AWS account and is shared with the AWS account where the HostedCluster
+ will be created.
+ properties:
+ localZoneID:
+ description: |-
+ localZoneID is the ID of the route53 hosted zone for [cluster-name].hypershift.local that is
+ associated with the HostedCluster's VPC and exists in the VPC owner account.
+ maxLength: 32
+ type: string
+ rolesRef:
+ description: |-
+ rolesRef contains references to roles in the VPC owner account that enable a
+ HostedCluster on a shared VPC.
+ properties:
+ controlPlaneARN:
+ description: "controlPlaneARN is an ARN value referencing
+ the role in the VPC owner account that allows\nthe
+ control plane operator in the cluster account to
+ create and manage a VPC endpoint, its\ncorresponding
+ Security Group, and DNS records in the hypershift
+ local hosted zone.\n\nThe referenced role must have
+ a trust relationship that allows it to be assumed
+ by the\ncontrol plane operator role in the VPC creator
+ account.\nExample:\n{\n\t \"Version\": \"2012-10-17\",\n\t
+ \"Statement\": [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t
+ \t\t\"Effect\": \"Allow\",\n\t \t\t\"Principal\":
+ {\n\t \t\t\t\"AWS\": \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-control-plane-operator\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing
+ the role in the VPC owner account that allows the\ningress
+ operator in the cluster account to create and manage
+ records in the private DNS\nhosted zone.\n\nThe
+ referenced role must have a trust relationship that
+ allows it to be assumed by the\ningress operator
+ role in the VPC creator account.\nExample:\n{\n\t
+ \"Version\": \"2012-10-17\",\n\t \"Statement\":
+ [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t \t\t\"Effect\":
+ \"Allow\",\n\t \t\t\"Principal\": {\n\t \t\t\t\"AWS\":
+ \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-openshift-ingress\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n(Based on https://docs.openshift.com/rosa/rosa_install_access_delete_clusters/rosa-shared-vpc-config.html#rosa-sharing-vpc-dns-and-roles_rosa-shared-vpc-config)\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"route53:ListHostedZonesByName\",\n\t\t\t\t\"route53:ChangeTagsForResource\",\n\t\t\t\t\"route53:GetAccountLimit\",\n\t\t\t\t\"route53:GetChange\",\n\t\t\t\t\"route53:GetHostedZone\",\n\t\t\t\t\"route53:ListTagsForResource\",\n\t\t\t\t\"route53:UpdateHostedZoneComment\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"tag:UntagResources\"\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ required:
+ - controlPlaneARN
+ - ingressARN
+ type: object
+ required:
+ - localZoneID
+ - rolesRef
+ type: object
+ required:
+ - region
+ - rolesRef
+ type: object
+ azure:
+ description: azure defines azure specific settings
+ properties:
+ azureAuthenticationConfig:
+ description: |-
+ azureAuthenticationConfig is the type of Azure authentication configuration to use to authenticate with Azure's
+ Cloud API.
+ properties:
+ azureAuthenticationConfigType:
+ description: |-
+ azureAuthenticationConfigType is the type of identity configuration used in the Hosted Cluster. This field is
+ used to determine which identity configuration is being used. Valid values are "ManagedIdentities" and
+ "WorkloadIdentities".
+ enum:
+ - ManagedIdentities
+ - WorkloadIdentities
+ type: string
+ managedIdentities:
+ description: |-
+ managedIdentities contains the managed identities needed for HCP control plane and data plane components that
+ authenticate with Azure's API.
+
+ These are required for managed Azure, also known as ARO HCP.
+ properties:
+ controlPlane:
+ description: |-
+ controlPlane contains the client IDs of all the managed identities on the HCP control plane needing to
+ authenticate with Azure's API.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is a pre-existing managed identity associated with the azure cloud provider, aka cloud controller
+ manager.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ controlPlaneOperator:
+ description: controlPlaneOperator is a pre-existing
+ managed identity associated with the control
+ plane operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ disk:
+ description: disk is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ file:
+ description: file is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ imageRegistry:
+ description: imageRegistry is a pre-existing managed
+ identity associated with the cluster-image-registry-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ ingress:
+ description: ingress is a pre-existing managed
+ identity associated with the cluster-ingress-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ managedIdentitiesKeyVault:
+ description: |-
+ managedIdentitiesKeyVault contains information on the management cluster's managed identities Azure Key Vault.
+ This Key Vault is where the managed identities certificates are stored. These certificates are pulled out of the
+ Key Vault by the Secrets Store CSI driver and mounted into a volume on control plane pods requiring
+ authentication with Azure API.
+
+ More information on how the Secrets Store CSI driver works to do this can be found here:
+ https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver.
+ properties:
+ name:
+ description: name is the name of the Azure
+ Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ tenantID:
+ description: tenantID is the tenant ID of
+ the Azure Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - tenantID
+ type: object
+ network:
+ description: network is a pre-existing managed
+ identity associated with the cluster-network-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ nodePoolManagement:
+ description: nodePoolManagement is a pre-existing
+ managed identity associated with the operator
+ managing the NodePools.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - cloudProvider
+ - controlPlaneOperator
+ - disk
+ - file
+ - ingress
+ - managedIdentitiesKeyVault
+ - network
+ - nodePoolManagement
+ type: object
+ dataPlane:
+ description: |-
+ dataPlane contains the client IDs of all the managed identities on the data plane needing to authenticate with
+ Azure's API.
+ properties:
+ diskMSIClientID:
+ description: diskMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI Disk driver.
+ maxLength: 255
+ type: string
+ fileMSIClientID:
+ description: fileMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI File driver.
+ maxLength: 255
+ type: string
+ imageRegistryMSIClientID:
+ description: |-
+ imageRegistryMSIClientID is the client ID of a pre-existing managed identity ID associated with the image
+ registry controller.
+ maxLength: 255
+ type: string
+ required:
+ - diskMSIClientID
+ - fileMSIClientID
+ - imageRegistryMSIClientID
+ type: object
+ required:
+ - controlPlane
+ - dataPlane
+ type: object
+ workloadIdentities:
+ description: |-
+ workloadIdentities is a struct of client IDs for each component that needs to authenticate with Azure's API in
+ self-managed Azure. These client IDs are used to authenticate with Azure cloud on both the control plane and data
+ plane.
+
+ This is required for self-managed Azure.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is the client ID of a federated managed identity, associated with azure-cloud-provider, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ disk:
+ description: |-
+ disk is the client ID of a federated managed identity, associated with cluster-storage-operator-disk,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ file:
+ description: |-
+ file is the client ID of a federated managed identity, associated with cluster-storage-operator-file,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ imageRegistry:
+ description: |-
+ imageRegistry is the client ID of a federated managed identity, associated with cluster-image-registry-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ ingress:
+ description: |-
+ ingress is the client ID of a federated managed identity, associated with cluster-ingress-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ network:
+ description: |-
+ network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ nodePoolManagement:
+ description: |-
+ nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
+ in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ required:
+ - cloudProvider
+ - disk
+ - file
+ - imageRegistry
+ - ingress
+ - network
+ - nodePoolManagement
+ type: object
+ required:
+ - azureAuthenticationConfigType
+ type: object
+ x-kubernetes-validations:
+ - message: managedIdentities is required when azureAuthenticationConfigType
+ is ManagedIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''ManagedIdentities''
+ ? has(self.managedIdentities) : !has(self.managedIdentities)'
+ - message: workloadIdentities is required when azureAuthenticationConfigType
+ is WorkloadIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''WorkloadIdentities''
+ ? has(self.workloadIdentities) : !has(self.workloadIdentities)'
+ cloud:
+ default: AzurePublicCloud
+ description: 'cloud is the cloud environment identifier, valid
+ values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33'
+ enum:
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ location:
+ description: |-
+ location is the Azure region in where all the cloud infrastructure resources will be created.
+
+ Example: eastus
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: Location is immutable
+ rule: self == oldSelf
+ resourceGroup:
+ default: default
+ description: |-
+ resourceGroup is the name of an existing resource group where all cloud resources created by the Hosted
+ Cluster are to be placed. The resource group is expected to exist under the same subscription as SubscriptionID.
+
+ In ARO HCP, this will be the managed resource group where customer cloud resources will be created.
+
+ Resource group naming requirements can be found here: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ResourceGroup.Name/.
+
+ Example: if your resource group ID is /subscriptions//resourceGroups/, your
+ ResourceGroupName is .
+ maxLength: 90
+ pattern: ^[a-zA-Z0-9_()\-\.]{1,89}[a-zA-Z0-9_()\-]$
+ type: string
+ x-kubernetes-validations:
+ - message: ResourceGroupName is immutable
+ rule: self == oldSelf
+ securityGroupID:
+ description: |-
+ securityGroupID is the ID of an existing security group on the SubnetID. This field is provided as part of the
+ configuration for the Azure cloud provider, aka Azure cloud controller manager (CCM). This security group is
+ expected to exist under the same subscription as SubscriptionID.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SecurityGroupID is immutable
+ rule: self == oldSelf
+ subnetID:
+ description: |-
+ subnetID is the subnet ID of an existing subnet where the nodes in the nodepool will be created. This can be a
+ different subnet than the one listed in the HostedCluster, HostedCluster.Spec.Platform.Azure.SubnetID, but must
+ exist in the same network, HostedCluster.Spec.Platform.Azure.VnetID, and must exist under the same subscription ID,
+ HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ subnetID is immutable once set.
+ The subnetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The vnetName should be between 2 and 64 characters, consisting only of alphanumeric characters, hyphens, underscores and periods and must not end with either a period (.) or hyphen (-) character.
+ The subnetName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores and must start with an alphanumeric character and must not end with a period (.) or hyphen (-) character.
+ maxLength: 355
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`
+ rule: size(self.split('/')) == 11 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Network/virtualNetworks/.*/subnets/.*$')
+ - message: The resourceGroupName should be between 1 and 90
+ characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the subnetID must not
+ end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The vnetName should be between 2 and 64 characters,
+ consisting only of alphanumeric characters, hyphens, underscores
+ and periods
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_\\.]{2,64}')
+ - message: the vnetName in the subnetID must not end with
+ either a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[8].endsWith(''.'') && !self.split(''/'')[8].endsWith(''-'')'
+ - message: The subnetName should be between 1 and 80 characters,
+ consisting only of alphanumeric characters, hyphens and
+ underscores and must start with an alphanumeric character
+ rule: self.split('/')[10].matches('[a-zA-Z0-9][a-zA-Z0-9-_\\.]{0,79}')
+ - message: the subnetName in the subnetID must not end with
+ a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[10].endsWith(''.'') && !self.split(''/'')[10].endsWith(''-'')'
+ - message: SubnetID is immutable
+ rule: self == oldSelf
+ subscriptionID:
+ description: subscriptionID is a unique identifier for an
+ Azure subscription used to manage resources.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SubscriptionID is immutable
+ rule: self == oldSelf
+ tenantID:
+ description: tenantID is a unique identifier for the tenant
+ where Azure resources will be created and managed in.
+ maxLength: 255
+ type: string
+ vnetID:
+ description: |-
+ vnetID is the ID of an existing VNET to use in creating VMs. The VNET can exist in a different resource group
+ other than the one specified in ResourceGroupName, but it must exist under the same subscription as
+ SubscriptionID.
+
+ In ARO HCP, this will be the ID of the customer provided VNET.
+
+ Example: /subscriptions//resourceGroups//providers/Microsoft.Network/virtualNetworks/
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: VnetID is immutable
+ rule: self == oldSelf
+ required:
+ - azureAuthenticationConfig
+ - location
+ - resourceGroup
+ - securityGroupID
+ - subnetID
+ - subscriptionID
+ - tenantID
+ - vnetID
+ type: object
+ ibmcloud:
+ description: ibmcloud defines IBMCloud specific settings for components
+ properties:
+ providerType:
+ description: providerType is a specific supported infrastructure
+ provider within IBM Cloud.
+ type: string
+ type: object
+ kubevirt:
+ description: kubevirt defines KubeVirt specific settings for cluster
+ components.
+ properties:
+ baseDomainPassthrough:
+ description: |-
+ baseDomainPassthrough toggles whether or not an automatically
+ generated base domain for the guest cluster should be used that
+ is a subdomain of the management cluster's *.apps DNS.
+
+ For the KubeVirt platform, the basedomain can be autogenerated using
+ the *.apps domain of the management/infra hosting cluster
+ This makes the guest cluster's base domain a subdomain of the
+ hypershift infra/mgmt cluster's base domain.
+
+ Example:
+ Infra/Mgmt cluster's DNS
+ Base: example.com
+ Cluster: mgmt-cluster.example.com
+ Apps: *.apps.mgmt-cluster.example.com
+ KubeVirt Guest cluster's DNS
+ Base: apps.mgmt-cluster.example.com
+ Cluster: guest.apps.mgmt-cluster.example.com
+ Apps: *.apps.guest.apps.mgmt-cluster.example.com
+
+ This is possible using OCP wildcard routes
+ type: boolean
+ x-kubernetes-validations:
+ - message: baseDomainPassthrough is immutable
+ rule: self == oldSelf
+ credentials:
+ description: |-
+ credentials defines the client credentials used when creating KubeVirt virtual machines.
+ Defining credentials is only necessary when the KubeVirt virtual machines are being placed
+ on a cluster separate from the one hosting the Hosted Control Plane components.
+
+ The default behavior when Credentials is not defined is for the KubeVirt VMs to be placed on
+ the same cluster and namespace as the Hosted Control Plane.
+ properties:
+ infraKubeConfigSecret:
+ description: |-
+ infraKubeConfigSecret is a reference to the secret containing the kubeconfig
+ of an external infrastructure cluster for kubevirt provider
+ properties:
+ key:
+ description: key is the key in the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: infraKubeConfigSecret is immutable
+ rule: self == oldSelf
+ infraNamespace:
+ description: |-
+ infraNamespace is the namespace in the external infrastructure cluster
+ where kubevirt resources will be created
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: infraNamespace is immutable
+ rule: self == oldSelf
+ required:
+ - infraNamespace
+ type: object
+ generateID:
+ description: |-
+ generateID is used to uniquely apply a name suffix to resources associated with
+ kubevirt infrastructure resources
+ maxLength: 11
+ type: string
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is immutable once set
+ rule: self == oldSelf
+ storageDriver:
+ description: |-
+ storageDriver defines how the KubeVirt CSI driver exposes StorageClasses on
+ the infra cluster (hosting the VMs) to the guest cluster.
+ properties:
+ manual:
+ description: |-
+ manual is used to explicitly define how the infra storageclasses are
+ mapped to guest storageclasses
+ properties:
+ storageClassMapping:
+ description: |-
+ storageClassMapping maps StorageClasses on the infra cluster hosting
+ the KubeVirt VMs to StorageClasses that are made available within the
+ Guest Cluster.
+
+ NOTE: It is possible that not all capabilities of an infra cluster's
+ storageclass will be present for the corresponding guest clusters storageclass.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestStorageClassName:
+ description: |-
+ guestStorageClassName is the name that the corresponding storageclass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraStorageClassName:
+ description: |-
+ infraStorageClassName is the name of the infra cluster storage class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestStorageClassName
+ - infraStorageClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: storageClassMapping is immutable
+ rule: self == oldSelf
+ volumeSnapshotClassMapping:
+ description: |-
+ volumeSnapshotClassMapping maps VolumeSnapshotClasses on the infra cluster hosting
+ the KubeVirt VMs to VolumeSnapshotClasses that are made available within the
+ Guest Cluster.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestVolumeSnapshotClassName:
+ description: |-
+ guestVolumeSnapshotClassName is the name that the corresponding volumeSnapshotClass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraVolumeSnapshotClassName:
+ description: |-
+ infraVolumeSnapshotClassName is the name of the infra cluster volume snapshot class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestVolumeSnapshotClassName
+ - infraVolumeSnapshotClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: volumeSnapshotClassMapping is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver.Manual is immutable
+ rule: self == oldSelf
+ type:
+ default: Default
+ description: type represents the type of kubevirt csi
+ driver configuration to use
+ enum:
+ - None
+ - Default
+ - Manual
+ type: string
+ x-kubernetes-validations:
+ - message: storageDriver.Type is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is required once set
+ rule: '!has(oldSelf.generateID) || has(self.generateID)'
+ powervs:
+ description: |-
+ powervs specifies configuration for clusters running on IBMCloud Power VS Service.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ accountID:
+ description: |-
+ accountID is the IBMCloud account id.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the IBMCloud CIS Service Instance's Cloud Resource Name
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ pattern: '^crn:'
+ type: string
+ imageRegistryOperatorCloudCreds:
+ description: |-
+ imageRegistryOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for image registry operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ ingressOperatorCloudCreds:
+ description: |-
+ ingressOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for ingress operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ kubeCloudControllerCreds:
+ description: |
+ kubeCloudControllerCreds is a reference to a secret containing cloud
+ credentials with permissions matching the cloud controller policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ nodePoolManagementCreds:
+ description: |
+ nodePoolManagementCreds is a reference to a secret containing cloud
+ credentials with permissions matching the node pool management policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ region:
+ description: |-
+ region is the IBMCloud region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot image for a given release.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the IBMCloud Resource Group in which the cluster resides.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ serviceInstanceID:
+ description: |-
+ serviceInstanceID is the reference to the Power VS service on which the server instance(VM) will be created.
+ Power VS service is a container for all Power VS instances at a specific geographic region.
+ serviceInstance can be created via IBM Cloud catalog or CLI.
+ ServiceInstanceID is the unique identifier that can be obtained from IBM Cloud UI or IBM Cloud cli.
+
+ More detail about Power VS service instance.
+ https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-creating-power-virtual-server
+
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ storageOperatorCloudCreds:
+ description: |-
+ storageOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for storage operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ subnet:
+ description: |-
+ subnet is the subnet to use for control plane cloud resources.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ name:
+ description: name of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: |-
+ vpc specifies IBM Cloud PowerVS Load Balancing configuration for the control
+ plane.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ description: |-
+ name for VPC to used for all the service load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ region:
+ description: |-
+ region is the IBMCloud region in which VPC gets created, this VPC used for all the ingress traffic
+ into the OCP cluster.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ subnet:
+ description: |-
+ subnet is the subnet to use for load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where load balancer cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - region
+ type: object
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - accountID
+ - cisInstanceCRN
+ - imageRegistryOperatorCloudCreds
+ - ingressOperatorCloudCreds
+ - kubeCloudControllerCreds
+ - nodePoolManagementCreds
+ - region
+ - resourceGroup
+ - serviceInstanceID
+ - storageOperatorCloudCreds
+ - subnet
+ - vpc
+ - zone
+ type: object
+ type:
+ description: type is the type of infrastructure provider for the
+ cluster.
+ enum:
+ - AWS
+ - Azure
+ - IBMCloud
+ - KubeVirt
+ - Agent
+ - PowerVS
+ - None
+ maxLength: 100
+ type: string
+ x-kubernetes-validations:
+ - message: Type is immutable
+ rule: self == oldSelf
+ required:
+ - type
+ type: object
+ pullSecret:
+ description: pullSecret is a reference to a secret containing the
+ pull secret for the hosted control plane.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ releaseImage:
+ description: releaseImage is the release image applied to the hosted
+ control plane.
+ maxLength: 255
+ type: string
+ secretEncryption:
+ description: |-
+ secretEncryption contains metadata about the kubernetes secret encryption strategy being used for the
+ cluster when applicable.
+ properties:
+ aescbc:
+ description: aescbc defines metadata about the AESCBC secret encryption
+ strategy
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to encrypt
+ new secrets
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - activeKey
+ type: object
+ kms:
+ description: kms defines metadata about the kms secret encryption
+ strategy
+ properties:
+ aws:
+ description: aws defines metadata about the configuration
+ of the AWS KMS Secret Encryption provider
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ auth:
+ description: auth defines metadata about the management
+ of credentials used to interact with AWS KMS
+ properties:
+ awsKms:
+ description: "awsKms is an ARN value referencing a
+ role appropriate for managing the auth via the AWS
+ KMS key.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n \t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"kms:Encrypt\",\n\t\t\t\t\"kms:Decrypt\",\n\t\t\t\t\"kms:ReEncrypt*\",\n\t\t\t\t\"kms:GenerateDataKey*\",\n\t\t\t\t\"kms:DescribeKey\"\n\t\t\t],\n\t\t\t\"Resource\":
+ %q\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - awsKms
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ region:
+ description: region contains the AWS region
+ maxLength: 255
+ type: string
+ required:
+ - activeKey
+ - auth
+ - region
+ type: object
+ azure:
+ description: azure defines metadata about the configuration
+ of the Azure KMS Secret Encryption provider using Azure
+ key vault
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ kms:
+ description: kms is a pre-existing managed identity used
+ to authenticate with Azure KMS.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity must
+ be a valid UUID. It should be 5 groups of hyphen
+ separated hexadecimal characters in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - activeKey
+ - kms
+ type: object
+ ibmcloud:
+ description: ibmcloud defines metadata for the IBM Cloud KMS
+ encryption strategy
+ properties:
+ auth:
+ description: auth defines metadata for how authentication
+ is done with IBM Cloud KMS
+ properties:
+ managed:
+ description: |-
+ managed defines metadata around the service to service authentication strategy for the IBM Cloud
+ KMS system (all provider managed).
+ type: object
+ type:
+ description: type defines the IBM Cloud KMS authentication
+ strategy
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ unmanaged:
+ description: unmanaged defines the auth metadata the
+ customer provides to interact with IBM Cloud KMS
+ properties:
+ credentials:
+ description: |-
+ credentials should reference a secret with a key field of IBMCloudIAMAPIKeySecretKey that contains a apikey to
+ call IBM Cloud KMS APIs
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - credentials
+ type: object
+ required:
+ - type
+ type: object
+ keyList:
+ description: keyList defines the list of keys used for
+ data encryption
+ items:
+ description: IBMCloudKMSKeyEntry defines metadata for
+ an IBM Cloud KMS encryption key
+ properties:
+ correlationID:
+ description: correlationID is an identifier used
+ to track all api call usage from hypershift
+ maxLength: 255
+ type: string
+ crkID:
+ description: crkID is the customer rook key id
+ maxLength: 255
+ type: string
+ instanceID:
+ description: instanceID is the id for the key protect
+ instance
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: |-
+ keyVersion is a unique number associated with the key. The number increments whenever a new
+ key is enabled for data encryption.
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ url:
+ description: url is the url to call key protect
+ apis over
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - correlationID
+ - crkID
+ - instanceID
+ - keyVersion
+ - url
+ type: object
+ maxItems: 100
+ type: array
+ region:
+ description: region is the IBM Cloud region
+ maxLength: 255
+ type: string
+ required:
+ - auth
+ - keyList
+ - region
+ type: object
+ provider:
+ description: provider defines the KMS provider
+ enum:
+ - IBMCloud
+ - AWS
+ - Azure
+ type: string
+ required:
+ - provider
+ type: object
+ type:
+ description: type defines the type of kube secret encryption being
+ used
+ enum:
+ - kms
+ - aescbc
+ type: string
+ required:
+ - type
+ type: object
+ serviceAccountSigningKey:
+ description: |-
+ serviceAccountSigningKey is a reference to a secret containing the private key
+ used by the service account token issuer. The secret is expected to contain
+ a single key named "key". If not specified, a service account signing key will
+ be generated automatically for the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ services:
+ description: |-
+ services defines metadata about how control plane services are published
+ in the management cluster.
+ items:
+ description: |-
+ ServicePublishingStrategyMapping specifies how individual control plane services endpoints are published for consumption.
+ This includes APIServer;OAuthServer;Konnectivity;Ignition.
+ If a given service is not present in this list, it will be exposed publicly by default.
+ properties:
+ service:
+ description: |-
+ service identifies the type of service being published.
+ It can be APIServer;OAuthServer;Konnectivity;Ignition
+ OVNSbDb;OIDC are no-op and kept for backward compatibility.
+ This field is immutable.
+ enum:
+ - APIServer
+ - OAuthServer
+ - OIDC
+ - Konnectivity
+ - Ignition
+ - OVNSbDb
+ type: string
+ servicePublishingStrategy:
+ description: servicePublishingStrategy specifies how to publish
+ a service endpoint.
+ properties:
+ loadBalancer:
+ description: loadBalancer configures exposing a service
+ using a dedicated LoadBalancer.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the LoadBalancer and passed through to consumers of the service.
+ If omitted, the value will be inferred from the corev1.Service Load balancer type .status.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ nodePort:
+ description: nodePort configures exposing a service using
+ a NodePort.
+ properties:
+ address:
+ description: address is the host/ip that the NodePort
+ service is exposed over.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: address must be a valid hostname, IPv4, or
+ IPv6 address
+ rule: self.matches('^(([a-zA-Z0-9][-a-zA-Z0-9]*\\.)+[a-zA-Z]{2,}|localhost)$')
+ || self.matches('^((\\d{1,3}\\.){3}\\d{1,3})$')
+ || self.matches('^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$')
+ port:
+ description: |-
+ port is the port of the NodePort service. If <=0, the port is dynamically
+ assigned when the service is created.
+ format: int32
+ type: integer
+ required:
+ - address
+ type: object
+ route:
+ description: |-
+ route configures exposing a service using a Route through and an ingress controller behind a cloud Load Balancer.
+ The specifics of the setup are platform dependent.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the Route and passed through to consumers of the service.
+ If omitted, the value will be inferred from management ingress.Spec.Domain.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy used for the service.
+ It can be LoadBalancer;NodePort;Route;None;S3
+ enum:
+ - LoadBalancer
+ - NodePort
+ - Route
+ - None
+ - S3
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: nodePort is required when type is NodePort, and forbidden
+ otherwise
+ rule: 'self.type == ''NodePort'' ? has(self.nodePort) : !has(self.nodePort)'
+ - message: only route is allowed when type is Route, and forbidden
+ otherwise
+ rule: 'self.type == ''Route'' ? !has(self.nodePort) && !has(self.loadBalancer)
+ : !has(self.route)'
+ - message: only loadBalancer is required when type is LoadBalancer,
+ and forbidden otherwise
+ rule: 'self.type == ''LoadBalancer'' ? !has(self.nodePort)
+ && !has(self.route) : !has(self.loadBalancer)'
+ - message: None does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''None'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ - message: S3 does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''S3'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ required:
+ - service
+ - servicePublishingStrategy
+ type: object
+ maxItems: 6
+ type: array
+ sshKey:
+ description: sshKey is a reference to a secret containing the SSH
+ key for the hosted control plane.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ tolerations:
+ description: tolerations when specified, define what custom tolerations
+ are added to the hcp pods.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ maxItems: 25
+ type: array
+ updateService:
+ description: |-
+ updateService may be used to specify the preferred upstream update service.
+ By default it will use the appropriate update service for the cluster and region.
+ type: string
+ required:
+ - dns
+ - etcd
+ - infraID
+ - issuerURL
+ - platform
+ - pullSecret
+ - releaseImage
+ - services
+ - sshKey
+ type: object
+ x-kubernetes-validations:
+ - message: spec.services in body should have at least 4 items or 3 for
+ IBMCloud
+ rule: 'self.platform.type == ''IBMCloud'' ? size(self.services) >= 3
+ : size(self.services) >= 4'
+ - message: disableMultiNetwork can only be set to true when networkType
+ is 'Other'
+ rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)
+ || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork)
+ || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork
+ || self.networking.networkType == ''Other'''
+ status:
+ description: status is the status of the HostedControlPlane.
+ properties:
+ conditions:
+ description: |-
+ conditions contains details for one aspect of the current state of the HostedControlPlane.
+ Current condition types are: "Available"
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ configuration:
+ description: configuration contains the cluster configuration status
+ of the HostedCluster
+ properties:
+ authentication:
+ description: |-
+ authentication contains the observed authentication configuration status from the hosted cluster.
+ This field reflects the current state of the cluster authentication including OAuth metadata,
+ OIDC client status, and other authentication-related configurations.
+ properties:
+ integratedOAuthMetadata:
+ description: |-
+ integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for the in-cluster integrated OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ This contains the observed value based on cluster state.
+ An explicitly set value in spec.oauthMetadata has precedence over this field.
+ This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
+ The key "oauthMetadata" is used to locate the data.
+ If the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config-managed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcClients:
+ description: |-
+ oidcClients is where participating operators place the current OIDC client status
+ for OIDC clients that can be customized by the cluster-admin.
+ items:
+ description: |-
+ OIDCClientStatus represents the current state
+ of platform components and how they interact with
+ the configured identity providers.
+ properties:
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component using the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component using the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ conditions:
+ description: |-
+ conditions are used to communicate the state of the `oidcClients` entry.
+
+ Supported conditions include Available, Degraded and Progressing.
+
+ If Available is true, the component is successfully using the configured client.
+ If Degraded is true, that means something has gone wrong trying to handle the client configuration.
+ If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or
+ in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ consumingUsers:
+ description: |-
+ consumingUsers is an optional list of ServiceAccounts requiring
+ read permissions on the `clientSecret` secret.
+
+ consumingUsers must not exceed 5 entries.
+ items:
+ description: ConsumingUser is an alias for string
+ which we add validation to. Currently only service
+ accounts are supported.
+ maxLength: 512
+ minLength: 1
+ pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ maxItems: 5
+ type: array
+ x-kubernetes-list-type: set
+ currentOIDCClients:
+ description: |-
+ currentOIDCClients is an optional list of clients that the component is currently using.
+ Entries must have unique issuerURL/clientID pairs.
+ items:
+ description: |-
+ OIDCClientReference is a reference to a platform component
+ client configuration.
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that specifies the client identifier, from
+ the identity provider, that the platform component is using for authentication
+ requests made to the identity provider.
+
+ clientID must not be empty.
+ minLength: 1
+ type: string
+ issuerURL:
+ description: |-
+ issuerURL is a required field that specifies the URL of the identity
+ provider that this client is configured to make requests against.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ oidcProviderName:
+ description: |-
+ oidcProviderName is a required reference to the 'name' of the identity provider
+ configured in 'oidcProviders' that this client is associated with.
+
+ oidcProviderName must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - clientID
+ - issuerURL
+ - oidcProviderName
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - issuerURL
+ - clientID
+ x-kubernetes-list-type: map
+ required:
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ type: object
+ type: object
+ controlPlaneEndpoint:
+ description: |-
+ controlPlaneEndpoint contains the endpoint information by which
+ external clients can access the control plane. This is populated
+ after the infrastructure is ready.
+ properties:
+ host:
+ description: host is the hostname on which the API server is serving.
+ maxLength: 255
+ type: string
+ port:
+ description: port is the port on which the API server is serving.
+ format: int32
+ type: integer
+ required:
+ - host
+ - port
+ type: object
+ customKubeconfig:
+ description: |-
+ customKubeconfig references an external custom kubeconfig secret.
+ This field is populated in the status when a custom kubeconfig secret has been generated
+ for the hosted cluster. It contains the name and key of the secret located in the
+ hostedCluster namespace. This field is only populated when kubeApiExternalName is set.
+ If this field is removed during a day 2 operation, the referenced secret will be deleted
+ and this field will be removed from the hostedCluster status.
+ properties:
+ key:
+ description: key is the key in the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ externalManagedControlPlane:
+ default: true
+ description: |-
+ externalManagedControlPlane indicates to cluster-api that the control plane
+ is managed by an external service.
+ https://github.com/kubernetes-sigs/cluster-api/blob/65e5385bffd71bf4aad3cf34a537f11b217c7fab/controllers/machine_controller.go#L468
+ type: boolean
+ initialized:
+ default: false
+ description: |-
+ initialized denotes whether or not the control plane has
+ provided a kubeadm-config.
+ Once this condition is marked true, its value is never changed. See the Ready condition for an indication of
+ the current readiness of the cluster's control plane.
+ This satisfies CAPI contract https://github.com/kubernetes-sigs/cluster-api/blob/cd3a694deac89d5ebeb888307deaa61487207aa0/controllers/cluster_controller_phases.go#L238-L252
+ type: boolean
+ kubeConfig:
+ description: |-
+ kubeConfig is a reference to the secret containing the default kubeconfig
+ for this control plane.
+ properties:
+ key:
+ description: key is the key in the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ kubeadminPassword:
+ description: |-
+ kubeadminPassword is a reference to the secret containing the initial kubeadmin password
+ for the guest cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ lastReleaseImageTransitionTime:
+ description: |-
+ lastReleaseImageTransitionTime is the time of the last update to the current
+ releaseImage property.
+
+ Deprecated: Use versionStatus.history[0].startedTime instead.
+ format: date-time
+ type: string
+ nodeCount:
+ description: nodeCount tracks the number of nodes in the HostedControlPlane.
+ type: integer
+ oauthCallbackURLTemplate:
+ description: |-
+ oauthCallbackURLTemplate contains a template for the URL to use as a callback
+ for identity providers. The [identity-provider-name] placeholder must be replaced
+ with the name of an identity provider defined on the HostedCluster.
+ This is populated after the infrastructure is ready.
+ maxLength: 255
+ type: string
+ platform:
+ description: platform contains platform-specific status of the HostedCluster
+ properties:
+ aws:
+ description: aws contains platform-specific status for AWS
+ properties:
+ defaultWorkerSecurityGroupID:
+ description: |-
+ defaultWorkerSecurityGroupID is the ID of a security group created by
+ the control plane operator. It is always added to worker machines in
+ addition to any security groups specified in the NodePool.
+ maxLength: 255
+ type: string
+ type: object
+ type: object
+ ready:
+ default: false
+ description: |-
+ ready denotes that the HostedControlPlane API Server is ready to
+ receive requests
+ This satisfies CAPI contract https://github.com/kubernetes-sigs/cluster-api/blob/cd3a694deac89d5ebeb888307deaa61487207aa0/controllers/cluster_controller_phases.go#L226-L230
+ type: boolean
+ releaseImage:
+ description: |-
+ releaseImage is the release image applied to the hosted control plane.
+
+ Deprecated: Use versionStatus.desired.image instead.
+ maxLength: 255
+ type: string
+ version:
+ description: |-
+ version is the semantic version of the release applied by
+ the hosted control plane operator
+
+ Deprecated: Use versionStatus.desired.version instead.
+ maxLength: 255
+ type: string
+ versionStatus:
+ description: |-
+ versionStatus is the status of the release version applied by the
+ hosted control plane operator.
+ properties:
+ availableUpdates:
+ description: |-
+ availableUpdates contains updates recommended for this
+ cluster. Updates which appear in conditionalUpdates but not in
+ availableUpdates may expose this cluster to known issues. This list
+ may be empty if no updates are recommended, if the update service
+ is unavailable, or if an invalid channel has been specified.
+ items:
+ description: Release represents an OpenShift release image and
+ associated metadata.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ maxItems: 100
+ nullable: true
+ type: array
+ conditionalUpdates:
+ description: |-
+ conditionalUpdates contains the list of updates that may be
+ recommended for this cluster if it meets specific required
+ conditions. Consumers interested in the set of updates that are
+ actually recommended for this cluster should use
+ availableUpdates. This list may be empty if no updates are
+ recommended, if the update service is unavailable, or if an empty
+ or invalid channel has been specified.
+ items:
+ description: |-
+ ConditionalUpdate represents an update which is recommended to some
+ clusters on the version the current cluster is reconciling, but which
+ may not be recommended for the current cluster.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the observations of the conditional update's
+ current status. Known types are:
+ * Recommended, for whether the update is recommended for the current cluster.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in
+ foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ release:
+ description: release is the target of the update.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ risks:
+ description: |-
+ risks represents the range of issues associated with
+ updating to the target release. The cluster-version
+ operator will evaluate all entries, and only recommend the
+ update if there is at least one entry and all entries
+ recommend the update.
+ items:
+ description: |-
+ ConditionalUpdateRisk represents a reason and cluster-state
+ for not recommending a conditional update.
+ properties:
+ matchingRules:
+ description: |-
+ matchingRules is a slice of conditions for deciding which
+ clusters match the risk and which do not. The slice is
+ ordered by decreasing precedence. The cluster-version
+ operator will walk the slice in order, and stop after the
+ first it can successfully evaluate. If no condition can be
+ successfully evaluated, the update will not be recommended.
+ items:
+ description: |-
+ ClusterCondition is a union of typed cluster conditions. The 'type'
+ property determines which of the type-specific properties are relevant.
+ When evaluated on a cluster, the condition may match, not match, or
+ fail to evaluate.
+ properties:
+ promql:
+ description: promql represents a cluster condition
+ based on PromQL.
+ properties:
+ promql:
+ description: |-
+ promql is a PromQL query classifying clusters. This query
+ query should return a 1 in the match case and a 0 in the
+ does-not-match case. Queries which return no time
+ series, or which return values besides 0 or 1, are
+ evaluation failures.
+ type: string
+ required:
+ - promql
+ type: object
+ type:
+ description: |-
+ type represents the cluster-condition type. This defines
+ the members and semantics of any additional properties.
+ enum:
+ - Always
+ - PromQL
+ type: string
+ required:
+ - type
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ message:
+ description: |-
+ message provides additional information about the risk of
+ updating, in the event that matchingRules match the cluster
+ state. This is only to be consumed by humans. It may
+ contain Line Feed characters (U+000A), which should be
+ rendered as new lines.
+ minLength: 1
+ type: string
+ name:
+ description: |-
+ name is the CamelCase reason for not recommending a
+ conditional update, in the event that matchingRules match the
+ cluster state.
+ minLength: 1
+ type: string
+ url:
+ description: url contains information about this risk.
+ format: uri
+ minLength: 1
+ type: string
+ required:
+ - matchingRules
+ - message
+ - name
+ - url
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - release
+ - risks
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-type: atomic
+ desired:
+ description: |-
+ desired is the version that the cluster is reconciling towards.
+ If the cluster is not yet fully initialized desired will be set
+ with the information available, which may be an image or a tag.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ history:
+ description: |-
+ history contains a list of the most recent versions applied to the cluster.
+ This value may be empty during cluster startup, and then will be updated
+ when a new update is being applied. The newest update is first in the
+ list and it is ordered by recency. Updates in the history have state
+ Completed if the rollout completed - if an update was failing or halfway
+ applied the state will be Partial. Only a limited amount of update history
+ is preserved.
+ items:
+ description: UpdateHistory is a single attempted update to the
+ cluster.
+ properties:
+ acceptedRisks:
+ description: |-
+ acceptedRisks records risks which were accepted to initiate the update.
+ For example, it may menition an Upgradeable=False or missing signature
+ that was overriden via desiredUpdate.force, or an update that was
+ initiated despite not being in the availableUpdates set of recommended
+ update targets.
+ type: string
+ completionTime:
+ description: |-
+ completionTime, if set, is when the update was fully applied. The update
+ that is currently being applied will have a null completion time.
+ Completion time will always be set for entries that are not the current
+ update (usually to the started time of the next update).
+ format: date-time
+ nullable: true
+ type: string
+ image:
+ description: |-
+ image is a container image location that contains the update. This value
+ is always populated.
+ type: string
+ startedTime:
+ description: startedTime is the time at which the update
+ was started.
+ format: date-time
+ type: string
+ state:
+ description: |-
+ state reflects whether the update was fully applied. The Partial state
+ indicates the update is not fully applied, while the Completed state
+ indicates the update was successfully rolled out at least once (all
+ parts of the update successfully applied).
+ type: string
+ verified:
+ description: |-
+ verified indicates whether the provided update was properly verified
+ before it was installed. If this is false the cluster may not be trusted.
+ Verified does not cover upgradeable checks that depend on the cluster
+ state at the time when the update target was accepted.
+ type: boolean
+ version:
+ description: |-
+ version is a semantic version identifying the update version. If the
+ requested image does not define a version, or if a failure occurs
+ retrieving the image, this value may be empty.
+ type: string
+ required:
+ - completionTime
+ - image
+ - startedTime
+ - state
+ - verified
+ type: object
+ type: array
+ observedGeneration:
+ description: |-
+ observedGeneration reports which version of the spec is being synced.
+ If this value is not equal to metadata.generation, then the desired
+ and conditions fields may represent a previous version.
+ format: int64
+ type: integer
+ required:
+ - availableUpdates
+ - desired
+ - observedGeneration
+ type: object
+ required:
+ - initialized
+ - ready
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/hostedcontrolplanes-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/hostedcontrolplanes-TechPreviewNoUpgrade.crd.yaml
new file mode 100644
index 00000000000..c9d77161c46
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/hostedcontrolplanes-TechPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,7775 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: TechPreviewNoUpgrade
+ name: hostedcontrolplanes.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ categories:
+ - cluster-api
+ kind: HostedControlPlane
+ listKind: HostedControlPlaneList
+ plural: hostedcontrolplanes
+ shortNames:
+ - hcp
+ - hcps
+ singular: hostedcontrolplane
+ scope: Namespaced
+ versions:
+ - name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: HostedControlPlane defines the desired state of HostedControlPlane
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the specification for the HostedControlPlane.
+ properties:
+ additionalTrustBundle:
+ description: additionalTrustBundle references a ConfigMap containing
+ a PEM-encoded X.509 certificate bundle
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ auditWebhook:
+ description: |-
+ auditWebhook contains metadata for configuring an audit webhook
+ endpoint for a cluster to process cluster audit events. It references
+ a secret that contains the webhook information for the audit webhook endpoint.
+ It is a secret because if the endpoint has MTLS the kubeconfig will contain client
+ keys. This is currently only supported in IBM Cloud. The kubeconfig needs to be stored
+ in the secret with a secret key name that corresponds to the constant AuditWebhookKubeconfigKey.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ autoNode:
+ description: autoNode specifies the configuration for the autoNode
+ feature.
+ properties:
+ provisionerConfig:
+ description: provisionerConfig is the implementation used for
+ Node auto provisioning.
+ properties:
+ karpenter:
+ description: karpenter specifies the configuration for the
+ Karpenter provisioner.
+ properties:
+ aws:
+ description: aws specifies the AWS-specific configuration
+ for Karpenter.
+ properties:
+ roleARN:
+ description: roleARN specifies the ARN of the Karpenter
+ provisioner.
+ maxLength: 255
+ type: string
+ required:
+ - roleARN
+ type: object
+ platform:
+ description: platform specifies the platform-specific
+ configuration for Karpenter.
+ maxLength: 100
+ type: string
+ required:
+ - platform
+ type: object
+ name:
+ allOf:
+ - enum:
+ - Karpenter
+ - enum:
+ - Karpenter
+ description: name specifies the name of the provisioner to
+ use.
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - provisionerConfig
+ type: object
+ autoscaling:
+ description: |-
+ autoscaling specifies auto-scaling behavior that applies to all NodePools
+ associated with the control plane.
+ properties:
+ balancingIgnoredLabels:
+ description: |-
+ balancingIgnoredLabels sets "--balancing-ignore-label " flag on cluster-autoscaler for each listed label.
+ This option specifies labels that cluster autoscaler should ignore when considering node group similarity.
+ For example, if you have nodes with "topology.ebs.csi.aws.com/zone" label, you can add name of this label here
+ to prevent cluster autoscaler from splitting nodes into different node groups based on its value.
+
+ HyperShift automatically appends platform-specific balancing ignore labels:
+ - AWS: "lifecycle", "k8s.amazonaws.com/eniConfig", "topology.k8s.aws/zone-id"
+ - Azure: "agentpool", "kubernetes.azure.com/agentpool"
+ - Common:
+ - "hypershift.openshift.io/nodePool"
+ - "topology.ebs.csi.aws.com/zone"
+ - "topology.disk.csi.azure.com/zone"
+ - "ibm-cloud.kubernetes.io/worker-id"
+ - "vpc-block-csi-driver-labels"
+ These labels are added by default and do not need to be manually specified.
+ items:
+ maxLength: 317
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-validations:
+ - message: Each balancingIgnoredLabels item must be a valid label
+ key
+ rule: self.all(l, l.matches('^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?[a-zA-Z0-9]([a-zA-Z0-9_.-]{0,61}[a-zA-Z0-9])?$'))
+ expanders:
+ description: |-
+ expanders guide the autoscaler in choosing node groups during scale-out.
+ Sets the order of expanders for scaling out node groups.
+ Options include:
+ * LeastWaste - selects the group with minimal idle CPU and memory after scaling.
+ * Priority - selects the group with the highest user-defined priority.
+ * Random - selects a group randomly.
+ If not specified, `[Priority, LeastWaste]` is the default.
+ Maximum of 3 expanders can be specified.
+ items:
+ description: ExpanderString contains the name of an expander
+ to be used by the cluster autoscaler.
+ enum:
+ - LeastWaste
+ - Priority
+ - Random
+ type: string
+ maxItems: 3
+ minItems: 1
+ type: array
+ maxFreeDifferenceRatioPercent:
+ description: |-
+ maxFreeDifferenceRatioPercent sets the maximum difference ratio for free resources between similar node groups. This parameter controls how strict the similarity check is when comparing node groups for load balancing.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means node groups must have exactly the same free resources to be considered similar (no difference allowed).
+ When set to 100, this means node groups will be considered similar regardless of their free resource differences (any difference allowed).
+ A value between 0 and 100 represents the maximum allowed difference ratio for free resources between node groups to be considered similar.
+ When omitted, the autoscaler defaults to 10%.
+ This affects the "--max-free-difference-ratio" flag on cluster-autoscaler.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ maxNodeProvisionTime:
+ description: |-
+ maxNodeProvisionTime is the maximum time to wait for node provisioning
+ before considering the provisioning to be unsuccessful, expressed as a Go
+ duration string. The default is 15 minutes.
+ maxLength: 100
+ pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$
+ type: string
+ maxNodesTotal:
+ description: |-
+ maxNodesTotal is the maximum allowable number of nodes for the Autoscaler scale out to be operational.
+ The autoscaler will not grow the cluster beyond this number.
+ If omitted, the autoscaler will not have a maximum limit.
+ number.
+ format: int32
+ minimum: 0
+ type: integer
+ maxPodGracePeriod:
+ description: |-
+ maxPodGracePeriod is the maximum seconds to wait for graceful pod
+ termination before scaling down a NodePool. The default is 600 seconds.
+ format: int32
+ minimum: 0
+ type: integer
+ podPriorityThreshold:
+ description: |-
+ podPriorityThreshold enables users to schedule "best-effort" pods, which
+ shouldn't trigger autoscaler actions, but only run when there are spare
+ resources available. The default is -10.
+
+ See the following for more details:
+ https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#how-does-cluster-autoscaler-work-with-pod-priority-and-preemption
+ format: int32
+ type: integer
+ scaleDown:
+ description: |-
+ scaleDown configures the behavior of the Cluster Autoscaler scale down operation.
+ This field is only valid when scaling is set to ScaleUpAndScaleDown.
+ properties:
+ delayAfterAddSeconds:
+ description: |-
+ delayAfterAddSeconds sets how long after scale up the scale down evaluation resumes in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after scale up, without any delay.
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterDeleteSeconds:
+ description: |-
+ delayAfterDeleteSeconds sets how long after node deletion, scale down evaluation resumes, defaults to scan-interval.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after node deletion, without any delay.
+ When omitted, the autoscaler defaults to 0s.
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ delayAfterFailureSeconds:
+ description: |-
+ delayAfterFailureSeconds sets how long after a scale down failure, scale down evaluation resumes.
+ It must be between 0 and 86400 (24 hours).
+ When set to 0, this means scale down evaluation will resume immediately after a scale down failure, without any delay.
+ When omitted, the autoscaler defaults to 180s (3 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ unneededDurationSeconds:
+ description: |-
+ unneededDurationSeconds establishes how long a node should be unneeded before it is eligible for scale down in seconds.
+ It must be between 0 and 86400 (24 hours).
+ When omitted, the autoscaler defaults to 600s (10 minutes).
+ format: int32
+ maximum: 86400
+ minimum: 0
+ type: integer
+ utilizationThresholdPercent:
+ description: |-
+ utilizationThresholdPercent determines the node utilization level, defined as sum of requested resources divided by capacity, below which a node can be considered for scale down.
+ The value represents a percentage from 0 to 100.
+ When set to 0, this means nodes will only be considered for scale down if they are completely idle (0% utilization).
+ When set to 100, this means nodes will be considered for scale down regardless of their utilization level.
+ A value between 0 and 100 represents the utilization threshold below which a node can be considered for scale down.
+ When omitted, the autoscaler defaults to 50%.
+ format: int32
+ maximum: 100
+ minimum: 0
+ type: integer
+ type: object
+ scaling:
+ default: ScaleUpAndScaleDown
+ description: |-
+ scaling defines the scaling behavior for the cluster autoscaler.
+ ScaleUpOnly means the autoscaler will only scale up nodes, never scale down.
+ ScaleUpAndScaleDown means the autoscaler will both scale up and scale down nodes.
+ When set to ScaleUpAndScaleDown, the scaleDown field can be used to configure scale down behavior.
+
+ Note: This field is only supported in OpenShift versions 4.19 and above.
+ enum:
+ - ScaleUpOnly
+ - ScaleUpAndScaleDown
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: scaleDown can only be set when scaling is ScaleUpAndScaleDown
+ rule: 'self.scaling == ''ScaleUpAndScaleDown'' ? true : !has(self.scaleDown)'
+ capabilities:
+ default: {}
+ description: |-
+ capabilities allows for disabling optional components at cluster install time.
+ This field is optional and once set cannot be changed.
+ properties:
+ disabled:
+ description: |-
+ disabled when specified, explicitly disables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+
+ Note: Disabling 'openshift-samples','Insights', 'Console', 'NodeTuning', 'Ingress' are only supported in OpenShift versions 4.20 and above.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Disabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Ingress capability can only be disabled if Console
+ capability is also disabled
+ rule: '!self.exists(cap, cap == ''Ingress'') || self.exists(cap,
+ cap == ''Console'')'
+ enabled:
+ description: |-
+ enabled when specified, explicitly enables the specified capabilitíes on the hosted cluster.
+ Once set, this field cannot be changed.
+ items:
+ enum:
+ - ImageRegistry
+ - openshift-samples
+ - Insights
+ - baremetal
+ - Console
+ - NodeTuning
+ - Ingress
+ type: string
+ maxItems: 25
+ type: array
+ x-kubernetes-list-type: atomic
+ x-kubernetes-validations:
+ - message: Enabled is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Capabilities is immutable. Changes might result in unpredictable
+ and disruptive behavior.
+ rule: self == oldSelf
+ - message: Capabilities can not be both enabled and disabled at once.
+ rule: 'has(self.enabled) && has(self.disabled) ? self.enabled.all(e,
+ !(e in self.disabled)) : true'
+ channel:
+ description: |-
+ channel is an identifier for explicitly requesting that a non-default
+ set of updates be applied to this cluster. The default channel will be
+ contain stable updates that are appropriate for production clusters.
+ maxLength: 255
+ type: string
+ clusterID:
+ description: |-
+ clusterID is the unique id that identifies the cluster externally.
+ Making it optional here allows us to keep compatibility with previous
+ versions of the control-plane-operator that have no knowledge of this
+ field.
+ maxLength: 255
+ type: string
+ configuration:
+ description: |-
+ configuration embeds resources that correspond to the openshift configuration API:
+ https://docs.openshift.com/container-platform/4.7/rest_api/config_apis/config-apis-index.html
+ properties:
+ apiServer:
+ description: |-
+ apiServer holds configuration (like serving certificates, client CA and CORS domains)
+ shared by all API servers in the system, among them especially kube-apiserver
+ and openshift-apiserver.
+ properties:
+ additionalCORSAllowedOrigins:
+ description: |-
+ additionalCORSAllowedOrigins lists additional, user-defined regular expressions describing hosts for which the
+ API server allows access using the CORS headers. This may be needed to access the API and the integrated OAuth
+ server from JavaScript applications.
+ The values are regular expressions that correspond to the Golang regular expression language.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ audit:
+ default:
+ profile: Default
+ description: |-
+ audit specifies the settings for audit configuration to be applied to all OpenShift-provided
+ API servers in the cluster.
+ properties:
+ customRules:
+ description: |-
+ customRules specify profiles per group. These profile take precedence over the
+ top-level profile field if they apply. They are evaluation from top to bottom and
+ the first one that matches, applies.
+ items:
+ description: |-
+ AuditCustomRule describes a custom rule for an audit profile that takes precedence over
+ the top-level profile.
+ properties:
+ group:
+ description: group is a name of group a request
+ user must be member of in order to this profile
+ to apply.
+ minLength: 1
+ type: string
+ profile:
+ description: |-
+ profile specifies the name of the desired audit policy configuration to be deployed to
+ all OpenShift-provided API servers in the cluster.
+
+ The following profiles are provided:
+ - Default: the existing default policy.
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ required:
+ - group
+ - profile
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - group
+ x-kubernetes-list-type: map
+ profile:
+ default: Default
+ description: |-
+ profile specifies the name of the desired top-level audit profile to be applied to all requests
+ sent to any of the OpenShift-provided API servers in the cluster (kube-apiserver,
+ openshift-apiserver and oauth-apiserver), with the exception of those requests that match
+ one or more of the customRules.
+
+ The following profiles are provided:
+ - Default: default policy which means MetaData level logging with the exception of events
+ (not logged at all), oauthaccesstokens and oauthauthorizetokens (both logged at RequestBody
+ level).
+ - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ write requests (create, update, patch).
+ - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ HTTP payloads for read requests (get, list).
+ - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+
+ Warning: It is not recommended to disable audit logging by using the `None` profile unless you
+ are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues.
+ If you disable audit logging and a support situation arises, you might need to enable audit logging
+ and reproduce the issue in order to troubleshoot properly.
+
+ If unset, the 'Default' profile is used as the default.
+ enum:
+ - Default
+ - WriteRequestBodies
+ - AllRequestBodies
+ - None
+ type: string
+ type: object
+ clientCA:
+ description: |-
+ clientCA references a ConfigMap containing a certificate bundle for the signers that will be recognized for
+ incoming client certificates in addition to the operator managed signers. If this is empty, then only operator managed signers are valid.
+ You usually only have to set this if you have your own PKI you wish to honor client certificates from.
+ The ConfigMap must exist in the openshift-config namespace and contain the following required fields:
+ - ConfigMap.Data["ca-bundle.crt"] - CA bundle.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ encryption:
+ description: encryption allows the configuration of encryption
+ of resources at the datastore layer.
+ properties:
+ type:
+ description: |-
+ type defines what encryption type should be used to encrypt resources at the datastore layer.
+ When this field is unset (i.e. when it is set to the empty string), identity is implied.
+ The behavior of unset can and will change over time. Even if encryption is enabled by default,
+ the meaning of unset may change to a different encryption type based on changes in best practices.
+
+ When encryption is enabled, all sensitive resources shipped with the platform are encrypted.
+ This list of sensitive resources can and will change over time. The current authoritative list is:
+
+ 1. secrets
+ 2. configmaps
+ 3. routes.route.openshift.io
+ 4. oauthaccesstokens.oauth.openshift.io
+ 5. oauthauthorizetokens.oauth.openshift.io
+ enum:
+ - ""
+ - identity
+ - aescbc
+ - aesgcm
+ type: string
+ type: object
+ servingCerts:
+ description: |-
+ servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates
+ will be used for serving secure traffic.
+ properties:
+ namedCertificates:
+ description: |-
+ namedCertificates references secrets containing the TLS cert info for serving secure traffic to specific hostnames.
+ If no named certificates are provided, or no named certificates match the server name as understood by a client,
+ the defaultServingCertificate will be used.
+ items:
+ description: APIServerNamedServingCert maps a server
+ DNS name, as understood by a client, to a certificate.
+ properties:
+ names:
+ description: |-
+ names is a optional list of explicit DNS names (leading wildcards allowed) that should use this certificate to
+ serve secure traffic. If no names are provided, the implicit names will be extracted from the certificates.
+ Exact names trump over wildcard names. Explicit names defined here trump over extracted implicit names.
+ items:
+ type: string
+ maxItems: 64
+ type: array
+ x-kubernetes-list-type: atomic
+ servingCertificate:
+ description: |-
+ servingCertificate references a kubernetes.io/tls type secret containing the TLS cert info for serving secure traffic.
+ The secret must exist in the openshift-config namespace and contain the following required fields:
+ - Secret.Data["tls.key"] - TLS private key.
+ - Secret.Data["tls.crt"] - TLS certificate.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ maxItems: 32
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ tlsSecurityProfile:
+ description: |-
+ tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
+
+ If unset, a default (which may change between releases) is chosen. Note that only Old,
+ Intermediate and Custom profiles are currently supported, and the maximum available
+ minTLSVersion is VersionTLS12.
+ properties:
+ custom:
+ description: |-
+ custom is a user-defined TLS security profile. Be extremely careful using a custom
+ profile as invalid configurations can be catastrophic. An example custom profile
+ looks like this:
+
+ ciphers:
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ minTLSVersion: VersionTLS11
+ nullable: true
+ properties:
+ ciphers:
+ description: |-
+ ciphers is used to specify the cipher algorithms that are negotiated
+ during the TLS handshake. Operators may remove entries their operands
+ do not support. For example, to use DES-CBC3-SHA (yaml):
+
+ ciphers:
+ - DES-CBC3-SHA
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ minTLSVersion:
+ description: |-
+ minTLSVersion is used to specify the minimal version of the TLS protocol
+ that is negotiated during the TLS handshake. For example, to use TLS
+ versions 1.1, 1.2 and 1.3 (yaml):
+
+ minTLSVersion: VersionTLS11
+
+ NOTE: currently the highest minTLSVersion allowed is VersionTLS12
+ enum:
+ - VersionTLS10
+ - VersionTLS11
+ - VersionTLS12
+ - VersionTLS13
+ type: string
+ type: object
+ intermediate:
+ description: |-
+ intermediate is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ minTLSVersion: VersionTLS12
+ nullable: true
+ type: object
+ modern:
+ description: |-
+ modern is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ minTLSVersion: VersionTLS13
+ nullable: true
+ type: object
+ old:
+ description: |-
+ old is a TLS security profile based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility
+
+ and looks like this (yaml):
+
+ ciphers:
+
+ - TLS_AES_128_GCM_SHA256
+
+ - TLS_AES_256_GCM_SHA384
+
+ - TLS_CHACHA20_POLY1305_SHA256
+
+ - ECDHE-ECDSA-AES128-GCM-SHA256
+
+ - ECDHE-RSA-AES128-GCM-SHA256
+
+ - ECDHE-ECDSA-AES256-GCM-SHA384
+
+ - ECDHE-RSA-AES256-GCM-SHA384
+
+ - ECDHE-ECDSA-CHACHA20-POLY1305
+
+ - ECDHE-RSA-CHACHA20-POLY1305
+
+ - DHE-RSA-AES128-GCM-SHA256
+
+ - DHE-RSA-AES256-GCM-SHA384
+
+ - DHE-RSA-CHACHA20-POLY1305
+
+ - ECDHE-ECDSA-AES128-SHA256
+
+ - ECDHE-RSA-AES128-SHA256
+
+ - ECDHE-ECDSA-AES128-SHA
+
+ - ECDHE-RSA-AES128-SHA
+
+ - ECDHE-ECDSA-AES256-SHA384
+
+ - ECDHE-RSA-AES256-SHA384
+
+ - ECDHE-ECDSA-AES256-SHA
+
+ - ECDHE-RSA-AES256-SHA
+
+ - DHE-RSA-AES128-SHA256
+
+ - DHE-RSA-AES256-SHA256
+
+ - AES128-GCM-SHA256
+
+ - AES256-GCM-SHA384
+
+ - AES128-SHA256
+
+ - AES256-SHA256
+
+ - AES128-SHA
+
+ - AES256-SHA
+
+ - DES-CBC3-SHA
+
+ minTLSVersion: VersionTLS10
+ nullable: true
+ type: object
+ type:
+ description: |-
+ type is one of Old, Intermediate, Modern or Custom. Custom provides
+ the ability to specify individual TLS security profile parameters.
+ Old, Intermediate and Modern are TLS security profiles based on:
+
+ https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
+
+ The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers
+ are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be
+ reduced.
+
+ Note that the Modern profile is currently not supported because it is not
+ yet well adopted by common software libraries.
+ enum:
+ - Old
+ - Intermediate
+ - Modern
+ - Custom
+ type: string
+ type: object
+ type: object
+ authentication:
+ description: |-
+ authentication specifies cluster-wide settings for authentication (like OAuth and
+ webhook token authenticators).
+ properties:
+ oauthMetadata:
+ description: |-
+ oauthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for an external OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ If oauthMetadata.name is non-empty, this value has precedence
+ over any metadata reference stored in status.
+ The key "oauthMetadata" is used to locate the data.
+ If specified and the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcProviders:
+ description: |-
+ oidcProviders are OIDC identity providers that can issue tokens
+ for this cluster
+ Can only be set if "Type" is set to "OIDC".
+
+ At most one provider can be configured.
+ items:
+ properties:
+ claimMappings:
+ description: |-
+ claimMappings is an optional field that configures the rules to be used by
+ the Kubernetes API server for translating claims in a JWT token, issued
+ by the identity provider, to a cluster identity.
+ properties:
+ extra:
+ description: |-
+ extra is an optional field for configuring the mappings
+ used to construct the extra attribute for the cluster identity.
+ When omitted, no extra attributes will be present on the cluster identity.
+ key values for extra mappings must be unique.
+ A maximum of 64 extra attribute mappings may be provided.
+ items:
+ description: |-
+ ExtraMapping allows specifying a key and CEL expression
+ to evaluate the keys' value. It is used to create additional
+ mappings and attributes added to a cluster identity from
+ a provided authentication token.
+ properties:
+ key:
+ description: |-
+ key is a required field that specifies the string
+ to use as the extra attribute key.
+
+ key must be a domain-prefix path (e.g 'example.org/foo').
+ key must not exceed 510 characters in length.
+ key must contain the '/' character, separating the domain and path characters.
+ key must not be empty.
+
+ The domain portion of the key (string of characters prior to the '/') must be a valid RFC1123 subdomain.
+ It must not exceed 253 characters in length.
+ It must start and end with an alphanumeric character.
+ It must only contain lower case alphanumeric characters and '-' or '.'.
+ It must not use the reserved domains, or be subdomains of, "kubernetes.io", "k8s.io", and "openshift.io".
+
+ The path portion of the key (string of characters after the '/') must not be empty and must consist of at least one
+ alphanumeric character, percent-encoded octets, '-', '.', '_', '~', '!', '$', '&', ''', '(', ')', '*', '+', ',', ';', '=', and ':'.
+ It must not exceed 256 characters in length.
+ maxLength: 510
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: key must contain the '/' character
+ rule: self.contains('/')
+ - message: the domain of the key must consist
+ of only lower case alphanumeric characters,
+ '-' or '.', and must start and end with
+ an alphanumeric character
+ rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
+ - message: the domain of the key must not
+ exceed 253 characters in length
+ rule: self.split('/', 2)[0].size() <= 253
+ - message: the domain 'kubernetes.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'kubernetes.io'
+ - message: the subdomains '*.kubernetes.io'
+ are reserved for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
+ - message: the domain 'k8s.io' is reserved
+ for Kubernetes use
+ rule: self.split('/', 2)[0] != 'k8s.io'
+ - message: the subdomains '*.k8s.io' are reserved
+ for Kubernetes use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
+ - message: the domain 'openshift.io' is reserved
+ for OpenShift use
+ rule: self.split('/', 2)[0] != 'openshift.io'
+ - message: the subdomains '*.openshift.io'
+ are reserved for OpenShift use
+ rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
+ - message: the path of the key must not be
+ empty and must consist of at least one
+ alphanumeric character, percent-encoded
+ octets, apostrophe, '-', '.', '_', '~',
+ '!', '$', '&', '(', ')', '*', '+', ',',
+ ';', '=', and ':'
+ rule: self.split('/', 2)[1].matches('[A-Za-z0-9/\\-._~%!$&\'()*+;=:]+')
+ - message: the path of the key must not exceed
+ 256 characters in length
+ rule: self.split('/', 2)[1].size() <= 256
+ valueExpression:
+ description: |-
+ valueExpression is a required field to specify the CEL expression to extract
+ the extra attribute value from a JWT token's claims.
+ valueExpression must produce a string or string array value.
+ "", [], and null are treated as the extra mapping not being present.
+ Empty string values within an array are filtered out.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ valueExpression must not exceed 4096 characters in length.
+ valueExpression must not be empty.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ required:
+ - key
+ - valueExpression
+ type: object
+ maxItems: 64
+ type: array
+ x-kubernetes-list-map-keys:
+ - key
+ x-kubernetes-list-type: map
+ groups:
+ description: |-
+ groups is an optional field that configures how the groups of a cluster identity
+ should be constructed from the claims in a JWT token issued
+ by the identity provider.
+ When referencing a claim, if the claim is present in the JWT
+ token, its value must be a list of groups separated by a comma (',').
+ For example - '"example"' and '"exampleOne", "exampleTwo", "exampleThree"' are valid claim values.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix is an optional field that configures the prefix that will be
+ applied to the cluster identity attribute during the process of mapping
+ JWT claims to cluster identity attributes.
+
+ When omitted (""), no prefix is applied to the cluster identity attribute.
+
+ Example: if `prefix` is set to "myoidc:" and the `claim` in JWT contains
+ an array of strings "a", "b" and "c", the mapping will result in an
+ array of string "myoidc:a", "myoidc:b" and "myoidc:c".
+ type: string
+ required:
+ - claim
+ type: object
+ uid:
+ description: |-
+ uid is an optional field for configuring the claim mapping
+ used to construct the uid for the cluster identity.
+
+ When using uid.claim to specify the claim it must be a single string value.
+ When using uid.expression the expression must result in a single string value.
+
+ When omitted, this means the user has no opinion and the platform
+ is left to choose a default, which is subject to change over time.
+ The current default is to use the 'sub' claim.
+ properties:
+ claim:
+ description: |-
+ claim is an optional field for specifying the
+ JWT token claim that is used in the mapping.
+ The value of this claim will be assigned to
+ the field in which this mapping is associated.
+
+ Precisely one of claim or expression must be set.
+ claim must not be specified when expression is set.
+ When specified, claim must be at least 1 character in length
+ and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ expression:
+ description: |-
+ expression is an optional field for specifying a
+ CEL expression that produces a string value from
+ JWT token claims.
+
+ CEL expressions have access to the token claims
+ through a CEL variable, 'claims'.
+ 'claims' is a map of claim names to claim values.
+ For example, the 'sub' claim value can be accessed as 'claims.sub'.
+ Nested claims can be accessed using dot notation ('claims.foo.bar').
+
+ Precisely one of claim or expression must be set.
+ expression must not be specified when claim is set.
+ When specified, expression must be at least 1 character in length
+ and must not exceed 4096 characters in length.
+ maxLength: 4096
+ minLength: 1
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: precisely one of claim or expression
+ must be set
+ rule: 'has(self.claim) ? !has(self.expression)
+ : has(self.expression)'
+ username:
+ description: |-
+ username is an optional field that configures how the username of a cluster identity
+ should be constructed from the claims in a JWT token issued by the identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the JWT token
+ claim whose value is assigned to the cluster identity
+ field associated with this mapping.
+ type: string
+ prefix:
+ description: |-
+ prefix configures the prefix that should be prepended to the value
+ of the JWT claim.
+
+ prefix must be set when prefixPolicy is set to 'Prefix' and must be unset otherwise.
+ properties:
+ prefixString:
+ description: |-
+ prefixString is a required field that configures the prefix that will
+ be applied to cluster identity username attribute
+ during the process of mapping JWT claims to cluster identity attributes.
+
+ prefixString must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - prefixString
+ type: object
+ prefixPolicy:
+ description: |-
+ prefixPolicy is an optional field that configures how a prefix should be
+ applied to the value of the JWT claim specified in the 'claim' field.
+
+ Allowed values are 'Prefix', 'NoPrefix', and omitted (not provided or an empty string).
+
+ When set to 'Prefix', the value specified in the prefix field will be
+ prepended to the value of the JWT claim.
+ The prefix field must be set when prefixPolicy is 'Prefix'.
+
+ When set to 'NoPrefix', no prefix will be prepended to the value
+ of the JWT claim.
+
+ When omitted, this means no opinion and the platform is left to choose
+ any prefixes that are applied which is subject to change over time.
+ Currently, the platform prepends `{issuerURL}#` to the value of the JWT claim
+ when the claim is not 'email'.
+ As an example, consider the following scenario:
+ `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
+ the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
+ and `claim` is set to:
+ - "username": the mapped value will be "https://myoidc.tld#userA"
+ - "email": the mapped value will be "userA@myoidc.tld"
+ enum:
+ - ""
+ - NoPrefix
+ - Prefix
+ type: string
+ required:
+ - claim
+ type: object
+ x-kubernetes-validations:
+ - message: prefix must be set if prefixPolicy is
+ 'Prefix', but must remain unset otherwise
+ rule: 'has(self.prefixPolicy) && self.prefixPolicy
+ == ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
+ > 0) : !has(self.prefix)'
+ type: object
+ claimValidationRules:
+ description: |-
+ claimValidationRules is an optional field that configures the rules to
+ be used by the Kubernetes API server for validating the claims in a JWT
+ token issued by the identity provider.
+
+ Validation rules are joined via an AND operation.
+ items:
+ properties:
+ requiredClaim:
+ description: |-
+ requiredClaim is an optional field that configures the required claim
+ and value that the Kubernetes API server will use to validate if an incoming
+ JWT is valid for this identity provider.
+ properties:
+ claim:
+ description: |-
+ claim is a required field that configures the name of the required claim.
+ When taken from the JWT claims, claim must be a string value.
+
+ claim must not be an empty string ("").
+ minLength: 1
+ type: string
+ requiredValue:
+ description: |-
+ requiredValue is a required field that configures the value that 'claim' must
+ have when taken from the incoming JWT claims.
+ If the value in the JWT claims does not match, the token
+ will be rejected for authentication.
+
+ requiredValue must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - claim
+ - requiredValue
+ type: object
+ type:
+ default: RequiredClaim
+ description: |-
+ type is an optional field that configures the type of the validation rule.
+
+ Allowed values are 'RequiredClaim' and omitted (not provided or an empty string).
+
+ When set to 'RequiredClaim', the Kubernetes API server
+ will be configured to validate that the incoming JWT
+ contains the required claim and that its value matches
+ the required value.
+
+ Defaults to 'RequiredClaim'.
+ enum:
+ - RequiredClaim
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ issuer:
+ description: |-
+ issuer is a required field that configures how the platform interacts
+ with the identity provider and how tokens issued from the identity provider
+ are evaluated by the Kubernetes API server.
+ properties:
+ audiences:
+ description: |-
+ audiences is a required field that configures the acceptable audiences
+ the JWT token, issued by the identity provider, must be issued to.
+ At least one of the entries must match the 'aud' claim in the JWT token.
+
+ audiences must contain at least one entry and must not exceed ten entries.
+ items:
+ minLength: 1
+ type: string
+ maxItems: 10
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ issuerCertificateAuthority:
+ description: |-
+ issuerCertificateAuthority is an optional field that configures the
+ certificate authority, used by the Kubernetes API server, to validate
+ the connection to the identity provider when fetching discovery information.
+
+ When not specified, the system trust is used.
+
+ When specified, it must reference a ConfigMap in the openshift-config
+ namespace containing the PEM-encoded CA certificates under the 'ca-bundle.crt'
+ key in the data field of the ConfigMap.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ issuerURL:
+ description: |-
+ issuerURL is a required field that configures the URL used to issue tokens
+ by the identity provider.
+ The Kubernetes API server determines how authentication tokens should be handled
+ by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ required:
+ - audiences
+ - issuerURL
+ type: object
+ name:
+ description: |-
+ name is a required field that configures the unique human-readable identifier
+ associated with the identity provider.
+ It is used to distinguish between multiple identity providers
+ and has no impact on token validation or authentication mechanics.
+
+ name must not be an empty string ("").
+ minLength: 1
+ type: string
+ oidcClients:
+ description: |-
+ oidcClients is an optional field that configures how on-cluster,
+ platform clients should request tokens from the identity provider.
+ oidcClients must not exceed 20 entries and entries must have unique namespace/name pairs.
+ items:
+ description: |-
+ OIDCClientConfig configures how platform clients
+ interact with identity providers as an authentication
+ method
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that configures the client identifier, from
+ the identity provider, that the platform component uses for authentication
+ requests made to the identity provider.
+ The identity provider must accept this identifier for platform components
+ to be able to use the identity provider as an authentication mode.
+
+ clientID must not be an empty string ("").
+ minLength: 1
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is an optional field that configures the client secret used
+ by the platform component when making authentication requests to the identity provider.
+
+ When not specified, no client secret will be used when making authentication requests
+ to the identity provider.
+
+ When specified, clientSecret references a Secret in the 'openshift-config'
+ namespace that contains the client secret in the 'clientSecret' key of the '.data' field.
+ The client secret will be used when making authentication requests to the identity provider.
+
+ Public clients do not require a client secret but private
+ clients do require a client secret to work with the identity provider.
+ properties:
+ name:
+ description: name is the metadata.name of
+ the referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component being configured to use the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component being configured to use the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ extraScopes:
+ description: |-
+ extraScopes is an optional field that configures the extra scopes that should
+ be requested by the platform component when making authentication requests to the
+ identity provider.
+ This is useful if you have configured claim mappings that requires specific
+ scopes to be requested beyond the standard OIDC scopes.
+
+ When omitted, no additional scopes are requested.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - clientID
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ required:
+ - issuer
+ - name
+ type: object
+ maxItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ serviceAccountIssuer:
+ description: |-
+ serviceAccountIssuer is the identifier of the bound service account token
+ issuer.
+ The default is https://kubernetes.default.svc
+ WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
+ previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
+ be trusted for a time period chosen by the platform (currently set to 24h).
+ This time period is subject to change over time.
+ This allows internal components to transition to use new service account issuer without service distruption.
+ type: string
+ type:
+ description: |-
+ type identifies the cluster managed, user facing authentication mode in use.
+ Specifically, it manages the component that responds to login attempts.
+ The default is IntegratedOAuth.
+ enum:
+ - ""
+ - None
+ - IntegratedOAuth
+ - OIDC
+ type: string
+ webhookTokenAuthenticator:
+ description: |-
+ webhookTokenAuthenticator configures a remote token reviewer.
+ These remote authentication webhooks can be used to verify bearer tokens
+ via the tokenreviews.authentication.k8s.io REST API. This is required to
+ honor bearer tokens that are provisioned by an external authentication service.
+
+ Can only be set if "Type" is set to "None".
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig references a secret that contains kube config file data which
+ describes how to access the remote webhook service.
+ The namespace for the referenced secret is openshift-config.
+
+ For further details, see:
+
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - kubeConfig
+ type: object
+ webhookTokenAuthenticators:
+ description: webhookTokenAuthenticators is DEPRECATED, setting
+ it has no effect.
+ items:
+ description: |-
+ deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
+ It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
+ properties:
+ kubeConfig:
+ description: |-
+ kubeConfig contains kube config file data which describes how to access the remote webhook service.
+ For further details, see:
+ https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
+ The key "kubeConfig" is used to locate the data.
+ If the secret or expected key is not found, the webhook is not honored.
+ If the specified kube config data is not valid, the webhook is not honored.
+ The namespace for this secret is determined by the point of use.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ featureGate:
+ description: featureGate holds cluster-wide information about
+ feature gates.
+ properties:
+ customNoUpgrade:
+ description: |-
+ customNoUpgrade allows the enabling or disabling of any feature. Turning this feature set on IS NOT SUPPORTED, CANNOT BE UNDONE, and PREVENTS UPGRADES.
+ Because of its nature, this setting cannot be validated. If you have any typos or accidentally apply invalid combinations
+ your cluster may fail in an unrecoverable way. featureSet must equal "CustomNoUpgrade" must be set to use this field.
+ nullable: true
+ properties:
+ disabled:
+ description: disabled is a list of all feature gates that
+ you want to force off
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ enabled:
+ description: enabled is a list of all feature gates that
+ you want to force on
+ items:
+ description: FeatureGateName is a string to enforce
+ patterns on the name of a FeatureGate
+ pattern: ^([A-Za-z0-9-]+\.)*[A-Za-z0-9-]+\.?$
+ type: string
+ type: array
+ type: object
+ featureSet:
+ description: |-
+ featureSet changes the list of features in the cluster. The default is empty. Be very careful adjusting this setting.
+ Turning on or off features may cause irreversible changes in your cluster which cannot be undone.
+ enum:
+ - CustomNoUpgrade
+ - DevPreviewNoUpgrade
+ - TechPreviewNoUpgrade
+ - ""
+ type: string
+ x-kubernetes-validations:
+ - message: CustomNoUpgrade may not be changed
+ rule: 'oldSelf == ''CustomNoUpgrade'' ? self == ''CustomNoUpgrade''
+ : true'
+ - message: TechPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''TechPreviewNoUpgrade'' ? self == ''TechPreviewNoUpgrade''
+ : true'
+ - message: DevPreviewNoUpgrade may not be changed
+ rule: 'oldSelf == ''DevPreviewNoUpgrade'' ? self == ''DevPreviewNoUpgrade''
+ : true'
+ type: object
+ image:
+ description: |-
+ image governs policies related to imagestream imports and runtime configuration
+ for external registries. It allows cluster admins to configure which registries
+ OpenShift is allowed to import images from, extra CA trust bundles for external
+ registries, and policies to block or allow registry hostnames.
+ When exposing OpenShift's image registry to the public, this also lets cluster
+ admins specify the external hostname.
+ This input will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ additionalTrustedCA:
+ description: |-
+ additionalTrustedCA is a reference to a ConfigMap containing additional CAs that
+ should be trusted during imagestream import, pod image pull, build image pull, and
+ imageregistry pullthrough.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ allowedRegistriesForImport:
+ description: |-
+ allowedRegistriesForImport limits the container image registries that normal users may import
+ images from. Set this list to the registries that you trust to contain valid Docker
+ images and that you want applications to be able to import from. Users with
+ permission to create Images or ImageStreamMappings via the API are not affected by
+ this policy - typically only administrators or system integrations will have those
+ permissions.
+ items:
+ description: |-
+ RegistryLocation contains a location of the registry specified by the registry domain
+ name. The domain name might include wildcards, like '*' or '??'.
+ properties:
+ domainName:
+ description: |-
+ domainName specifies a domain name for the registry
+ In case the registry use non-standard (80 or 443) port, the port should be included
+ in the domain name as well.
+ type: string
+ insecure:
+ description: |-
+ insecure indicates whether the registry is secure (https) or insecure (http)
+ By default (if not specified) the registry is assumed as secure.
+ type: boolean
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalRegistryHostnames:
+ description: |-
+ externalRegistryHostnames provides the hostnames for the default external image
+ registry. The external hostname should be set only when the image registry
+ is exposed externally. The first value is used in 'publicDockerImageRepository'
+ field in ImageStreams. The value must be in "hostname[:port]" format.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ registrySources:
+ description: |-
+ registrySources contains configuration that determines how the container runtime
+ should treat individual registries when accessing images for builds+pods. (e.g.
+ whether or not to allow insecure access). It does not contain configuration for the
+ internal cluster registry.
+ properties:
+ allowedRegistries:
+ description: |-
+ allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ blockedRegistries:
+ description: |-
+ blockedRegistries cannot be used for image pull and push actions. All other registries are permitted.
+
+ Only one of BlockedRegistries or AllowedRegistries may be set.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ containerRuntimeSearchRegistries:
+ description: |-
+ containerRuntimeSearchRegistries are registries that will be searched when pulling images that do not have fully qualified
+ domains in their pull specs. Registries will be searched in the order provided in the list.
+ Note: this search list only works with the container runtime, i.e CRI-O. Will NOT work with builds or imagestream imports.
+ format: hostname
+ items:
+ type: string
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ insecureRegistries:
+ description: insecureRegistries are registries which do
+ not have a valid TLS certificates or only support HTTP
+ connections.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-validations:
+ - message: Only one of blockedRegistries or allowedRegistries
+ may be set
+ rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
+ : true'
+ type: object
+ ingress:
+ description: |-
+ ingress holds cluster-wide information about ingress, including the default ingress domain
+ used for routes.
+ properties:
+ appsDomain:
+ description: |-
+ appsDomain is an optional domain to use instead of the one specified
+ in the domain field when a Route is created without specifying an explicit
+ host. If appsDomain is nonempty, this value is used to generate default
+ host values for Route. Unlike domain, appsDomain may be modified after
+ installation.
+ This assumes a new ingresscontroller has been setup with a wildcard
+ certificate.
+ type: string
+ componentRoutes:
+ description: |-
+ componentRoutes is an optional list of routes that are managed by OpenShift components
+ that a cluster-admin is able to configure the hostname and serving certificate for.
+ The namespace and name of each route in this list should match an existing entry in the
+ status.componentRoutes list.
+
+ To determine the set of configurable Routes, look at namespace and name of entries in the
+ .status.componentRoutes list, where participating operators write the status of
+ configurable routes.
+ items:
+ description: ComponentRouteSpec allows for configuration
+ of a route's hostname and serving certificate.
+ properties:
+ hostname:
+ description: hostname is the hostname that should be
+ used by the route.
+ pattern: ^([a-zA-Z0-9\p{S}\p{L}]((-?[a-zA-Z0-9\p{S}\p{L}]{0,62})?)|([a-zA-Z0-9\p{S}\p{L}](([a-zA-Z0-9-\p{S}\p{L}]{0,61}[a-zA-Z0-9\p{S}\p{L}])?)(\.)){1,}([a-zA-Z\p{L}]){2,63})$|^(([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})[\.]){0,}([a-z0-9][-a-z0-9]{0,61}[a-z0-9]|[a-z0-9]{1,63})$
+ type: string
+ name:
+ description: |-
+ name is the logical name of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 256
+ minLength: 1
+ type: string
+ namespace:
+ description: |-
+ namespace is the namespace of the route to customize.
+
+ The namespace and name of this componentRoute must match a corresponding
+ entry in the list of status.componentRoutes if the route is to be customized.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ servingCertKeyPairSecret:
+ description: |-
+ servingCertKeyPairSecret is a reference to a secret of type `kubernetes.io/tls` in the openshift-config namespace.
+ The serving cert/key pair must match and will be used by the operator to fulfill the intent of serving with this name.
+ If the custom hostname uses the default routing suffix of the cluster,
+ the Secret specification for a serving certificate will not be needed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - hostname
+ - name
+ - namespace
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - namespace
+ - name
+ x-kubernetes-list-type: map
+ domain:
+ description: |-
+ domain is used to generate a default host name for a route when the
+ route's host name is empty. The generated host name will follow this
+ pattern: "..".
+
+ It is also used as the default wildcard domain suffix for ingress. The
+ default ingresscontroller domain will follow this pattern: "*.".
+
+ Once set, changing domain is not currently supported.
+ type: string
+ loadBalancer:
+ description: |-
+ loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
+ provider of the current cluster and are required for Ingress Controller to work on OpenShift.
+ properties:
+ platform:
+ description: |-
+ platform holds configuration specific to the underlying
+ infrastructure provider for the ingress load balancers.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ properties:
+ aws:
+ description: aws contains settings specific to the
+ Amazon Web Services infrastructure provider.
+ properties:
+ type:
+ description: |-
+ type allows user to set a load balancer type.
+ When this field is set the default ingresscontroller will get created using the specified LBType.
+ If this field is not set then the default ingress controller of LBType Classic will be created.
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - NLB
+ - Classic
+ type: string
+ required:
+ - type
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the cluster.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt",
+ "OpenStack", "VSphere", "oVirt", "KubeVirt", "EquinixMetal", "PowerVS",
+ "AlibabaCloud", "Nutanix" and "None". Individual components may not support all platforms,
+ and must handle unrecognized platforms as None if they do not support that platform.
+ enum:
+ - ""
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Libvirt
+ - OpenStack
+ - None
+ - VSphere
+ - oVirt
+ - IBMCloud
+ - KubeVirt
+ - EquinixMetal
+ - PowerVS
+ - AlibabaCloud
+ - Nutanix
+ - External
+ type: string
+ type: object
+ type: object
+ requiredHSTSPolicies:
+ description: |-
+ requiredHSTSPolicies specifies HSTS policies that are required to be set on newly created or updated routes
+ matching the domainPattern/s and namespaceSelector/s that are specified in the policy.
+ Each requiredHSTSPolicy must have at least a domainPattern and a maxAge to validate a route HSTS Policy route
+ annotation, and affect route admission.
+
+ A candidate route is checked for HSTS Policies if it has the HSTS Policy route annotation:
+ "haproxy.router.openshift.io/hsts_header"
+ E.g. haproxy.router.openshift.io/hsts_header: max-age=31536000;preload;includeSubDomains
+
+ - For each candidate route, if it matches a requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then the maxAge, preloadPolicy, and includeSubdomainsPolicy must be valid to be admitted. Otherwise, the route
+ is rejected.
+ - The first match, by domainPattern and optional namespaceSelector, in the ordering of the RequiredHSTSPolicies
+ determines the route's admission status.
+ - If the candidate route doesn't match any requiredHSTSPolicy domainPattern and optional namespaceSelector,
+ then it may use any HSTS Policy annotation.
+
+ The HSTS policy configuration may be changed after routes have already been created. An update to a previously
+ admitted route may then fail if the updated route does not conform to the updated HSTS policy configuration.
+ However, changing the HSTS policy configuration will not cause a route that is already admitted to stop working.
+
+ Note that if there are no RequiredHSTSPolicies, any HSTS Policy annotation on the route is valid.
+ items:
+ properties:
+ domainPatterns:
+ description: |-
+ domainPatterns is a list of domains for which the desired HSTS annotations are required.
+ If domainPatterns is specified and a route is created with a spec.host matching one of the domains,
+ the route must specify the HSTS Policy components described in the matching RequiredHSTSPolicy.
+
+ The use of wildcards is allowed like this: *.foo.com matches everything under foo.com.
+ foo.com only matches foo.com, so to cover foo.com and everything under it, you must specify *both*.
+ items:
+ type: string
+ minItems: 1
+ type: array
+ includeSubDomainsPolicy:
+ description: |-
+ includeSubDomainsPolicy means the HSTS Policy should apply to any subdomains of the host's
+ domain name. Thus, for the host bar.foo.com, if includeSubDomainsPolicy was set to RequireIncludeSubDomains:
+ - the host app.bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host bar.foo.com would inherit the HSTS Policy of bar.foo.com
+ - the host foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ - the host def.foo.com would NOT inherit the HSTS Policy of bar.foo.com
+ enum:
+ - RequireIncludeSubDomains
+ - RequireNoIncludeSubDomains
+ - NoOpinion
+ type: string
+ maxAge:
+ description: |-
+ maxAge is the delta time range in seconds during which hosts are regarded as HSTS hosts.
+ If set to 0, it negates the effect, and hosts are removed as HSTS hosts.
+ If set to 0 and includeSubdomains is specified, all subdomains of the host are also removed as HSTS hosts.
+ maxAge is a time-to-live value, and if this policy is not refreshed on a client, the HSTS
+ policy will eventually expire on that client.
+ properties:
+ largestMaxAge:
+ description: |-
+ The largest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ This value can be left unspecified, in which case no upper limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ smallestMaxAge:
+ description: |-
+ The smallest allowed value (in seconds) of the RequiredHSTSPolicy max-age
+ Setting max-age=0 allows the deletion of an existing HSTS header from a host. This is a necessary
+ tool for administrators to quickly correct mistakes.
+ This value can be left unspecified, in which case no lower limit is enforced.
+ format: int32
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ type: object
+ namespaceSelector:
+ description: |-
+ namespaceSelector specifies a label selector such that the policy applies only to those routes that
+ are in namespaces with labels that match the selector, and are in one of the DomainPatterns.
+ Defaults to the empty LabelSelector, which matches everything.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label
+ selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the
+ selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ preloadPolicy:
+ description: |-
+ preloadPolicy directs the client to include hosts in its host preload list so that
+ it never needs to do an initial load to get the HSTS header (note that this is not defined
+ in RFC 6797 and is therefore client implementation-dependent).
+ enum:
+ - RequirePreload
+ - RequireNoPreload
+ - NoOpinion
+ type: string
+ required:
+ - domainPatterns
+ type: object
+ type: array
+ type: object
+ network:
+ description: |-
+ network holds cluster-wide information about the network. It is used to configure the desired network configuration, such as: IP address pools for services/pod IPs, network plugin, etc.
+ Please view network.spec for an explanation on what applies when configuring this resource.
+ properties:
+ clusterNetwork:
+ description: |-
+ IP address pool to use for pod IPs.
+ This field is immutable after installation.
+ items:
+ description: |-
+ ClusterNetworkEntry is a contiguous block of IP addresses from which pod IPs
+ are allocated.
+ properties:
+ cidr:
+ description: The complete block for pod IPs.
+ type: string
+ hostPrefix:
+ description: |-
+ The size (prefix) of block to allocate to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ externalIP:
+ description: |-
+ externalIP defines configuration for controllers that
+ affect Service.ExternalIP. If nil, then ExternalIP is
+ not allowed to be set.
+ properties:
+ autoAssignCIDRs:
+ description: |-
+ autoAssignCIDRs is a list of CIDRs from which to automatically assign
+ Service.ExternalIP. These are assigned when the service is of type
+ LoadBalancer. In general, this is only useful for bare-metal clusters.
+ In Openshift 3.x, this was misleadingly called "IngressIPs".
+ Automatically assigned External IPs are not affected by any
+ ExternalIPPolicy rules.
+ Currently, only one entry may be provided.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ policy:
+ description: |-
+ policy is a set of restrictions applied to the ExternalIP field.
+ If nil or empty, then ExternalIP is not allowed to be set.
+ properties:
+ allowedCIDRs:
+ description: allowedCIDRs is the list of allowed CIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ rejectedCIDRs:
+ description: |-
+ rejectedCIDRs is the list of disallowed CIDRs. These take precedence
+ over allowedCIDRs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkDiagnostics:
+ description: |-
+ networkDiagnostics defines network diagnostics configuration.
+
+ Takes precedence over spec.disableNetworkDiagnostics in network.operator.openshift.io.
+ If networkDiagnostics is not specified or is empty,
+ and the spec.disableNetworkDiagnostics flag in network.operator.openshift.io is set to true,
+ the network diagnostics feature will be disabled.
+ properties:
+ mode:
+ description: |-
+ mode controls the network diagnostics mode
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is All.
+ enum:
+ - ""
+ - All
+ - Disabled
+ type: string
+ sourcePlacement:
+ description: |-
+ sourcePlacement controls the scheduling of network diagnostics source deployment
+
+ See NetworkDiagnosticsSourcePlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is an empty list.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ targetPlacement:
+ description: |-
+ targetPlacement controls the scheduling of network diagnostics target daemonset
+
+ See NetworkDiagnosticsTargetPlacement for more details about default values.
+ properties:
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is the node selector applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `kubernetes.io/os: linux`.
+ type: object
+ tolerations:
+ description: |-
+ tolerations is a list of tolerations applied to network diagnostics components
+
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is `- operator: "Exists"` which means that all taints are tolerated.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ type: object
+ networkType:
+ description: |-
+ networkType is the plugin that is to be deployed (e.g. OVNKubernetes).
+ This should match a value that the cluster-network-operator understands,
+ or else no networking will be installed.
+ Currently supported values are:
+ - OVNKubernetes
+ This field is immutable after installation.
+ type: string
+ serviceNetwork:
+ description: |-
+ IP address pool for services.
+ Currently, we only support a single entry here.
+ This field is immutable after installation.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ serviceNodePortRange:
+ description: |-
+ The port range allowed for Services of type NodePort.
+ If not specified, the default of 30000-32767 will be used.
+ Such Services without a NodePort specified will have one
+ automatically allocated from this range.
+ This parameter can be updated after the cluster is
+ installed.
+ pattern: ^([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])-([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: cannot set networkDiagnostics.sourcePlacement and networkDiagnostics.targetPlacement
+ when networkDiagnostics.mode is Disabled
+ rule: '!has(self.networkDiagnostics) || !has(self.networkDiagnostics.mode)
+ || self.networkDiagnostics.mode!=''Disabled'' || !has(self.networkDiagnostics.sourcePlacement)
+ && !has(self.networkDiagnostics.targetPlacement)'
+ oauth:
+ description: |-
+ oauth holds cluster-wide information about OAuth.
+ It is used to configure the integrated OAuth server.
+ This configuration is only honored when the top level Authentication config has type set to IntegratedOAuth.
+ properties:
+ identityProviders:
+ description: |-
+ identityProviders is an ordered list of ways for a user to identify themselves.
+ When this list is empty, no identities are provisioned for users.
+ items:
+ description: IdentityProvider provides identities for users
+ authenticating using credentials
+ properties:
+ basicAuth:
+ description: basicAuth contains configuration options
+ for the BasicAuth IdP
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ github:
+ description: github enables user authentication using
+ GitHub credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ This can only be configured when hostname is set to a non-empty value.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostname:
+ description: |-
+ hostname is the optional domain (e.g. "mycompany.com") for use with a hosted instance of
+ GitHub Enterprise.
+ It must match the GitHub Enterprise settings value configured at /setup/settings#hostname.
+ type: string
+ organizations:
+ description: organizations optionally restricts
+ which organizations are allowed to log in
+ items:
+ type: string
+ type: array
+ teams:
+ description: teams optionally restricts which teams
+ are allowed to log in. Format is /.
+ items:
+ type: string
+ type: array
+ type: object
+ gitlab:
+ description: gitlab enables user authentication using
+ GitLab credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the oauth server base URL
+ type: string
+ type: object
+ google:
+ description: google enables user authentication using
+ Google credentials
+ properties:
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ hostedDomain:
+ description: hostedDomain is the optional Google
+ App domain (e.g. "mycompany.com") to restrict
+ logins to
+ type: string
+ type: object
+ htpasswd:
+ description: htpasswd enables user authentication using
+ an HTPasswd file to validate credentials
+ properties:
+ fileData:
+ description: |-
+ fileData is a required reference to a secret by name containing the data to use as the htpasswd file.
+ The key "htpasswd" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ If the specified htpasswd data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ keystone:
+ description: keystone enables user authentication using
+ keystone password credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ domainName:
+ description: domainName is required for keystone
+ v3
+ type: string
+ tlsClientCert:
+ description: |-
+ tlsClientCert is an optional reference to a secret by name that contains the
+ PEM-encoded TLS client certificate to present when connecting to the server.
+ The key "tls.crt" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ tlsClientKey:
+ description: |-
+ tlsClientKey is an optional reference to a secret by name that contains the
+ PEM-encoded TLS private key for the client certificate referenced in tlsClientCert.
+ The key "tls.key" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ If the specified certificate data is not valid, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: url is the remote URL to connect to
+ type: string
+ type: object
+ ldap:
+ description: ldap enables user authentication using
+ LDAP credentials
+ properties:
+ attributes:
+ description: attributes maps LDAP attributes to
+ identities
+ properties:
+ email:
+ description: |-
+ email is the list of attributes whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ id:
+ description: |-
+ id is the list of attributes whose values should be used as the user ID. Required.
+ First non-empty attribute is used. At least one attribute is required. If none of the listed
+ attribute have a value, authentication fails.
+ LDAP standard identity attribute is "dn"
+ items:
+ type: string
+ type: array
+ name:
+ description: |-
+ name is the list of attributes whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ LDAP standard display name attribute is "cn"
+ items:
+ type: string
+ type: array
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of attributes whose values should be used as the preferred username.
+ LDAP standard login attribute is "uid"
+ items:
+ type: string
+ type: array
+ type: object
+ bindDN:
+ description: bindDN is an optional DN to bind with
+ during the search phase.
+ type: string
+ bindPassword:
+ description: |-
+ bindPassword is an optional reference to a secret by name
+ containing a password to bind with during the search phase.
+ The key "bindPassword" is used to locate the data.
+ If specified and the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ insecure:
+ description: |-
+ insecure, if true, indicates the connection should not use TLS
+ WARNING: Should not be set to `true` with the URL scheme "ldaps://" as "ldaps://" URLs always
+ attempt to connect using TLS, even when `insecure` is set to `true`
+ When `true`, "ldap://" URLS connect insecurely. When `false`, "ldap://" URLs are upgraded to
+ a TLS connection using StartTLS as specified in https://tools.ietf.org/html/rfc2830.
+ type: boolean
+ url:
+ description: |-
+ url is an RFC 2255 URL which specifies the LDAP search parameters to use.
+ The syntax of the URL is:
+ ldap://host:port/basedn?attribute?scope?filter
+ type: string
+ type: object
+ mappingMethod:
+ description: |-
+ mappingMethod determines how identities from this provider are mapped to users
+ Defaults to "claim"
+ type: string
+ name:
+ description: |-
+ name is used to qualify the identities returned by this provider.
+ - It MUST be unique and not shared by any other identity provider used
+ - It MUST be a valid path segment: name cannot equal "." or ".." or contain "/" or "%" or ":"
+ Ref: https://godoc.org/github.com/openshift/origin/pkg/user/apis/user/validation#ValidateIdentityProviderName
+ type: string
+ openID:
+ description: openID enables user authentication using
+ OpenID credentials
+ properties:
+ ca:
+ description: |-
+ ca is an optional reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ The key "ca.crt" is used to locate the data.
+ If specified and the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ If empty, the default system roots are used.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ claims:
+ description: claims mappings
+ properties:
+ email:
+ description: |-
+ email is the list of claims whose values should be used as the email address. Optional.
+ If unspecified, no email is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ groups:
+ description: |-
+ groups is the list of claims value of which should be used to synchronize groups
+ from the OIDC provider to OpenShift for the user.
+ If multiple claims are specified, the first one with a non-empty value is used.
+ items:
+ description: |-
+ OpenIDClaim represents a claim retrieved from an OpenID provider's tokens or userInfo
+ responses
+ minLength: 1
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: |-
+ name is the list of claims whose values should be used as the display name. Optional.
+ If unspecified, no display name is set for the identity
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ preferredUsername:
+ description: |-
+ preferredUsername is the list of claims whose values should be used as the preferred username.
+ If unspecified, the preferred username is determined from the value of the sub claim
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ clientID:
+ description: clientID is the oauth client ID
+ type: string
+ clientSecret:
+ description: |-
+ clientSecret is a required reference to the secret by name containing the oauth client secret.
+ The key "clientSecret" is used to locate the data.
+ If the secret or expected key is not found, the identity provider is not honored.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced secret
+ type: string
+ required:
+ - name
+ type: object
+ extraAuthorizeParameters:
+ additionalProperties:
+ type: string
+ description: extraAuthorizeParameters are any custom
+ parameters to add to the authorize request.
+ type: object
+ extraScopes:
+ description: extraScopes are any scopes to request
+ in addition to the standard "openid" scope.
+ items:
+ type: string
+ type: array
+ issuer:
+ description: |-
+ issuer is the URL that the OpenID Provider asserts as its Issuer Identifier.
+ It must use the https scheme with no query or fragment component.
+ type: string
+ type: object
+ requestHeader:
+ description: requestHeader enables user authentication
+ using request header credentials
+ properties:
+ ca:
+ description: |-
+ ca is a required reference to a config map by name containing the PEM-encoded CA bundle.
+ It is used as a trust anchor to validate the TLS certificate presented by the remote server.
+ Specifically, it allows verification of incoming requests to prevent header spoofing.
+ The key "ca.crt" is used to locate the data.
+ If the config map or expected key is not found, the identity provider is not honored.
+ If the specified ca data is not valid, the identity provider is not honored.
+ The namespace for this config map is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the
+ referenced config map
+ type: string
+ required:
+ - name
+ type: object
+ challengeURL:
+ description: |-
+ challengeURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect WWW-Authenticate challenges will be
+ redirected here.
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when challenge is set to true.
+ type: string
+ clientCommonNames:
+ description: |-
+ clientCommonNames is an optional list of common names to require a match from. If empty, any
+ client certificate validated against the clientCA bundle is considered authoritative.
+ items:
+ type: string
+ type: array
+ emailHeaders:
+ description: emailHeaders is the set of headers
+ to check for the email address
+ items:
+ type: string
+ type: array
+ headers:
+ description: headers is the set of headers to check
+ for identity information
+ items:
+ type: string
+ type: array
+ loginURL:
+ description: |-
+ loginURL is a URL to redirect unauthenticated /authorize requests to
+ Unauthenticated requests from OAuth clients which expect interactive logins will be redirected here
+ ${url} is replaced with the current URL, escaped to be safe in a query parameter
+ https://www.example.com/sso-login?then=${url}
+ ${query} is replaced with the current query string
+ https://www.example.com/auth-proxy/oauth/authorize?${query}
+ Required when login is set to true.
+ type: string
+ nameHeaders:
+ description: nameHeaders is the set of headers to
+ check for the display name
+ items:
+ type: string
+ type: array
+ preferredUsernameHeaders:
+ description: preferredUsernameHeaders is the set
+ of headers to check for the preferred username
+ items:
+ type: string
+ type: array
+ type: object
+ type:
+ description: type identifies the identity provider type
+ for this entry.
+ type: string
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ templates:
+ description: templates allow you to customize pages like the
+ login page.
+ properties:
+ error:
+ description: |-
+ error is the name of a secret that specifies a go template to use to render error pages
+ during the authentication or grant flow.
+ The key "errors.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default error page is used.
+ If the specified template is not valid, the default error page is used.
+ If unspecified, the default error page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ login:
+ description: |-
+ login is the name of a secret that specifies a go template to use to render the login page.
+ The key "login.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default login page is used.
+ If the specified template is not valid, the default login page is used.
+ If unspecified, the default login page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ providerSelection:
+ description: |-
+ providerSelection is the name of a secret that specifies a go template to use to render
+ the provider selection page.
+ The key "providers.html" is used to locate the template data.
+ If specified and the secret or expected key is not found, the default provider selection page is used.
+ If the specified template is not valid, the default provider selection page is used.
+ If unspecified, the default provider selection page is used.
+ The namespace for this secret is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ secret
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ tokenConfig:
+ description: tokenConfig contains options for authorization
+ and access tokens
+ properties:
+ accessTokenInactivityTimeout:
+ description: |-
+ accessTokenInactivityTimeout defines the token inactivity timeout
+ for tokens granted by any client.
+ The value represents the maximum amount of time that can occur between
+ consecutive uses of the token. Tokens become invalid if they are not
+ used within this temporal window. The user will need to acquire a new
+ token to regain access once a token times out. Takes valid time
+ duration string such as "5m", "1.5h" or "2h45m". The minimum allowed
+ value for duration is 300s (5 minutes). If the timeout is configured
+ per client, then that value takes precedence. If the timeout value is
+ not specified and the client does not override the value, then tokens
+ are valid until their lifetime.
+
+ WARNING: existing tokens' timeout will not be affected (lowered) by changing this value
+ type: string
+ accessTokenInactivityTimeoutSeconds:
+ description: 'accessTokenInactivityTimeoutSeconds - DEPRECATED:
+ setting this field has no effect.'
+ format: int32
+ type: integer
+ accessTokenMaxAgeSeconds:
+ description: accessTokenMaxAgeSeconds defines the maximum
+ age of access tokens
+ format: int32
+ type: integer
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: spec.configuration.oauth.tokenConfig.accessTokenInactivityTimeout
+ minimum acceptable token timeout value is 300 seconds
+ rule: '!has(self.tokenConfig) || !has(self.tokenConfig.accessTokenInactivityTimeout)
+ || duration(self.tokenConfig.accessTokenInactivityTimeout).getSeconds()
+ >= 300'
+ operatorhub:
+ description: |-
+ operatorhub specifies the configuration for the Operator Lifecycle Manager in the HostedCluster. This is only configured at deployment time but the controller are not reconcilling over it.
+ The OperatorHub configuration will be constantly reconciled if catalog placement is management, but only on cluster creation otherwise.
+ properties:
+ disableAllDefaultSources:
+ description: |-
+ disableAllDefaultSources allows you to disable all the default hub
+ sources. If this is true, a specific entry in sources can be used to
+ enable a default source. If this is false, a specific entry in
+ sources can be used to disable or enable a default source.
+ type: boolean
+ sources:
+ description: |-
+ sources is the list of default hub sources and their configuration.
+ If the list is empty, it implies that the default hub sources are
+ enabled on the cluster unless disableAllDefaultSources is true.
+ If disableAllDefaultSources is true and sources is not empty,
+ the configuration present in sources will take precedence. The list of
+ default hub sources and their current state will always be reflected in
+ the status block.
+ items:
+ description: HubSource is used to specify the hub source
+ and its configuration
+ properties:
+ disabled:
+ description: disabled is used to disable a default hub
+ source on cluster
+ type: boolean
+ name:
+ description: name is the name of one of the default
+ hub sources
+ maxLength: 253
+ minLength: 1
+ type: string
+ type: object
+ type: array
+ type: object
+ proxy:
+ description: |-
+ proxy holds cluster-wide information on how to configure default proxies for the cluster.
+ This affects traffic flowing from the hosted cluster data plane.
+ The controllers will generate a machineConfig with the proxy config for the cluster.
+ This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
+ Changing this value will trigger a rollout for all existing NodePools in the cluster.
+ properties:
+ httpProxy:
+ description: httpProxy is the URL of the proxy for HTTP requests. Empty
+ means unset and will not result in an env var.
+ type: string
+ httpsProxy:
+ description: httpsProxy is the URL of the proxy for HTTPS
+ requests. Empty means unset and will not result in an env
+ var.
+ type: string
+ noProxy:
+ description: |-
+ noProxy is a comma-separated list of hostnames and/or CIDRs and/or IPs for which the proxy should not be used.
+ Empty means unset and will not result in an env var.
+ type: string
+ readinessEndpoints:
+ description: readinessEndpoints is a list of endpoints used
+ to verify readiness of the proxy.
+ items:
+ type: string
+ type: array
+ trustedCA:
+ description: |-
+ trustedCA is a reference to a ConfigMap containing a CA certificate bundle.
+ The trustedCA field should only be consumed by a proxy validator. The
+ validator is responsible for reading the certificate bundle from the required
+ key "ca-bundle.crt", merging it with the system default trust bundle,
+ and writing the merged trust bundle to a ConfigMap named "trusted-ca-bundle"
+ in the "openshift-config-managed" namespace. Clients that expect to make
+ proxy connections must use the trusted-ca-bundle for all HTTPS requests to
+ the proxy, and may use the trusted-ca-bundle for non-proxy HTTPS requests as
+ well.
+
+ The namespace for the ConfigMap referenced by trustedCA is
+ "openshift-config". Here is an example ConfigMap (in yaml):
+
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: user-ca-bundle
+ namespace: openshift-config
+ data:
+ ca-bundle.crt: |
+ -----BEGIN CERTIFICATE-----
+ Custom CA certificate bundle.
+ -----END CERTIFICATE-----
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ scheduler:
+ description: |-
+ scheduler holds cluster-wide config information to run the Kubernetes Scheduler
+ and influence its placement decisions. The canonical name for this config is `cluster`.
+ properties:
+ defaultNodeSelector:
+ description: |-
+ defaultNodeSelector helps set the cluster-wide default node selector to
+ restrict pod placement to specific nodes. This is applied to the pods
+ created in all namespaces and creates an intersection with any existing
+ nodeSelectors already set on a pod, additionally constraining that pod's selector.
+ For example,
+ defaultNodeSelector: "type=user-node,region=east" would set nodeSelector
+ field in pod spec to "type=user-node,region=east" to all pods created
+ in all namespaces. Namespaces having project-wide node selectors won't be
+ impacted even if this field is set. This adds an annotation section to
+ the namespace.
+ For example, if a new namespace is created with
+ node-selector='type=user-node,region=east',
+ the annotation openshift.io/node-selector: type=user-node,region=east
+ gets added to the project. When the openshift.io/node-selector annotation
+ is set on the project the value is used in preference to the value we are setting
+ for defaultNodeSelector field.
+ For instance,
+ openshift.io/node-selector: "type=user-node,region=west" means
+ that the default of "type=user-node,region=east" set in defaultNodeSelector
+ would not be applied.
+ type: string
+ mastersSchedulable:
+ description: |-
+ mastersSchedulable allows masters nodes to be schedulable. When this flag is
+ turned on, all the master nodes in the cluster will be made schedulable,
+ so that workload pods can run on them. The default value for this field is false,
+ meaning none of the master nodes are schedulable.
+ Important Note: Once the workload pods start running on the master nodes,
+ extreme care must be taken to ensure that cluster-critical control plane components
+ are not impacted.
+ Please turn on this field after doing due diligence.
+ type: boolean
+ policy:
+ description: |-
+ DEPRECATED: the scheduler Policy API has been deprecated and will be removed in a future release.
+ policy is a reference to a ConfigMap containing scheduler policy which has
+ user specified predicates and priorities. If this ConfigMap is not available
+ scheduler will default to use DefaultAlgorithmProvider.
+ The namespace for this configmap is openshift-config.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ profile:
+ description: |-
+ profile sets which scheduling profile should be set in order to configure scheduling
+ decisions for new pods.
+
+ Valid values are "LowNodeUtilization", "HighNodeUtilization", "NoScoring"
+ Defaults to "LowNodeUtilization"
+ enum:
+ - ""
+ - LowNodeUtilization
+ - HighNodeUtilization
+ - NoScoring
+ type: string
+ profileCustomizations:
+ description: profileCustomizations contains configuration
+ for modifying the default behavior of existing scheduler
+ profiles.
+ properties:
+ dynamicResourceAllocation:
+ description: |-
+ dynamicResourceAllocation allows to enable or disable dynamic resource allocation within the scheduler.
+ Dynamic resource allocation is an API for requesting and sharing resources between pods and containers inside a pod.
+ Third-party resource drivers are responsible for tracking and allocating resources.
+ Different kinds of resources support arbitrary parameters for defining requirements and initialization.
+ Valid values are Enabled, Disabled and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default,
+ which is subject to change over time.
+ The current default is Disabled.
+ enum:
+ - ""
+ - Enabled
+ - Disabled
+ type: string
+ type: object
+ type: object
+ type: object
+ controlPlaneReleaseImage:
+ description: |-
+ controlPlaneReleaseImage specifies the desired OCP release payload for
+ control plane components running on the management cluster.
+ If not defined, ReleaseImage is used
+ maxLength: 255
+ type: string
+ controllerAvailabilityPolicy:
+ default: HighlyAvailable
+ description: |-
+ controllerAvailabilityPolicy specifies the availability policy applied to
+ critical control plane components. The default value is SingleReplica.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ x-kubernetes-validations:
+ - message: ControllerAvailabilityPolicy is immutable
+ rule: self == oldSelf
+ dns:
+ description: dns is the DNS configuration for the cluster.
+ properties:
+ baseDomain:
+ description: |-
+ baseDomain is the base domain of the hosted cluster.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Once set, this field is immutable.
+ When the value is the empty string "", the controller might default to a value depending on the platform.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomain must be a valid domain name (e.g., example,
+ example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomain is immutable
+ rule: oldSelf == "" || self == oldSelf
+ baseDomainPrefix:
+ description: |-
+ baseDomainPrefix is the base domain prefix for the hosted cluster ingress.
+ It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
+ If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
+ Set baseDomainPrefix to an empty string "", if you don't want a prefix at all (not even hostedCluster.name) to be prepended to baseDomain.
+ This field is immutable.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: baseDomainPrefix must be a valid domain name (e.g.,
+ example, example.com, sub.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ - message: baseDomainPrefix is immutable
+ rule: self == oldSelf
+ privateZoneID:
+ description: |-
+ privateZoneID is the Hosted Zone ID where all the DNS records that are only available internally to the cluster exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: privateZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ publicZoneID:
+ description: |-
+ publicZoneID is the Hosted Zone ID where all the DNS records that are publicly accessible to the internet exist.
+ This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
+ Once set, this value is immutable.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: publicZoneID is immutable
+ rule: oldSelf == "" || self == oldSelf
+ required:
+ - baseDomain
+ type: object
+ etcd:
+ description: |-
+ etcd contains metadata about the etcd cluster the hypershift managed Openshift control plane components
+ use to store data.
+ properties:
+ managed:
+ description: managed specifies the behavior of an etcd cluster
+ managed by HyperShift.
+ properties:
+ storage:
+ description: storage specifies how etcd data is persisted.
+ properties:
+ persistentVolume:
+ description: |-
+ persistentVolume is the configuration for PersistentVolume etcd storage.
+ With this implementation, a PersistentVolume will be allocated for every
+ etcd member (either 1 or 3 depending on the HostedCluster control plane
+ availability configuration).
+ properties:
+ size:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 8Gi
+ description: |-
+ size is the minimum size of the data volume for each etcd member.
+ Default is 8Gi.
+ This field is immutable
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ x-kubernetes-validations:
+ - message: Etcd PV storage size is immutable
+ rule: self == oldSelf
+ storageClassName:
+ description: |-
+ storageClassName is the StorageClass of the data volume for each etcd member.
+ See https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: storageClassName is immutable
+ rule: self == oldSelf
+ type: object
+ restoreSnapshotURL:
+ description: |-
+ restoreSnapshotURL allows an optional URL to be provided where
+ an etcd snapshot can be downloaded, for example a pre-signed URL
+ referencing a storage service.
+ This snapshot will be restored on initial startup, only when the etcd PV
+ is empty.
+ items:
+ maxLength: 1024
+ type: string
+ maxItems: 1
+ type: array
+ x-kubernetes-list-type: set
+ x-kubernetes-validations:
+ - message: RestoreSnapshotURL shouldn't contain more than
+ 1 entry
+ rule: self.size() <= 1
+ type:
+ description: |-
+ type is the kind of persistent storage implementation to use for etcd.
+ Only PersistentVolume is supported at the moment.
+ enum:
+ - PersistentVolume
+ type: string
+ required:
+ - type
+ type: object
+ required:
+ - storage
+ type: object
+ managementType:
+ description: |-
+ managementType defines how the etcd cluster is managed.
+ This can be either Managed or Unmanaged.
+ This field is immutable.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ x-kubernetes-validations:
+ - message: managementType is immutable
+ rule: self == oldSelf
+ unmanaged:
+ description: |-
+ unmanaged specifies configuration which enables the control plane to
+ integrate with an externally managed etcd cluster.
+ properties:
+ endpoint:
+ description: |-
+ endpoint is the full etcd cluster client endpoint URL. For example:
+
+ https://etcd-client:2379
+
+ If the URL uses an HTTPS scheme, the TLS field is required.
+ maxLength: 255
+ pattern: ^https://
+ type: string
+ tls:
+ description: tls specifies TLS configuration for HTTPS etcd
+ client endpoints.
+ properties:
+ clientSecret:
+ description: |-
+ clientSecret refers to a secret for client mTLS authentication with the etcd cluster. It
+ may have the following key/value pairs:
+
+ etcd-client-ca.crt: Certificate Authority value
+ etcd-client.crt: Client certificate value
+ etcd-client.key: Client certificate key value
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - clientSecret
+ type: object
+ required:
+ - endpoint
+ - tls
+ type: object
+ required:
+ - managementType
+ type: object
+ x-kubernetes-validations:
+ - message: Only managed configuration must be set when managementType
+ is Managed
+ rule: 'self.managementType == ''Managed'' ? has(self.managed) :
+ !has(self.managed)'
+ - message: Only unmanaged configuration must be set when managementType
+ is Unmanaged
+ rule: 'self.managementType == ''Unmanaged'' ? has(self.unmanaged)
+ : !has(self.unmanaged)'
+ fips:
+ description: fips specifies if the nodes for the cluster will be running
+ in FIPS mode
+ type: boolean
+ imageContentSources:
+ description: imageContentSources lists sources/repositories for the
+ release-image content.
+ items:
+ description: |-
+ ImageContentSource specifies image mirrors that can be used by cluster nodes
+ to pull content. For cluster workloads, if a container image registry host of
+ the pullspec matches Source then one of the Mirrors are substituted as hosts
+ in the pullspec and tried in order to fetch the image.
+ properties:
+ mirrors:
+ description: mirrors are one or more repositories that may also
+ contain the same images.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 255
+ type: array
+ x-kubernetes-list-type: set
+ source:
+ description: |-
+ source is the repository that users refer to, e.g. in image pull
+ specifications.
+ maxLength: 255
+ type: string
+ required:
+ - source
+ type: object
+ maxItems: 255
+ type: array
+ infraID:
+ description: infraID is the unique id that identifies the cluster
+ internally.
+ maxLength: 255
+ type: string
+ infrastructureAvailabilityPolicy:
+ default: SingleReplica
+ description: |-
+ infrastructureAvailabilityPolicy specifies the availability policy applied
+ to infrastructure services which run on cluster nodes. The default value is
+ SingleReplica.
+ enum:
+ - HighlyAvailable
+ - SingleReplica
+ type: string
+ issuerURL:
+ description: |-
+ issuerURL is an OIDC issuer URL which is used as the issuer in all
+ ServiceAccount tokens generated by the control plane API server. The
+ default value is kubernetes.default.svc, which only works for in-cluster
+ validation.
+ maxLength: 255
+ type: string
+ kubeAPIServerDNSName:
+ description: |-
+ kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
+ When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
+ If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
+ The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
+ This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
+ access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
+ for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)
+ rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
+ kubeconfig:
+ description: kubeconfig specifies the name and key for the kubeconfig
+ secret
+ properties:
+ key:
+ description: key is the key in the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ description: |-
+ labels when specified, define what custom labels are added to the hcp pods.
+ Changing this day 2 will cause a rollout of all hcp pods.
+ Duplicate keys are not supported. If duplicate keys are defined, only the last key/value pair is preserved.
+ Valid values are those in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
+
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(key) <= 317 && key.matches('^(([A-Za-z0-9]+(\\.[A-Za-z0-9]+)?)*[A-Za-z0-9]\\/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$'))`, message="label key must have two segments: an optional prefix and name, separated by a slash (/). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (_), dots (.), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (.), not longer than 253 characters in total, followed by a slash (/)"
+ -kubebuilder:validation:XValidation:rule=`self.all(key, size(self[key]) <= 63 && self[key].matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$'))`, message="label value must be 63 characters or less (can be empty), consist of alphanumeric characters, dashes (-), underscores (_) or dots (.), and begin and end with an alphanumeric character"
+ maxProperties: 20
+ type: object
+ networking:
+ description: |-
+ networking specifies network configuration for the cluster.
+ Temporarily optional for backward compatibility, required in future releases.
+ properties:
+ apiServer:
+ description: |-
+ apiServer contains advanced network settings for the API server that affect
+ how the APIServer is exposed inside a hosted cluster node.
+ properties:
+ advertiseAddress:
+ description: |-
+ advertiseAddress is the address that pods within the nodes will use to talk to the API
+ server. This is an address associated with the loopback adapter of each
+ node. If not specified, the controller will take default values.
+ The default values will be set as 172.20.0.1 or fd00::1.
+ This value is immutable.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: advertiseAddress is immutable
+ rule: self == oldSelf
+ allowedCIDRBlocks:
+ description: |-
+ allowedCIDRBlocks is an allow list of CIDR blocks that can access the APIServer.
+ If not specified, traffic is allowed from all addresses.
+ This field is enforced for ARO (Azure Red Hat OpenShift) via the shared-ingress HAProxy.
+ For platforms other than ARO, the enforcement depends on whether the underlying cloud provider supports the Service LoadBalancerSourceRanges field.
+ If the platform does not support LoadBalancerSourceRanges, this field may have no effect.
+ items:
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ maxItems: 500
+ type: array
+ x-kubernetes-list-type: set
+ port:
+ description: |-
+ port is the port at which the APIServer is exposed inside a node. Other
+ pods using host networking cannot listen on this port.
+ If omitted 6443 is used.
+ This is useful to choose a port other than the default one which might interfere with customer environments e.g. https://github.com/openshift/hypershift/pull/356.
+ Setting this to 443 is possible only for backward compatibility reasons and it's discouraged.
+ Doing so, it would result in the controller overriding the KAS endpoint in the guest cluster having a discrepancy with the KAS Pod and potentially causing temporarily network failures.
+ This value is immutable.
+ format: int32
+ type: integer
+ x-kubernetes-validations:
+ - message: port is immutable
+ rule: self == oldSelf
+ type: object
+ clusterNetwork:
+ default:
+ - cidr: 10.132.0.0/14
+ description: |-
+ clusterNetwork is the list of IP address pools for pods.
+ Defaults to cidr: "10.132.0.0/14".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: |-
+ ClusterNetworkEntry is a single IP address block for pod IP blocks. IP blocks
+ are allocated with size 2^HostSubnetLength.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ hostPrefix:
+ description: |-
+ hostPrefix is the prefix size to allocate to each node from the CIDR.
+ For example, 24 would allocate 2^(32-24)=2^8=256 addresses to each node. If this
+ field is not used by the plugin, it can be left unset.
+ format: int32
+ type: integer
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: clusterNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ machineNetwork:
+ description: |-
+ machineNetwork is the list of IP address pools for machines.
+ This might be used among other things to generate appropriate networking security groups in some clouds providers.
+ Currently only one entry or two for dual stack is supported.
+ This field is immutable.
+ items:
+ description: MachineNetworkEntry is a single IP address block
+ for node IP blocks.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for machines
+ within the cluster.
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: machineNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ networkType:
+ default: OVNKubernetes
+ description: |-
+ networkType specifies the SDN provider used for cluster networking.
+ Defaults to OVNKubernetes.
+ This field is required and immutable.
+ kubebuilder:validation:XValidation:rule="self == oldSelf", message="networkType is immutable"
+ enum:
+ - OpenShiftSDN
+ - Calico
+ - OVNKubernetes
+ - Other
+ type: string
+ serviceNetwork:
+ default:
+ - cidr: 172.31.0.0/16
+ description: |-
+ serviceNetwork is the list of IP address pools for services.
+ Defaults to cidr: "172.31.0.0/16".
+ Currently only one entry is supported.
+ This field is immutable.
+ items:
+ description: ServiceNetworkEntry is a single IP address block
+ for the service network.
+ properties:
+ cidr:
+ description: cidr is the IP block address pool for services
+ within the cluster in CIDR format (e.g., 192.168.1.0/24
+ or 2001:0db8::/64)
+ maxLength: 43
+ type: string
+ x-kubernetes-validations:
+ - message: cidr must be a valid IPv4 or IPv6 CIDR notation
+ (e.g., 192.168.1.0/24 or 2001:db8::/64)
+ rule: self.matches('^((\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2})$')
+ || self.matches('^([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?/[0-9]{1,3}$')
+ required:
+ - cidr
+ type: object
+ maxItems: 2
+ minItems: 1
+ type: array
+ x-kubernetes-validations:
+ - message: serviceNetwork is immutable and cannot be modified
+ once set.
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+ must be unique and non-overlapping
+ rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
+ c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
+ self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
+ self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
+ self.serviceNetwork.all(s, c.cidr != s.cidr)))))
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: nodeSelector when specified, must be true for the pods
+ managed by the HostedCluster to be scheduled.
+ type: object
+ olmCatalogPlacement:
+ default: management
+ description: |-
+ olmCatalogPlacement specifies the placement of OLM catalog components. By default,
+ this is set to management and OLM catalog components are deployed onto the management
+ cluster. If set to guest, the OLM catalog components will be deployed onto the guest
+ cluster.
+ enum:
+ - management
+ - guest
+ type: string
+ operatorConfiguration:
+ description: operatorConfiguration specifies configuration for individual
+ OCP operators in the cluster.
+ properties:
+ clusterNetworkOperator:
+ description: clusterNetworkOperator specifies the configuration
+ for the Cluster Network Operator in the hosted cluster.
+ properties:
+ disableMultiNetwork:
+ default: false
+ description: |-
+ disableMultiNetwork when set to true disables the Multus CNI plugin and related components
+ in the hosted cluster. This prevents the installation of multus daemon sets in the
+ guest cluster and the multus-admission-controller in the management cluster.
+ Default is false (Multus is enabled).
+ This field is immutable.
+ This field can only be set to true when NetworkType is "Other". Setting it to true
+ with any other NetworkType will result in a validation error during cluster creation.
+ type: boolean
+ x-kubernetes-validations:
+ - message: disableMultiNetwork is immutable
+ rule: self == oldSelf
+ ovnKubernetesConfig:
+ description: |-
+ ovnKubernetesConfig holds OVN-Kubernetes specific configuration.
+ This is only consumed when NetworkType is OVNKubernetes.
+ minProperties: 1
+ properties:
+ ipv4:
+ description: |-
+ ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
+ this means no opinions and the default configuration is used. Check individual
+ fields within ipv4 for details of default values.
+ minProperties: 1
+ properties:
+ internalJoinSubnet:
+ description: |-
+ internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the
+ default one is being already used by something else. It must not overlap with
+ any other subnet being used by OpenShift or by the node network. The size of the
+ subnet must be larger than the number of nodes.
+ The current default value is 100.64.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ (e.g., 192.168.1.1/24)
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ internalTransitSwitchSubnet:
+ description: |-
+ internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally
+ by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect
+ architecture that connects the cluster routers on each node together to enable
+ east west traffic. The subnet chosen should not overlap with other networks
+ specified for OVN-Kubernetes as well as other networks used on the host.
+ When omitted, this means no opinion and the platform is left to choose a reasonable
+ default which is subject to change over time.
+ The current default subnet is 100.88.0.0/16
+ The subnet must be large enough to accommodate one IP per node in your cluster
+ The value must be in proper IPV4 CIDR format
+ maxLength: 18
+ minLength: 9
+ type: string
+ x-kubernetes-validations:
+ - message: Subnet must be in a valid IPv4 CIDR format
+ rule: self.matches('^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$')
+ && self.split('/')[0].split('.').all(oct, int(oct)
+ >= 0 && int(oct) <= 255)
+ - message: subnet must be in the range /0 to /30 inclusive
+ rule: self.matches('^.*/[0-9]+$') && int(self.split('/')[1])
+ <= 30
+ - message: first IP address octet must not be 0
+ rule: self.matches('^[0-9]{1,3}\\..*') && int(self.split('/')[0].split('.')[0])
+ > 0
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: internalJoinSubnet and internalTransitSwitchSubnet
+ must not be the same
+ rule: '!has(self.ipv4) || !has(self.ipv4.internalJoinSubnet)
+ || !has(self.ipv4.internalTransitSwitchSubnet) || self.ipv4.internalJoinSubnet
+ != self.ipv4.internalTransitSwitchSubnet'
+ type: object
+ clusterVersionOperator:
+ description: clusterVersionOperator specifies the configuration
+ for the Cluster Version Operator in the hosted cluster.
+ properties:
+ operatorLogLevel:
+ default: Normal
+ description: |-
+ operatorLogLevel is an intent based logging for the operator itself. It does not give fine-grained control,
+ but it is a simple way to manage coarse grained logging choices that operators have to interpret for themselves.
+
+ Valid values are: "Normal", "Debug", "Trace", "TraceAll".
+ Defaults to "Normal".
+ enum:
+ - ""
+ - Normal
+ - Debug
+ - Trace
+ - TraceAll
+ type: string
+ type: object
+ ingressOperator:
+ description: |-
+ ingressOperator specifies the configuration for the Ingress Operator in the hosted cluster.
+ This allows configuring how the default ingress controller endpoints are published.
+ properties:
+ endpointPublishingStrategy:
+ description: |-
+ endpointPublishingStrategy is used to publish the default ingress controller endpoints.
+
+ The endpoint publishing strategy is determined by the following precedence order:
+ 1. User-specified endpointPublishingStrategy (highest priority) - if this field is set,
+ it takes precedence over all other configuration methods
+ 2. Platform-specific defaults with annotation overrides - if no user strategy is set,
+ the platform type determines the default strategy, which can be further modified by:
+ - hypershift.openshift.io/private-ingress-controller annotation (sets PrivateStrategyType)
+ - hypershift.openshift.io/ingress-controller-load-balancer-scope annotation (sets LoadBalancerScope)
+ 3. Generic LoadBalancer fallback - if the platform is not recognized, defaults to
+ LoadBalancerService with External scope
+
+ Platform-specific defaults when endpointPublishingStrategy is not set:
+ - AWS: LoadBalancerService with External scope (or NLB if configured)
+ - Azure, GCP: LoadBalancerService with External scope
+ - IBMCloud: LoadBalancerService with External scope (or NodePort for UPI)
+ - None: HostNetwork
+ - KubeVirt: NodePortService
+ - OpenStack: LoadBalancerService with External scope and optional FloatingIP
+ - Other platforms: LoadBalancerService with External scope
+
+ See the OpenShift Ingress Operator EndpointPublishingStrategy type for the full specification:
+ https://github.com/openshift/api/blob/master/operator/v1/types_ingress.go
+ properties:
+ hostNetwork:
+ description: |-
+ hostNetwork holds parameters for the HostNetwork endpoint publishing
+ strategy. Present only if type is HostNetwork.
+ properties:
+ httpPort:
+ default: 80
+ description: |-
+ httpPort is the port on the host which should be used to listen for
+ HTTP requests. This field should be set when port 80 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 80.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ httpsPort:
+ default: 443
+ description: |-
+ httpsPort is the port on the host which should be used to listen for
+ HTTPS requests. This field should be set when port 443 is already in use.
+ The value should not coincide with the NodePort range of the cluster.
+ When the value is 0 or is not specified it defaults to 443.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ statsPort:
+ default: 1936
+ description: |-
+ statsPort is the port on the host where the stats from the router are
+ published. The value should not coincide with the NodePort range of the
+ cluster. If an external load balancer is configured to forward connections
+ to this IngressController, the load balancer should use this port for
+ health checks. The load balancer can send HTTP probes on this port on a
+ given node, with the path /healthz/ready to determine if the ingress
+ controller is ready to receive traffic on the node. For proper operation
+ the load balancer must not forward traffic to a node until the health
+ check reports ready. The load balancer should also stop forwarding requests
+ within a maximum of 45 seconds after /healthz/ready starts reporting
+ not-ready. Probing every 5 to 10 seconds, with a 5-second timeout and with
+ a threshold of two successful or failed requests to become healthy or
+ unhealthy respectively, are well-tested values. When the value is 0 or
+ is not specified it defaults to 1936.
+ format: int32
+ maximum: 65535
+ minimum: 0
+ type: integer
+ type: object
+ loadBalancer:
+ description: |-
+ loadBalancer holds parameters for the load balancer. Present only if
+ type is LoadBalancerService.
+ properties:
+ allowedSourceRanges:
+ description: |-
+ allowedSourceRanges specifies an allowlist of IP address ranges to which
+ access to the load balancer should be restricted. Each range must be
+ specified using CIDR notation (e.g. "10.0.0.0/8" or "fd00::/8"). If no range is
+ specified, "0.0.0.0/0" for IPv4 and "::/0" for IPv6 are used by default,
+ which allows all source addresses.
+
+ To facilitate migration from earlier versions of OpenShift that did
+ not have the allowedSourceRanges field, you may set the
+ service.beta.kubernetes.io/load-balancer-source-ranges annotation on
+ the "router-" service in the
+ "openshift-ingress" namespace, and this annotation will take
+ effect if allowedSourceRanges is empty on OpenShift 4.12.
+ items:
+ description: |-
+ CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8"
+ or "fd00::/8").
+ pattern: (^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/([0-9]|[12][0-9]|3[0-2])$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)
+ type: string
+ nullable: true
+ type: array
+ x-kubernetes-list-type: atomic
+ dnsManagementPolicy:
+ default: Managed
+ description: |-
+ dnsManagementPolicy indicates if the lifecycle of the wildcard DNS record
+ associated with the load balancer service will be managed by
+ the ingress operator. It defaults to Managed.
+ Valid values are: Managed and Unmanaged.
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ providerParameters:
+ description: |-
+ providerParameters holds desired load balancer information specific to
+ the underlying infrastructure provider.
+
+ If empty, defaults will be applied. See specific providerParameters
+ fields for details about their defaults.
+ properties:
+ aws:
+ description: |-
+ aws provides configuration settings that are specific to AWS
+ load balancers.
+
+ If empty, defaults will be applied. See specific aws fields for
+ details about their defaults.
+ properties:
+ classicLoadBalancer:
+ description: |-
+ classicLoadBalancerParameters holds configuration parameters for an AWS
+ classic load balancer. Present only if type is Classic.
+ properties:
+ connectionIdleTimeout:
+ description: |-
+ connectionIdleTimeout specifies the maximum time period that a
+ connection may be idle before the load balancer closes the
+ connection. The value must be parseable as a time duration value;
+ see . A nil or zero value
+ means no opinion, in which case a default value is used. The default
+ value for this field is 60s. This default is subject to change.
+ format: duration
+ type: string
+ type: object
+ networkLoadBalancer:
+ description: |-
+ networkLoadBalancerParameters holds configuration parameters for an AWS
+ network load balancer. Present only if type is NLB.
+ type: object
+ type:
+ description: |-
+ type is the type of AWS load balancer to instantiate for an ingresscontroller.
+
+ Valid values are:
+
+ * "Classic": A Classic Load Balancer that makes routing decisions at either
+ the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See
+ the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
+
+ * "NLB": A Network Load Balancer that makes routing decisions at the
+ transport layer (TCP/SSL). See the following for additional details:
+
+ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
+ enum:
+ - Classic
+ - NLB
+ type: string
+ required:
+ - type
+ type: object
+ gcp:
+ description: |-
+ gcp provides configuration settings that are specific to GCP
+ load balancers.
+
+ If empty, defaults will be applied. See specific gcp fields for
+ details about their defaults.
+ properties:
+ clientAccess:
+ description: |-
+ clientAccess describes how client access is restricted for internal
+ load balancers.
+
+ Valid values are:
+ * "Global": Specifying an internal load balancer with Global client access
+ allows clients from any region within the VPC to communicate with the load
+ balancer.
+
+ https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#global_access
+
+ * "Local": Specifying an internal load balancer with Local client access
+ means only clients within the same region (and VPC) as the GCP load balancer
+ can communicate with the load balancer. Note that this is the default behavior.
+
+ https://cloud.google.com/load-balancing/docs/internal#client_access
+ enum:
+ - Global
+ - Local
+ type: string
+ type: object
+ ibm:
+ description: |-
+ ibm provides configuration settings that are specific to IBM Cloud
+ load balancers.
+
+ If empty, defaults will be applied. See specific ibm fields for
+ details about their defaults.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the load balancer uses PROXY protocol to forward connections to
+ the IngressController. See "service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features:
+ "proxy-protocol"" at https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas"
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ Valid values for protocol are TCP, PROXY and omitted.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is TCP, without the proxy protocol enabled.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ openstack:
+ description: |-
+ openstack provides configuration settings that are specific to OpenStack
+ load balancers.
+
+ If empty, defaults will be applied. See specific openstack fields for
+ details about their defaults.
+ properties:
+ floatingIP:
+ description: |-
+ floatingIP specifies the IP address that the load balancer will use.
+ When not specified, an IP address will be assigned randomly by the OpenStack cloud provider.
+ When specified, the floating IP has to be pre-created. If the
+ specified value is not a floating IP or is already claimed, the
+ OpenStack cloud provider won't be able to provision the load
+ balancer.
+ This field may only be used if the IngressController has External scope.
+ This value must be a valid IPv4 or IPv6 address.
+ type: string
+ x-kubernetes-validations:
+ - message: floatingIP must be a valid IPv4
+ or IPv6 address
+ rule: isIP(self)
+ type: object
+ type:
+ description: |-
+ type is the underlying infrastructure provider for the load balancer.
+ Allowed values are "AWS", "Azure", "BareMetal", "GCP", "IBM", "Nutanix",
+ "OpenStack", and "VSphere".
+ enum:
+ - AWS
+ - Azure
+ - BareMetal
+ - GCP
+ - Nutanix
+ - OpenStack
+ - VSphere
+ - IBM
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: openstack is not permitted when type is
+ not OpenStack
+ rule: 'has(self.type) && self.type == ''OpenStack''
+ ? true : !has(self.openstack)'
+ scope:
+ description: |-
+ scope indicates the scope at which the load balancer is exposed.
+ Possible values are "External" and "Internal".
+ enum:
+ - Internal
+ - External
+ type: string
+ required:
+ - dnsManagementPolicy
+ - scope
+ type: object
+ x-kubernetes-validations:
+ - message: cannot specify a floating ip when scope is
+ internal
+ rule: '!has(self.scope) || self.scope != ''Internal''
+ || !has(self.providerParameters) || !has(self.providerParameters.openstack)
+ || !has(self.providerParameters.openstack.floatingIP)
+ || self.providerParameters.openstack.floatingIP ==
+ ""'
+ nodePort:
+ description: |-
+ nodePort holds parameters for the NodePortService endpoint publishing strategy.
+ Present only if type is NodePortService.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ private:
+ description: |-
+ private holds parameters for the Private endpoint publishing
+ strategy. Present only if type is Private.
+ properties:
+ protocol:
+ description: |-
+ protocol specifies whether the IngressController expects incoming
+ connections to use plain TCP or whether the IngressController expects
+ PROXY protocol.
+
+ PROXY protocol can be used with load balancers that support it to
+ communicate the source addresses of client connections when
+ forwarding those connections to the IngressController. Using PROXY
+ protocol enables the IngressController to report those source
+ addresses instead of reporting the load balancer's address in HTTP
+ headers and logs. Note that enabling PROXY protocol on the
+ IngressController will cause connections to fail if you are not using
+ a load balancer that uses PROXY protocol to forward connections to
+ the IngressController. See
+ http://www.haproxy.org/download/2.2/doc/proxy-protocol.txt for
+ information about PROXY protocol.
+
+ The following values are valid for this field:
+
+ * The empty string.
+ * "TCP".
+ * "PROXY".
+
+ The empty string specifies the default, which is TCP without PROXY
+ protocol. Note that the default is subject to change.
+ enum:
+ - ""
+ - TCP
+ - PROXY
+ type: string
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy to use. Valid values are:
+
+ * LoadBalancerService
+
+ Publishes the ingress controller using a Kubernetes LoadBalancer Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A LoadBalancer Service is created to publish the deployment.
+
+ See: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
+
+ If domain is set, a wildcard DNS record will be managed to point at the
+ LoadBalancer Service's external name. DNS records are managed only in DNS
+ zones defined by dns.config.openshift.io/cluster .spec.publicZone and
+ .spec.privateZone.
+
+ Wildcard DNS management is currently supported only on the AWS, Azure,
+ and GCP platforms.
+
+ * HostNetwork
+
+ Publishes the ingress controller on node ports where the ingress controller
+ is deployed.
+
+ In this configuration, the ingress controller deployment uses host
+ networking, bound to node ports 80 and 443. The user is responsible for
+ configuring an external load balancer to publish the ingress controller via
+ the node ports.
+
+ * Private
+
+ Does not publish the ingress controller.
+
+ In this configuration, the ingress controller deployment uses container
+ networking, and is not explicitly published. The user must manually publish
+ the ingress controller.
+
+ * NodePortService
+
+ Publishes the ingress controller using a Kubernetes NodePort Service.
+
+ In this configuration, the ingress controller deployment uses container
+ networking. A NodePort Service is created to publish the deployment. The
+ specific node ports are dynamically allocated by OpenShift; however, to
+ support static port allocations, user changes to the node port
+ field of the managed NodePort Service will preserved.
+ enum:
+ - LoadBalancerService
+ - HostNetwork
+ - Private
+ - NodePortService
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-preserve-unknown-fields: true
+ type: object
+ type: object
+ pausedUntil:
+ description: |-
+ pausedUntil is a field that can be used to pause reconciliation on a resource.
+ Either a date can be provided in RFC3339 format or a boolean. If a date is
+ provided: reconciliation is paused on the resource until that date. If the boolean true is
+ provided: reconciliation is paused on the resource until the field is removed.
+ maxLength: 255
+ type: string
+ platform:
+ description: platform is the platform configuration for the cluster.
+ properties:
+ agent:
+ description: agent specifies configuration for agent-based installations.
+ properties:
+ agentNamespace:
+ description: agentNamespace is the namespace where to search
+ for Agents for this cluster
+ maxLength: 63
+ type: string
+ required:
+ - agentNamespace
+ type: object
+ aws:
+ description: aws specifies configuration for clusters running
+ on Amazon Web Services.
+ properties:
+ additionalAllowedPrincipals:
+ description: |-
+ additionalAllowedPrincipals specifies a list of additional allowed principal ARNs
+ to be added to the hosted control plane's VPC Endpoint Service to enable additional
+ VPC Endpoint connection requests to be automatically accepted.
+ See https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html
+ for more details around VPC Endpoint Service allowed principals.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 25
+ type: array
+ cloudProviderConfig:
+ description: |-
+ cloudProviderConfig specifies AWS networking configuration for the control
+ plane.
+ This is mainly used for cloud provider controller config:
+ https://github.com/kubernetes/kubernetes/blob/f5be5052e3d0808abb904aebd3218fe4a5c2dd82/staging/src/k8s.io/legacy-cloud-providers/aws/aws.go#L1347-L1364
+ properties:
+ subnet:
+ description: subnet is the subnet to use for control plane
+ cloud resources.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify
+ an AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for
+ the filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: vpc is the VPC to use for control plane cloud
+ resources.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ maxLength: 255
+ type: string
+ required:
+ - vpc
+ type: object
+ endpointAccess:
+ default: Public
+ description: |-
+ endpointAccess specifies the publishing scope of cluster endpoints. The
+ default is Public.
+ enum:
+ - Public
+ - PublicAndPrivate
+ - Private
+ type: string
+ multiArch:
+ default: false
+ description: |-
+ multiArch specifies whether the Hosted Cluster will be expected to support NodePools with different
+ CPU architectures, i.e., supporting arm64 NodePools and supporting amd64 NodePools on the same Hosted Cluster.
+ Deprecated: This field is no longer used. The HyperShift Operator now performs multi-arch validations
+ automatically despite the platform type. The HyperShift Operator will set HostedCluster.Status.PayloadArch based
+ on the HostedCluster release image. This field is used by the NodePool controller to validate the
+ NodePool.Spec.Arch is supported.
+ type: boolean
+ region:
+ description: |-
+ region is the AWS region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot AMI for a given release.
+ maxLength: 255
+ type: string
+ resourceTags:
+ description: |-
+ resourceTags is a list of additional tags to apply to AWS resources created
+ for the cluster. See
+ https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for
+ information on tagging AWS resources. AWS supports a maximum of 50 tags per
+ resource. OpenShift reserves 25 tags for its use, leaving 25 tags available
+ for the user.
+ Changes to this field will be propagated in-place to AWS resources (VPC Endpoints, EC2 instances, initial EBS volumes and default/endpoint security groups).
+ These tags will be propagated to the infrastructure CR in the guest cluster, where other OCP operators might choose to honor this input to reconcile AWS resources created by them.
+ Please consult the official documentation for a list of all AWS resources that support in-place tag updates.
+ These take precedence over tags defined out of band (i.e., tags added manually or by other tools outside of HyperShift) in AWS in case of conflicts.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ value:
+ description: |-
+ value is the value of the tag.
+
+ Some AWS service do not support empty values. Since tags are added to
+ resources in many services, the length of the tag value must meet the
+ requirements of all services.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ rolesRef:
+ description: |-
+ rolesRef contains references to various AWS IAM roles required to enable
+ integrations such as OIDC.
+ properties:
+ controlPlaneOperatorARN:
+ description: "controlPlaneOperatorARN is an ARN value
+ referencing a role appropriate for the Control Plane
+ Operator.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"arn:aws:route53:::%s\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ imageRegistryARN:
+ description: "imageRegistryARN is an ARN value referencing
+ a role appropriate for the Image Registry Operator.\n\nThe
+ following is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"s3:CreateBucket\",\n\t\t\t\t\"s3:DeleteBucket\",\n\t\t\t\t\"s3:PutBucketTagging\",\n\t\t\t\t\"s3:GetBucketTagging\",\n\t\t\t\t\"s3:PutBucketPublicAccessBlock\",\n\t\t\t\t\"s3:GetBucketPublicAccessBlock\",\n\t\t\t\t\"s3:PutEncryptionConfiguration\",\n\t\t\t\t\"s3:GetEncryptionConfiguration\",\n\t\t\t\t\"s3:PutLifecycleConfiguration\",\n\t\t\t\t\"s3:GetLifecycleConfiguration\",\n\t\t\t\t\"s3:GetBucketLocation\",\n\t\t\t\t\"s3:ListBucket\",\n\t\t\t\t\"s3:GetObject\",\n\t\t\t\t\"s3:PutObject\",\n\t\t\t\t\"s3:DeleteObject\",\n\t\t\t\t\"s3:ListBucketMultipartUploads\",\n\t\t\t\t\"s3:AbortMultipartUpload\",\n\t\t\t\t\"s3:ListMultipartUploadParts\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing a
+ role appropriate for the Ingress Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"elasticloadbalancing:DescribeLoadBalancers\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"route53:ListHostedZones\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"route53:ChangeResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ [\n\t\t\t\t\"arn:aws:route53:::PUBLIC_ZONE_ID\",\n\t\t\t\t\"arn:aws:route53:::PRIVATE_ZONE_ID\"\n\t\t\t]\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ kubeCloudControllerARN:
+ description: |-
+ kubeCloudControllerARN is an ARN value referencing a role appropriate for the KCM/KCC.
+ Source: https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies
+
+ The following is an example of a valid policy document:
+
+ {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Action": [
+ "autoscaling:DescribeAutoScalingGroups",
+ "autoscaling:DescribeLaunchConfigurations",
+ "autoscaling:DescribeTags",
+ "ec2:DescribeAvailabilityZones",
+ "ec2:DescribeInstances",
+ "ec2:DescribeImages",
+ "ec2:DescribeRegions",
+ "ec2:DescribeRouteTables",
+ "ec2:DescribeSecurityGroups",
+ "ec2:DescribeSubnets",
+ "ec2:DescribeVolumes",
+ "ec2:CreateSecurityGroup",
+ "ec2:CreateTags",
+ "ec2:CreateVolume",
+ "ec2:ModifyInstanceAttribute",
+ "ec2:ModifyVolume",
+ "ec2:AttachVolume",
+ "ec2:AuthorizeSecurityGroupIngress",
+ "ec2:CreateRoute",
+ "ec2:DeleteRoute",
+ "ec2:DeleteSecurityGroup",
+ "ec2:DeleteVolume",
+ "ec2:DetachVolume",
+ "ec2:RevokeSecurityGroupIngress",
+ "ec2:DescribeVpcs",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:AttachLoadBalancerToSubnets",
+ "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancer",
+ "elasticloadbalancing:CreateLoadBalancerPolicy",
+ "elasticloadbalancing:CreateLoadBalancerListeners",
+ "elasticloadbalancing:ConfigureHealthCheck",
+ "elasticloadbalancing:DeleteLoadBalancer",
+ "elasticloadbalancing:DeleteLoadBalancerListeners",
+ "elasticloadbalancing:DescribeLoadBalancers",
+ "elasticloadbalancing:DescribeLoadBalancerAttributes",
+ "elasticloadbalancing:DetachLoadBalancerFromSubnets",
+ "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
+ "elasticloadbalancing:ModifyLoadBalancerAttributes",
+ "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
+ "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
+ "elasticloadbalancing:AddTags",
+ "elasticloadbalancing:CreateListener",
+ "elasticloadbalancing:CreateTargetGroup",
+ "elasticloadbalancing:DeleteListener",
+ "elasticloadbalancing:DeleteTargetGroup",
+ "elasticloadbalancing:DeregisterTargets",
+ "elasticloadbalancing:DescribeListeners",
+ "elasticloadbalancing:DescribeLoadBalancerPolicies",
+ "elasticloadbalancing:DescribeTargetGroups",
+ "elasticloadbalancing:DescribeTargetHealth",
+ "elasticloadbalancing:ModifyListener",
+ "elasticloadbalancing:ModifyTargetGroup",
+ "elasticloadbalancing:RegisterTargets",
+ "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
+ "iam:CreateServiceLinkedRole",
+ "kms:DescribeKey"
+ ],
+ "Resource": [
+ "*"
+ ],
+ "Effect": "Allow"
+ }
+ ]
+ }
+ maxLength: 2048
+ type: string
+ networkARN:
+ description: "networkARN is an ARN value referencing a
+ role appropriate for the Network Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:DescribeInstances\",\n
+ \ \"ec2:DescribeInstanceStatus\",\n \"ec2:DescribeInstanceTypes\",\n
+ \ \"ec2:UnassignPrivateIpAddresses\",\n \"ec2:AssignPrivateIpAddresses\",\n
+ \ \"ec2:UnassignIpv6Addresses\",\n \"ec2:AssignIpv6Addresses\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeNetworkInterfaces\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ nodePoolManagementARN:
+ description: "nodePoolManagementARN is an ARN value referencing
+ a role appropriate for the CAPI Controller.\n\nThe following
+ is an example of a valid policy document:\n\n{\n \"Version\":
+ \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\":
+ [\n \"ec2:AssociateRouteTable\",\n \"ec2:AttachInternetGateway\",\n
+ \ \"ec2:AuthorizeSecurityGroupIngress\",\n \"ec2:CreateInternetGateway\",\n
+ \ \"ec2:CreateNatGateway\",\n \"ec2:CreateRoute\",\n
+ \ \"ec2:CreateRouteTable\",\n \"ec2:CreateSecurityGroup\",\n
+ \ \"ec2:CreateSubnet\",\n \"ec2:CreateTags\",\n
+ \ \"ec2:DeleteInternetGateway\",\n \"ec2:DeleteNatGateway\",\n
+ \ \"ec2:DeleteRouteTable\",\n \"ec2:DeleteSecurityGroup\",\n
+ \ \"ec2:DeleteSubnet\",\n \"ec2:DeleteTags\",\n
+ \ \"ec2:DescribeAccountAttributes\",\n \"ec2:DescribeAddresses\",\n
+ \ \"ec2:DescribeAvailabilityZones\",\n \"ec2:DescribeImages\",\n
+ \ \"ec2:DescribeInstances\",\n \"ec2:DescribeInternetGateways\",\n
+ \ \"ec2:DescribeNatGateways\",\n \"ec2:DescribeNetworkInterfaces\",\n
+ \ \"ec2:DescribeNetworkInterfaceAttribute\",\n
+ \ \"ec2:DescribeRouteTables\",\n \"ec2:DescribeSecurityGroups\",\n
+ \ \"ec2:DescribeSubnets\",\n \"ec2:DescribeVpcs\",\n
+ \ \"ec2:DescribeVpcAttribute\",\n \"ec2:DescribeVolumes\",\n
+ \ \"ec2:DetachInternetGateway\",\n \"ec2:DisassociateRouteTable\",\n
+ \ \"ec2:DisassociateAddress\",\n \"ec2:ModifyInstanceAttribute\",\n
+ \ \"ec2:ModifyNetworkInterfaceAttribute\",\n \"ec2:ModifySubnetAttribute\",\n
+ \ \"ec2:RevokeSecurityGroupIngress\",\n \"ec2:RunInstances\",\n
+ \ \"ec2:TerminateInstances\",\n \"tag:GetResources\",\n
+ \ \"ec2:CreateLaunchTemplate\",\n \"ec2:CreateLaunchTemplateVersion\",\n
+ \ \"ec2:DescribeLaunchTemplates\",\n \"ec2:DescribeLaunchTemplateVersions\",\n
+ \ \"ec2:DeleteLaunchTemplate\",\n \"ec2:DeleteLaunchTemplateVersions\"\n
+ \ ],\n \"Resource\": [\n \"*\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n {\n \"Condition\":
+ {\n \"StringLike\": {\n \"iam:AWSServiceName\":
+ \"elasticloadbalancing.amazonaws.com\"\n }\n },\n
+ \ \"Action\": [\n \"iam:CreateServiceLinkedRole\"\n
+ \ ],\n \"Resource\": [\n \"arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing\"\n
+ \ ],\n \"Effect\": \"Allow\"\n },\n {\n \"Action\":
+ [\n \"iam:PassRole\"\n ],\n \"Resource\":
+ [\n \"arn:*:iam::*:role/*-worker-role\"\n ],\n
+ \ \"Effect\": \"Allow\"\n },\n\t {\n\t \t\"Effect\":
+ \"Allow\",\n\t \t\"Action\": [\n\t \t\t\"kms:Decrypt\",\n\t
+ \ \t\t\"kms:ReEncrypt\",\n\t \t\t\"kms:GenerateDataKeyWithoutPlainText\",\n\t
+ \ \t\t\"kms:DescribeKey\"\n\t \t],\n\t \t\"Resource\":
+ \"*\"\n\t },\n\t {\n\t \t\"Effect\": \"Allow\",\n\t
+ \ \t\"Action\": [\n\t \t\t\"kms:CreateGrant\"\n\t \t],\n\t
+ \ \t\"Resource\": \"*\",\n\t \t\"Condition\": {\n\t
+ \ \t\t\"Bool\": {\n\t \t\t\t\"kms:GrantIsForAWSResource\":
+ true\n\t \t\t}\n\t \t}\n\t }\n ]\n}"
+ maxLength: 2048
+ type: string
+ storageARN:
+ description: "storageARN is an ARN value referencing a
+ role appropriate for the Storage Operator.\n\nThe following
+ is an example of a valid policy document:\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:AttachVolume\",\n\t\t\t\t\"ec2:CreateSnapshot\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"ec2:CreateVolume\",\n\t\t\t\t\"ec2:DeleteSnapshot\",\n\t\t\t\t\"ec2:DeleteTags\",\n\t\t\t\t\"ec2:DeleteVolume\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeSnapshots\",\n\t\t\t\t\"ec2:DescribeTags\",\n\t\t\t\t\"ec2:DescribeVolumes\",\n\t\t\t\t\"ec2:DescribeVolumesModifications\",\n\t\t\t\t\"ec2:DetachVolume\",\n\t\t\t\t\"ec2:ModifyVolume\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - controlPlaneOperatorARN
+ - imageRegistryARN
+ - ingressARN
+ - kubeCloudControllerARN
+ - networkARN
+ - nodePoolManagementARN
+ - storageARN
+ type: object
+ serviceEndpoints:
+ description: |-
+ serviceEndpoints specifies optional custom endpoints which will override
+ the default service endpoint of specific AWS Services.
+
+ There must be only one ServiceEndpoint for a given service name.
+ items:
+ description: |-
+ AWSServiceEndpoint stores the configuration for services to
+ override existing defaults of AWS Services.
+ properties:
+ name:
+ description: |-
+ name is the name of the AWS service.
+ This must be provided and cannot be empty.
+ maxLength: 255
+ type: string
+ url:
+ description: |-
+ url is fully qualified URI with scheme https, that overrides the default generated
+ endpoint for a client.
+ This must be provided and cannot be empty.
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - name
+ - url
+ type: object
+ maxItems: 50
+ type: array
+ sharedVPC:
+ description: |-
+ sharedVPC contains fields that must be specified if the HostedCluster must use a VPC that is
+ created in a different AWS account and is shared with the AWS account where the HostedCluster
+ will be created.
+ properties:
+ localZoneID:
+ description: |-
+ localZoneID is the ID of the route53 hosted zone for [cluster-name].hypershift.local that is
+ associated with the HostedCluster's VPC and exists in the VPC owner account.
+ maxLength: 32
+ type: string
+ rolesRef:
+ description: |-
+ rolesRef contains references to roles in the VPC owner account that enable a
+ HostedCluster on a shared VPC.
+ properties:
+ controlPlaneARN:
+ description: "controlPlaneARN is an ARN value referencing
+ the role in the VPC owner account that allows\nthe
+ control plane operator in the cluster account to
+ create and manage a VPC endpoint, its\ncorresponding
+ Security Group, and DNS records in the hypershift
+ local hosted zone.\n\nThe referenced role must have
+ a trust relationship that allows it to be assumed
+ by the\ncontrol plane operator role in the VPC creator
+ account.\nExample:\n{\n\t \"Version\": \"2012-10-17\",\n\t
+ \"Statement\": [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t
+ \t\t\"Effect\": \"Allow\",\n\t \t\t\"Principal\":
+ {\n\t \t\t\t\"AWS\": \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-control-plane-operator\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ ingressARN:
+ description: "ingressARN is an ARN value referencing
+ the role in the VPC owner account that allows the\ningress
+ operator in the cluster account to create and manage
+ records in the private DNS\nhosted zone.\n\nThe
+ referenced role must have a trust relationship that
+ allows it to be assumed by the\ningress operator
+ role in the VPC creator account.\nExample:\n{\n\t
+ \"Version\": \"2012-10-17\",\n\t \"Statement\":
+ [\n\t \t{\n\t \t\t\"Sid\": \"Statement1\",\n\t \t\t\"Effect\":
+ \"Allow\",\n\t \t\t\"Principal\": {\n\t \t\t\t\"AWS\":
+ \"arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-openshift-ingress\"\n\t
+ \t\t},\n\t \t\t\"Action\": \"sts:AssumeRole\"\n\t
+ \t}\n\t ]\n}\n\nThe following is an example of the
+ policy document for this role.\n(Based on https://docs.openshift.com/rosa/rosa_install_access_delete_clusters/rosa-shared-vpc-config.html#rosa-sharing-vpc-dns-and-roles_rosa-shared-vpc-config)\n\n{\n\t\"Version\":
+ \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
+ \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"route53:ListHostedZonesByName\",\n\t\t\t\t\"route53:ChangeTagsForResource\",\n\t\t\t\t\"route53:GetAccountLimit\",\n\t\t\t\t\"route53:GetChange\",\n\t\t\t\t\"route53:GetHostedZone\",\n\t\t\t\t\"route53:ListTagsForResource\",\n\t\t\t\t\"route53:UpdateHostedZoneComment\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"tag:UntagResources\"\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
+ \"*\"\n\t\t},\n\t]\n}"
+ maxLength: 2048
+ pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
+ type: string
+ required:
+ - controlPlaneARN
+ - ingressARN
+ type: object
+ required:
+ - localZoneID
+ - rolesRef
+ type: object
+ required:
+ - region
+ - rolesRef
+ type: object
+ azure:
+ description: azure defines azure specific settings
+ properties:
+ azureAuthenticationConfig:
+ description: |-
+ azureAuthenticationConfig is the type of Azure authentication configuration to use to authenticate with Azure's
+ Cloud API.
+ properties:
+ azureAuthenticationConfigType:
+ description: |-
+ azureAuthenticationConfigType is the type of identity configuration used in the Hosted Cluster. This field is
+ used to determine which identity configuration is being used. Valid values are "ManagedIdentities" and
+ "WorkloadIdentities".
+ enum:
+ - ManagedIdentities
+ - WorkloadIdentities
+ type: string
+ managedIdentities:
+ description: |-
+ managedIdentities contains the managed identities needed for HCP control plane and data plane components that
+ authenticate with Azure's API.
+
+ These are required for managed Azure, also known as ARO HCP.
+ properties:
+ controlPlane:
+ description: |-
+ controlPlane contains the client IDs of all the managed identities on the HCP control plane needing to
+ authenticate with Azure's API.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is a pre-existing managed identity associated with the azure cloud provider, aka cloud controller
+ manager.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ controlPlaneOperator:
+ description: controlPlaneOperator is a pre-existing
+ managed identity associated with the control
+ plane operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ disk:
+ description: disk is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ file:
+ description: file is a pre-existing managed identity
+ associated with the azure-disk-controller.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ imageRegistry:
+ description: imageRegistry is a pre-existing managed
+ identity associated with the cluster-image-registry-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ ingress:
+ description: ingress is a pre-existing managed
+ identity associated with the cluster-ingress-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ managedIdentitiesKeyVault:
+ description: |-
+ managedIdentitiesKeyVault contains information on the management cluster's managed identities Azure Key Vault.
+ This Key Vault is where the managed identities certificates are stored. These certificates are pulled out of the
+ Key Vault by the Secrets Store CSI driver and mounted into a volume on control plane pods requiring
+ authentication with Azure API.
+
+ More information on how the Secrets Store CSI driver works to do this can be found here:
+ https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver.
+ properties:
+ name:
+ description: name is the name of the Azure
+ Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ tenantID:
+ description: tenantID is the tenant ID of
+ the Azure Key Vault on the management cluster.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - tenantID
+ type: object
+ network:
+ description: network is a pre-existing managed
+ identity associated with the cluster-network-operator.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ nodePoolManagement:
+ description: nodePoolManagement is a pre-existing
+ managed identity associated with the operator
+ managing the NodePools.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - cloudProvider
+ - controlPlaneOperator
+ - disk
+ - file
+ - ingress
+ - managedIdentitiesKeyVault
+ - network
+ - nodePoolManagement
+ type: object
+ dataPlane:
+ description: |-
+ dataPlane contains the client IDs of all the managed identities on the data plane needing to authenticate with
+ Azure's API.
+ properties:
+ diskMSIClientID:
+ description: diskMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI Disk driver.
+ maxLength: 255
+ type: string
+ fileMSIClientID:
+ description: fileMSIClientID is the client ID
+ of a pre-existing managed identity ID associated
+ with the CSI File driver.
+ maxLength: 255
+ type: string
+ imageRegistryMSIClientID:
+ description: |-
+ imageRegistryMSIClientID is the client ID of a pre-existing managed identity ID associated with the image
+ registry controller.
+ maxLength: 255
+ type: string
+ required:
+ - diskMSIClientID
+ - fileMSIClientID
+ - imageRegistryMSIClientID
+ type: object
+ required:
+ - controlPlane
+ - dataPlane
+ type: object
+ workloadIdentities:
+ description: |-
+ workloadIdentities is a struct of client IDs for each component that needs to authenticate with Azure's API in
+ self-managed Azure. These client IDs are used to authenticate with Azure cloud on both the control plane and data
+ plane.
+
+ This is required for self-managed Azure.
+ properties:
+ cloudProvider:
+ description: |-
+ cloudProvider is the client ID of a federated managed identity, associated with azure-cloud-provider, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ disk:
+ description: |-
+ disk is the client ID of a federated managed identity, associated with cluster-storage-operator-disk,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ file:
+ description: |-
+ file is the client ID of a federated managed identity, associated with cluster-storage-operator-file,
+ used in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ imageRegistry:
+ description: |-
+ imageRegistry is the client ID of a federated managed identity, associated with cluster-image-registry-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ ingress:
+ description: |-
+ ingress is the client ID of a federated managed identity, associated with cluster-ingress-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ network:
+ description: |-
+ network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
+ workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ nodePoolManagement:
+ description: |-
+ nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
+ in workload identity authentication.
+ properties:
+ clientID:
+ description: clientID is client ID of a federated
+ managed identity used in workload identity authentication
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity
+ must be a valid UUID. It should be 5 groups
+ of hyphen separated hexadecimal characters
+ in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ required:
+ - clientID
+ type: object
+ required:
+ - cloudProvider
+ - disk
+ - file
+ - imageRegistry
+ - ingress
+ - network
+ - nodePoolManagement
+ type: object
+ required:
+ - azureAuthenticationConfigType
+ type: object
+ x-kubernetes-validations:
+ - message: managedIdentities is required when azureAuthenticationConfigType
+ is ManagedIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''ManagedIdentities''
+ ? has(self.managedIdentities) : !has(self.managedIdentities)'
+ - message: workloadIdentities is required when azureAuthenticationConfigType
+ is WorkloadIdentities, and forbidden otherwise
+ rule: 'self.azureAuthenticationConfigType == ''WorkloadIdentities''
+ ? has(self.workloadIdentities) : !has(self.workloadIdentities)'
+ cloud:
+ default: AzurePublicCloud
+ description: 'cloud is the cloud environment identifier, valid
+ values could be found here: https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33'
+ enum:
+ - AzurePublicCloud
+ - AzureUSGovernmentCloud
+ - AzureChinaCloud
+ - AzureGermanCloud
+ - AzureStackCloud
+ type: string
+ location:
+ description: |-
+ location is the Azure region in where all the cloud infrastructure resources will be created.
+
+ Example: eastus
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: Location is immutable
+ rule: self == oldSelf
+ resourceGroup:
+ default: default
+ description: |-
+ resourceGroup is the name of an existing resource group where all cloud resources created by the Hosted
+ Cluster are to be placed. The resource group is expected to exist under the same subscription as SubscriptionID.
+
+ In ARO HCP, this will be the managed resource group where customer cloud resources will be created.
+
+ Resource group naming requirements can be found here: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ResourceGroup.Name/.
+
+ Example: if your resource group ID is /subscriptions//resourceGroups/, your
+ ResourceGroupName is .
+ maxLength: 90
+ pattern: ^[a-zA-Z0-9_()\-\.]{1,89}[a-zA-Z0-9_()\-]$
+ type: string
+ x-kubernetes-validations:
+ - message: ResourceGroupName is immutable
+ rule: self == oldSelf
+ securityGroupID:
+ description: |-
+ securityGroupID is the ID of an existing security group on the SubnetID. This field is provided as part of the
+ configuration for the Azure cloud provider, aka Azure cloud controller manager (CCM). This security group is
+ expected to exist under the same subscription as SubscriptionID.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SecurityGroupID is immutable
+ rule: self == oldSelf
+ subnetID:
+ description: |-
+ subnetID is the subnet ID of an existing subnet where the nodes in the nodepool will be created. This can be a
+ different subnet than the one listed in the HostedCluster, HostedCluster.Spec.Platform.Azure.SubnetID, but must
+ exist in the same network, HostedCluster.Spec.Platform.Azure.VnetID, and must exist under the same subscription ID,
+ HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ subnetID is immutable once set.
+ The subnetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The vnetName should be between 2 and 64 characters, consisting only of alphanumeric characters, hyphens, underscores and periods and must not end with either a period (.) or hyphen (-) character.
+ The subnetName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores and must start with an alphanumeric character and must not end with a period (.) or hyphen (-) character.
+ maxLength: 355
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`
+ rule: size(self.split('/')) == 11 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Network/virtualNetworks/.*/subnets/.*$')
+ - message: The resourceGroupName should be between 1 and 90
+ characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the subnetID must not
+ end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The vnetName should be between 2 and 64 characters,
+ consisting only of alphanumeric characters, hyphens, underscores
+ and periods
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_\\.]{2,64}')
+ - message: the vnetName in the subnetID must not end with
+ either a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[8].endsWith(''.'') && !self.split(''/'')[8].endsWith(''-'')'
+ - message: The subnetName should be between 1 and 80 characters,
+ consisting only of alphanumeric characters, hyphens and
+ underscores and must start with an alphanumeric character
+ rule: self.split('/')[10].matches('[a-zA-Z0-9][a-zA-Z0-9-_\\.]{0,79}')
+ - message: the subnetName in the subnetID must not end with
+ a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[10].endsWith(''.'') && !self.split(''/'')[10].endsWith(''-'')'
+ - message: SubnetID is immutable
+ rule: self == oldSelf
+ subscriptionID:
+ description: subscriptionID is a unique identifier for an
+ Azure subscription used to manage resources.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: SubscriptionID is immutable
+ rule: self == oldSelf
+ tenantID:
+ description: tenantID is a unique identifier for the tenant
+ where Azure resources will be created and managed in.
+ maxLength: 255
+ type: string
+ vnetID:
+ description: |-
+ vnetID is the ID of an existing VNET to use in creating VMs. The VNET can exist in a different resource group
+ other than the one specified in ResourceGroupName, but it must exist under the same subscription as
+ SubscriptionID.
+
+ In ARO HCP, this will be the ID of the customer provided VNET.
+
+ Example: /subscriptions//resourceGroups//providers/Microsoft.Network/virtualNetworks/
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: VnetID is immutable
+ rule: self == oldSelf
+ required:
+ - azureAuthenticationConfig
+ - location
+ - resourceGroup
+ - securityGroupID
+ - subnetID
+ - subscriptionID
+ - tenantID
+ - vnetID
+ type: object
+ gcp:
+ description: gcp specifies configuration for clusters running
+ on Google Cloud Platform.
+ properties:
+ endpointAccess:
+ default: Private
+ description: |-
+ endpointAccess controls API endpoint accessibility for the HostedControlPlane on GCP.
+ Allowed values: "Private", "PublicAndPrivate". Defaults to "Private".
+ enum:
+ - PublicAndPrivate
+ - Private
+ type: string
+ networkConfig:
+ description: |-
+ networkConfig specifies VPC configuration for Private Service Connect.
+ Required for VPC configuration in Private Service Connect deployments.
+ properties:
+ network:
+ description: network is the VPC network name
+ properties:
+ name:
+ description: name is the name of the GCP resource
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ required:
+ - name
+ type: object
+ privateServiceConnectSubnet:
+ description: privateServiceConnectSubnet is the subnet
+ for Private Service Connect endpoints
+ properties:
+ name:
+ description: name is the name of the GCP resource
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - network
+ - privateServiceConnectSubnet
+ type: object
+ project:
+ description: |-
+ project is the GCP project ID.
+ A valid project ID must satisfy the following rules:
+ length: Must be between 6 and 30 characters, inclusive
+ characters: Only lowercase letters (`a-z`), digits (`0-9`), and hyphens (`-`) are allowed
+ start and end: Must begin with a lowercase letter and must not end with a hyphen
+ hyphens: No consecutive hyphens are allowed (e.g., "my--project" is invalid)
+ valid examples: "my-project", "my-project-1", "my-project-123".
+ maxLength: 30
+ minLength: 6
+ pattern: ^[a-z]([a-z0-9]*(-[a-z0-9]+)*)?$
+ type: string
+ x-kubernetes-validations:
+ - message: Project is immutable
+ rule: self == oldSelf
+ region:
+ description: |-
+ region is the GCP region in which the cluster resides.
+ A valid region must satisfy the following rules:
+ format: Must be in the form `-`
+ characters: Only lowercase letters (`a-z`), digits (`0-9`), and a single hyphen (`-`) separator
+ valid examples: "us-central1", "europe-west2"
+ region must not include zone suffixes (e.g., "-a").
+ For a full list of valid regions, see: https://cloud.google.com/compute/docs/regions-zones.
+ maxLength: 63
+ pattern: ^[a-z]+-[a-z0-9]+[0-9]$
+ type: string
+ x-kubernetes-validations:
+ - message: Region is immutable
+ rule: self == oldSelf
+ required:
+ - networkConfig
+ - project
+ - region
+ type: object
+ ibmcloud:
+ description: ibmcloud defines IBMCloud specific settings for components
+ properties:
+ providerType:
+ description: providerType is a specific supported infrastructure
+ provider within IBM Cloud.
+ type: string
+ type: object
+ kubevirt:
+ description: kubevirt defines KubeVirt specific settings for cluster
+ components.
+ properties:
+ baseDomainPassthrough:
+ description: |-
+ baseDomainPassthrough toggles whether or not an automatically
+ generated base domain for the guest cluster should be used that
+ is a subdomain of the management cluster's *.apps DNS.
+
+ For the KubeVirt platform, the basedomain can be autogenerated using
+ the *.apps domain of the management/infra hosting cluster
+ This makes the guest cluster's base domain a subdomain of the
+ hypershift infra/mgmt cluster's base domain.
+
+ Example:
+ Infra/Mgmt cluster's DNS
+ Base: example.com
+ Cluster: mgmt-cluster.example.com
+ Apps: *.apps.mgmt-cluster.example.com
+ KubeVirt Guest cluster's DNS
+ Base: apps.mgmt-cluster.example.com
+ Cluster: guest.apps.mgmt-cluster.example.com
+ Apps: *.apps.guest.apps.mgmt-cluster.example.com
+
+ This is possible using OCP wildcard routes
+ type: boolean
+ x-kubernetes-validations:
+ - message: baseDomainPassthrough is immutable
+ rule: self == oldSelf
+ credentials:
+ description: |-
+ credentials defines the client credentials used when creating KubeVirt virtual machines.
+ Defining credentials is only necessary when the KubeVirt virtual machines are being placed
+ on a cluster separate from the one hosting the Hosted Control Plane components.
+
+ The default behavior when Credentials is not defined is for the KubeVirt VMs to be placed on
+ the same cluster and namespace as the Hosted Control Plane.
+ properties:
+ infraKubeConfigSecret:
+ description: |-
+ infraKubeConfigSecret is a reference to the secret containing the kubeconfig
+ of an external infrastructure cluster for kubevirt provider
+ properties:
+ key:
+ description: key is the key in the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: infraKubeConfigSecret is immutable
+ rule: self == oldSelf
+ infraNamespace:
+ description: |-
+ infraNamespace is the namespace in the external infrastructure cluster
+ where kubevirt resources will be created
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: infraNamespace is immutable
+ rule: self == oldSelf
+ required:
+ - infraNamespace
+ type: object
+ generateID:
+ description: |-
+ generateID is used to uniquely apply a name suffix to resources associated with
+ kubevirt infrastructure resources
+ maxLength: 11
+ type: string
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is immutable once set
+ rule: self == oldSelf
+ storageDriver:
+ description: |-
+ storageDriver defines how the KubeVirt CSI driver exposes StorageClasses on
+ the infra cluster (hosting the VMs) to the guest cluster.
+ properties:
+ manual:
+ description: |-
+ manual is used to explicitly define how the infra storageclasses are
+ mapped to guest storageclasses
+ properties:
+ storageClassMapping:
+ description: |-
+ storageClassMapping maps StorageClasses on the infra cluster hosting
+ the KubeVirt VMs to StorageClasses that are made available within the
+ Guest Cluster.
+
+ NOTE: It is possible that not all capabilities of an infra cluster's
+ storageclass will be present for the corresponding guest clusters storageclass.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestStorageClassName:
+ description: |-
+ guestStorageClassName is the name that the corresponding storageclass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraStorageClassName:
+ description: |-
+ infraStorageClassName is the name of the infra cluster storage class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestStorageClassName
+ - infraStorageClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: storageClassMapping is immutable
+ rule: self == oldSelf
+ volumeSnapshotClassMapping:
+ description: |-
+ volumeSnapshotClassMapping maps VolumeSnapshotClasses on the infra cluster hosting
+ the KubeVirt VMs to VolumeSnapshotClasses that are made available within the
+ Guest Cluster.
+ items:
+ properties:
+ group:
+ description: group contains which group this
+ mapping belongs to.
+ maxLength: 255
+ type: string
+ guestVolumeSnapshotClassName:
+ description: |-
+ guestVolumeSnapshotClassName is the name that the corresponding volumeSnapshotClass will
+ be called within the guest cluster
+ maxLength: 255
+ type: string
+ infraVolumeSnapshotClassName:
+ description: |-
+ infraVolumeSnapshotClassName is the name of the infra cluster volume snapshot class that
+ will be exposed to the guest.
+ maxLength: 255
+ type: string
+ required:
+ - guestVolumeSnapshotClassName
+ - infraVolumeSnapshotClassName
+ type: object
+ maxItems: 50
+ type: array
+ x-kubernetes-validations:
+ - message: volumeSnapshotClassMapping is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver.Manual is immutable
+ rule: self == oldSelf
+ type:
+ default: Default
+ description: type represents the type of kubevirt csi
+ driver configuration to use
+ enum:
+ - None
+ - Default
+ - Manual
+ type: string
+ x-kubernetes-validations:
+ - message: storageDriver.Type is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: storageDriver is immutable
+ rule: self == oldSelf
+ type: object
+ x-kubernetes-validations:
+ - message: Kubevirt GenerateID is required once set
+ rule: '!has(oldSelf.generateID) || has(self.generateID)'
+ openstack:
+ description: openstack specifies configuration for clusters running
+ on OpenStack.
+ properties:
+ disableExternalNetwork:
+ description: |-
+ disableExternalNetwork specifies whether or not to attempt to connect the cluster
+ to an external network. This allows for the creation of clusters when connecting
+ to an external network is not possible or desirable, e.g. if using a provider network.
+ type: boolean
+ externalNetwork:
+ description: |-
+ externalNetwork is the OpenStack Network to be used to get public internet to the VMs.
+ This option is ignored if DisableExternalNetwork is set to true.
+
+ If ExternalNetwork is defined it must refer to exactly one external network.
+
+ If ExternalNetwork is not defined or is empty the controller will use any
+ existing external network as long as there is only one. It is an
+ error if ExternalNetwork is not defined and there are multiple
+ external networks unless DisableExternalNetwork is also set.
+
+ If ExternalNetwork is not defined and there are no external networks
+ the controller will proceed as though DisableExternalNetwork was set.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ network. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ network to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the network to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the network
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the network to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ identityRef:
+ description: |-
+ identityRef is a reference to a secret holding OpenStack credentials
+ to be used when reconciling the hosted cluster.
+ properties:
+ cloudName:
+ description: cloudName specifies the name of the entry
+ in the clouds.yaml file to use.
+ maxLength: 255
+ type: string
+ name:
+ description: |-
+ name is the name of a secret in the same namespace as the resource being provisioned.
+ The secret must contain a key named `clouds.yaml` which contains an OpenStack clouds.yaml file.
+ The secret may optionally contain a key named `cacert` containing a PEM-encoded CA certificate.
+ maxLength: 255
+ type: string
+ required:
+ - cloudName
+ - name
+ type: object
+ ingressFloatingIP:
+ description: |-
+ ingressFloatingIP is an available floating IP in your OpenStack cluster that will
+ be associated with the OpenShift ingress port.
+ When not specified, an IP address will be assigned randomly by the OpenStack cloud provider.
+ When specified, the floating IP has to be pre-created. If the
+ specified value is not a floating IP or is already claimed, the
+ OpenStack cloud provider won't be able to provision the load
+ balancer.
+ This value must be a valid IPv4 or IPv6 address.
+ maxLength: 45
+ type: string
+ x-kubernetes-validations:
+ - message: floatingIP must be a valid IPv4 or IPv6 address
+ rule: isIP(self)
+ managedSubnets:
+ description: |-
+ managedSubnets describe the OpenStack Subnet to be created. Cluster actuator will create a network,
+ and a subnet with the defined DNSNameservers, AllocationPools and the CIDR defined in the HostedCluster
+ MachineNetwork, and a router connected to the subnet. Currently only one IPv4
+ subnet is supported.
+ items:
+ properties:
+ allocationPools:
+ description: |-
+ allocationPools is an array of AllocationPool objects that will be applied to OpenStack Subnet being created.
+ If set, OpenStack will only allocate these IPs for Machines. It will still be possible to create ports from
+ outside of these ranges manually.
+ items:
+ properties:
+ end:
+ description: end represents the end of the AlloctionPool,
+ that is the highest IP of the pool.
+ maxLength: 255
+ type: string
+ start:
+ description: start represents the start of the
+ AllocationPool, that is the lowest IP of the
+ pool.
+ maxLength: 255
+ type: string
+ required:
+ - end
+ - start
+ type: object
+ maxItems: 10
+ type: array
+ dnsNameservers:
+ description: |-
+ dnsNameservers holds a list of DNS server addresses that will be provided when creating
+ the subnet. These addresses need to have the same IP version as CIDR.
+ items:
+ maxLength: 45
+ type: string
+ maxItems: 10
+ type: array
+ type: object
+ maxItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ network:
+ description: |-
+ network specifies an existing network to use if no ManagedSubnets
+ are specified.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ network. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ network to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the network to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the network
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the network to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ networkMTU:
+ description: networkMTU is the MTU for the network.
+ maximum: 9000
+ minimum: 1500
+ type: integer
+ router:
+ description: |-
+ router specifies an existing router to be used if ManagedSubnets are
+ specified. If specified, no new router will be created.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select an OpenStack
+ router. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description of the
+ router to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the router to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the router
+ to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the router to use. If ID
+ is provided, the other filters cannot be provided. Must
+ be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ subnets:
+ description: |-
+ subnets specifies existing subnets to use if not ManagedSubnets are
+ specified. All subnets must be in the network specified by Network.
+ There can be zero, one, or two subnets. If no subnets are specified,
+ all subnets in Network will be used. If 2 subnets are specified, one
+ must be IPv4 and the other IPv6.
+ items:
+ description: SubnetParam specifies an OpenStack subnet to
+ use. It may be specified by either ID or filter, but not
+ both.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select the
+ subnet. It must match exactly one subnet.
+ minProperties: 1
+ properties:
+ cidr:
+ description: cidr is the CIDR of the subnet to filter
+ by.
+ maxLength: 45
+ type: string
+ description:
+ description: description is the description of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ gatewayIP:
+ description: gatewayIP is the gateway IP of the
+ subnet to filter by.
+ maxLength: 45
+ type: string
+ ipVersion:
+ description: ipVersion is the IP version of the
+ subnet to filter by.
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ ipv6AddressMode:
+ description: ipv6AddressMode is the IPv6 address
+ mode of the subnet to filter by.
+ maxLength: 255
+ type: string
+ ipv6RAMode:
+ description: ipv6RAMode is the IPv6 RA mode of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the subnet to filter
+ by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of the
+ subnet to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the uuid of the subnet. It will not
+ be validated.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ maxItems: 2
+ type: array
+ x-kubernetes-list-type: atomic
+ tags:
+ description: tags to set on all resources in cluster which
+ support tags
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - identityRef
+ type: object
+ powervs:
+ description: |-
+ powervs specifies configuration for clusters running on IBMCloud Power VS Service.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ accountID:
+ description: |-
+ accountID is the IBMCloud account id.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ cisInstanceCRN:
+ description: |-
+ cisInstanceCRN is the IBMCloud CIS Service Instance's Cloud Resource Name
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ pattern: '^crn:'
+ type: string
+ imageRegistryOperatorCloudCreds:
+ description: |-
+ imageRegistryOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for image registry operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ ingressOperatorCloudCreds:
+ description: |-
+ ingressOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for ingress operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ kubeCloudControllerCreds:
+ description: |
+ kubeCloudControllerCreds is a reference to a secret containing cloud
+ credentials with permissions matching the cloud controller policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ nodePoolManagementCreds:
+ description: |
+ nodePoolManagementCreds is a reference to a secret containing cloud
+ credentials with permissions matching the node pool management policy.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ region:
+ description: |-
+ region is the IBMCloud region in which the cluster resides. This configures the
+ OCP control plane cloud integrations, and is used by NodePool to resolve
+ the correct boot image for a given release.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ resourceGroup:
+ description: |-
+ resourceGroup is the IBMCloud Resource Group in which the cluster resides.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ serviceInstanceID:
+ description: |-
+ serviceInstanceID is the reference to the Power VS service on which the server instance(VM) will be created.
+ Power VS service is a container for all Power VS instances at a specific geographic region.
+ serviceInstance can be created via IBM Cloud catalog or CLI.
+ ServiceInstanceID is the unique identifier that can be obtained from IBM Cloud UI or IBM Cloud cli.
+
+ More detail about Power VS service instance.
+ https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-creating-power-virtual-server
+
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ storageOperatorCloudCreds:
+ description: |-
+ storageOperatorCloudCreds is a reference to a secret containing ibm cloud
+ credentials for storage operator to get authenticated with ibm cloud.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ subnet:
+ description: |-
+ subnet is the subnet to use for control plane cloud resources.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ name:
+ description: name of resource
+ maxLength: 255
+ type: string
+ type: object
+ vpc:
+ description: |-
+ vpc specifies IBM Cloud PowerVS Load Balancing configuration for the control
+ plane.
+ This field is immutable. Once set, It can't be changed.
+ properties:
+ name:
+ description: |-
+ name for VPC to used for all the service load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ region:
+ description: |-
+ region is the IBMCloud region in which VPC gets created, this VPC used for all the ingress traffic
+ into the OCP cluster.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ subnet:
+ description: |-
+ subnet is the subnet to use for load balancer.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ zone:
+ description: |-
+ zone is the availability zone where load balancer cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - name
+ - region
+ type: object
+ zone:
+ description: |-
+ zone is the availability zone where control plane cloud resources are
+ created.
+ This field is immutable. Once set, It can't be changed.
+ maxLength: 255
+ type: string
+ required:
+ - accountID
+ - cisInstanceCRN
+ - imageRegistryOperatorCloudCreds
+ - ingressOperatorCloudCreds
+ - kubeCloudControllerCreds
+ - nodePoolManagementCreds
+ - region
+ - resourceGroup
+ - serviceInstanceID
+ - storageOperatorCloudCreds
+ - subnet
+ - vpc
+ - zone
+ type: object
+ type:
+ description: type is the type of infrastructure provider for the
+ cluster.
+ enum:
+ - AWS
+ - Azure
+ - IBMCloud
+ - KubeVirt
+ - Agent
+ - PowerVS
+ - None
+ - OpenStack
+ - GCP
+ maxLength: 100
+ type: string
+ x-kubernetes-validations:
+ - message: Type is immutable
+ rule: self == oldSelf
+ required:
+ - type
+ type: object
+ pullSecret:
+ description: pullSecret is a reference to a secret containing the
+ pull secret for the hosted control plane.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ releaseImage:
+ description: releaseImage is the release image applied to the hosted
+ control plane.
+ maxLength: 255
+ type: string
+ secretEncryption:
+ description: |-
+ secretEncryption contains metadata about the kubernetes secret encryption strategy being used for the
+ cluster when applicable.
+ properties:
+ aescbc:
+ description: aescbc defines metadata about the AESCBC secret encryption
+ strategy
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to encrypt
+ new secrets
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - activeKey
+ type: object
+ kms:
+ description: kms defines metadata about the kms secret encryption
+ strategy
+ properties:
+ aws:
+ description: aws defines metadata about the configuration
+ of the AWS KMS Secret Encryption provider
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ auth:
+ description: auth defines metadata about the management
+ of credentials used to interact with AWS KMS
+ properties:
+ awsKms:
+ description: "awsKms is an ARN value referencing a
+ role appropriate for managing the auth via the AWS
+ KMS key.\n\nThe following is an example of a valid
+ policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
+ [\n \t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
+ [\n\t\t\t\t\"kms:Encrypt\",\n\t\t\t\t\"kms:Decrypt\",\n\t\t\t\t\"kms:ReEncrypt*\",\n\t\t\t\t\"kms:GenerateDataKey*\",\n\t\t\t\t\"kms:DescribeKey\"\n\t\t\t],\n\t\t\t\"Resource\":
+ %q\n\t\t}\n\t]\n}"
+ maxLength: 2048
+ type: string
+ required:
+ - awsKms
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ arn:
+ description: arn is the Amazon Resource Name for the
+ encryption key
+ maxLength: 2048
+ pattern: '^arn:'
+ type: string
+ required:
+ - arn
+ type: object
+ region:
+ description: region contains the AWS region
+ maxLength: 255
+ type: string
+ required:
+ - activeKey
+ - auth
+ - region
+ type: object
+ azure:
+ description: azure defines metadata about the configuration
+ of the Azure KMS Secret Encryption provider using Azure
+ key vault
+ properties:
+ activeKey:
+ description: activeKey defines the active key used to
+ encrypt new secrets
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ backupKey:
+ description: |-
+ backupKey defines the old key during the rotation process so previously created
+ secrets can continue to be decrypted until they are all re-encrypted with the active key.
+ properties:
+ keyName:
+ description: keyName is the name of the keyvault key
+ used for encrypt/decrypt
+ maxLength: 255
+ type: string
+ keyVaultName:
+ description: |-
+ keyVaultName is the name of the keyvault. Must match criteria specified at https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name
+ Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
+ `az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn `
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: keyVersion contains the version of the
+ key to use
+ maxLength: 255
+ type: string
+ required:
+ - keyName
+ - keyVaultName
+ - keyVersion
+ type: object
+ kms:
+ description: kms is a pre-existing managed identity used
+ to authenticate with Azure KMS.
+ properties:
+ clientID:
+ description: |-
+ clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
+ mainly used for CI purposes.
+ maxLength: 36
+ minLength: 36
+ pattern: ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$
+ type: string
+ x-kubernetes-validations:
+ - message: the client ID of a managed identity must
+ be a valid UUID. It should be 5 groups of hyphen
+ separated hexadecimal characters in the form 8-4-4-4-12.
+ rule: self.matches('^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$')
+ credentialsSecretName:
+ description: |-
+ credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
+ format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
+ ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.
+
+ More info on this struct can be found here - https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156.
+
+ credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
+ credentialsSecretName must also be unique within the Azure Key Vault. See more details here - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/.
+ maxLength: 127
+ minLength: 1
+ pattern: ^[a-zA-Z0-9-]+$
+ type: string
+ objectEncoding:
+ allOf:
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ - enum:
+ - utf-8
+ - hex
+ - base64
+ default: utf-8
+ description: |-
+ objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
+ the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
+ Azure Key Vault. If objectEncoding doesn't match the encoding format of the certificate, the certificate will
+ unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
+ SecretProviderClass custom resource related to the managed identity.
+
+ The default value is utf-8.
+
+ See this for more info - https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md
+ type: string
+ required:
+ - credentialsSecretName
+ - objectEncoding
+ type: object
+ required:
+ - activeKey
+ - kms
+ type: object
+ ibmcloud:
+ description: ibmcloud defines metadata for the IBM Cloud KMS
+ encryption strategy
+ properties:
+ auth:
+ description: auth defines metadata for how authentication
+ is done with IBM Cloud KMS
+ properties:
+ managed:
+ description: |-
+ managed defines metadata around the service to service authentication strategy for the IBM Cloud
+ KMS system (all provider managed).
+ type: object
+ type:
+ description: type defines the IBM Cloud KMS authentication
+ strategy
+ enum:
+ - Managed
+ - Unmanaged
+ type: string
+ unmanaged:
+ description: unmanaged defines the auth metadata the
+ customer provides to interact with IBM Cloud KMS
+ properties:
+ credentials:
+ description: |-
+ credentials should reference a secret with a key field of IBMCloudIAMAPIKeySecretKey that contains a apikey to
+ call IBM Cloud KMS APIs
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ required:
+ - credentials
+ type: object
+ required:
+ - type
+ type: object
+ keyList:
+ description: keyList defines the list of keys used for
+ data encryption
+ items:
+ description: IBMCloudKMSKeyEntry defines metadata for
+ an IBM Cloud KMS encryption key
+ properties:
+ correlationID:
+ description: correlationID is an identifier used
+ to track all api call usage from hypershift
+ maxLength: 255
+ type: string
+ crkID:
+ description: crkID is the customer rook key id
+ maxLength: 255
+ type: string
+ instanceID:
+ description: instanceID is the id for the key protect
+ instance
+ maxLength: 255
+ type: string
+ keyVersion:
+ description: |-
+ keyVersion is a unique number associated with the key. The number increments whenever a new
+ key is enabled for data encryption.
+ maximum: 2147483647
+ minimum: 0
+ type: integer
+ url:
+ description: url is the url to call key protect
+ apis over
+ maxLength: 2048
+ pattern: ^https://
+ type: string
+ required:
+ - correlationID
+ - crkID
+ - instanceID
+ - keyVersion
+ - url
+ type: object
+ maxItems: 100
+ type: array
+ region:
+ description: region is the IBM Cloud region
+ maxLength: 255
+ type: string
+ required:
+ - auth
+ - keyList
+ - region
+ type: object
+ provider:
+ description: provider defines the KMS provider
+ enum:
+ - IBMCloud
+ - AWS
+ - Azure
+ type: string
+ required:
+ - provider
+ type: object
+ type:
+ description: type defines the type of kube secret encryption being
+ used
+ enum:
+ - kms
+ - aescbc
+ type: string
+ required:
+ - type
+ type: object
+ serviceAccountSigningKey:
+ description: |-
+ serviceAccountSigningKey is a reference to a secret containing the private key
+ used by the service account token issuer. The secret is expected to contain
+ a single key named "key". If not specified, a service account signing key will
+ be generated automatically for the cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ services:
+ description: |-
+ services defines metadata about how control plane services are published
+ in the management cluster.
+ items:
+ description: |-
+ ServicePublishingStrategyMapping specifies how individual control plane services endpoints are published for consumption.
+ This includes APIServer;OAuthServer;Konnectivity;Ignition.
+ If a given service is not present in this list, it will be exposed publicly by default.
+ properties:
+ service:
+ description: |-
+ service identifies the type of service being published.
+ It can be APIServer;OAuthServer;Konnectivity;Ignition
+ OVNSbDb;OIDC are no-op and kept for backward compatibility.
+ This field is immutable.
+ enum:
+ - APIServer
+ - OAuthServer
+ - OIDC
+ - Konnectivity
+ - Ignition
+ - OVNSbDb
+ type: string
+ servicePublishingStrategy:
+ description: servicePublishingStrategy specifies how to publish
+ a service endpoint.
+ properties:
+ loadBalancer:
+ description: loadBalancer configures exposing a service
+ using a dedicated LoadBalancer.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the LoadBalancer and passed through to consumers of the service.
+ If omitted, the value will be inferred from the corev1.Service Load balancer type .status.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ nodePort:
+ description: nodePort configures exposing a service using
+ a NodePort.
+ properties:
+ address:
+ description: address is the host/ip that the NodePort
+ service is exposed over.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: address must be a valid hostname, IPv4, or
+ IPv6 address
+ rule: self.matches('^(([a-zA-Z0-9][-a-zA-Z0-9]*\\.)+[a-zA-Z]{2,}|localhost)$')
+ || self.matches('^((\\d{1,3}\\.){3}\\d{1,3})$')
+ || self.matches('^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$')
+ port:
+ description: |-
+ port is the port of the NodePort service. If <=0, the port is dynamically
+ assigned when the service is created.
+ format: int32
+ type: integer
+ required:
+ - address
+ type: object
+ route:
+ description: |-
+ route configures exposing a service using a Route through and an ingress controller behind a cloud Load Balancer.
+ The specifics of the setup are platform dependent.
+ properties:
+ hostname:
+ description: |-
+ hostname is the name of the DNS record that will be created pointing to the Route and passed through to consumers of the service.
+ If omitted, the value will be inferred from management ingress.Spec.Domain.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: hostname must be a valid domain name (e.g.,
+ example.com)
+ rule: self.matches('^(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}$')
+ type: object
+ type:
+ description: |-
+ type is the publishing strategy used for the service.
+ It can be LoadBalancer;NodePort;Route;None;S3
+ enum:
+ - LoadBalancer
+ - NodePort
+ - Route
+ - None
+ - S3
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: nodePort is required when type is NodePort, and forbidden
+ otherwise
+ rule: 'self.type == ''NodePort'' ? has(self.nodePort) : !has(self.nodePort)'
+ - message: only route is allowed when type is Route, and forbidden
+ otherwise
+ rule: 'self.type == ''Route'' ? !has(self.nodePort) && !has(self.loadBalancer)
+ : !has(self.route)'
+ - message: only loadBalancer is required when type is LoadBalancer,
+ and forbidden otherwise
+ rule: 'self.type == ''LoadBalancer'' ? !has(self.nodePort)
+ && !has(self.route) : !has(self.loadBalancer)'
+ - message: None does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''None'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ - message: S3 does not allowed any configuration for loadBalancer,
+ nodePort, or route
+ rule: 'self.type == ''S3'' ? !has(self.nodePort) && !has(self.route)
+ && !has(self.loadBalancer) : true'
+ required:
+ - service
+ - servicePublishingStrategy
+ type: object
+ maxItems: 6
+ type: array
+ sshKey:
+ description: sshKey is a reference to a secret containing the SSH
+ key for the hosted control plane.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ tolerations:
+ description: tolerations when specified, define what custom tolerations
+ are added to the hcp pods.
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists and Equal. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ maxItems: 25
+ type: array
+ updateService:
+ description: |-
+ updateService may be used to specify the preferred upstream update service.
+ By default it will use the appropriate update service for the cluster and region.
+ type: string
+ required:
+ - dns
+ - etcd
+ - infraID
+ - issuerURL
+ - platform
+ - pullSecret
+ - releaseImage
+ - services
+ - sshKey
+ type: object
+ x-kubernetes-validations:
+ - message: spec.services in body should have at least 4 items or 3 for
+ IBMCloud
+ rule: 'self.platform.type == ''IBMCloud'' ? size(self.services) >= 3
+ : size(self.services) >= 4'
+ - message: disableMultiNetwork can only be set to true when networkType
+ is 'Other'
+ rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)
+ || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork)
+ || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork
+ || self.networking.networkType == ''Other'''
+ status:
+ description: status is the status of the HostedControlPlane.
+ properties:
+ conditions:
+ description: |-
+ conditions contains details for one aspect of the current state of the HostedControlPlane.
+ Current condition types are: "Available"
+ items:
+ description: Condition contains details for one aspect of the current
+ state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ configuration:
+ description: configuration contains the cluster configuration status
+ of the HostedCluster
+ properties:
+ authentication:
+ description: |-
+ authentication contains the observed authentication configuration status from the hosted cluster.
+ This field reflects the current state of the cluster authentication including OAuth metadata,
+ OIDC client status, and other authentication-related configurations.
+ properties:
+ integratedOAuthMetadata:
+ description: |-
+ integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
+ Authorization Server Metadata for the in-cluster integrated OAuth server.
+ This discovery document can be viewed from its served location:
+ oc get --raw '/.well-known/oauth-authorization-server'
+ For further details, see the IETF Draft:
+ https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
+ This contains the observed value based on cluster state.
+ An explicitly set value in spec.oauthMetadata has precedence over this field.
+ This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
+ The key "oauthMetadata" is used to locate the data.
+ If the config map or expected key is not found, no metadata is served.
+ If the specified metadata is not valid, no metadata is served.
+ The namespace for this config map is openshift-config-managed.
+ properties:
+ name:
+ description: name is the metadata.name of the referenced
+ config map
+ type: string
+ required:
+ - name
+ type: object
+ oidcClients:
+ description: |-
+ oidcClients is where participating operators place the current OIDC client status
+ for OIDC clients that can be customized by the cluster-admin.
+ items:
+ description: |-
+ OIDCClientStatus represents the current state
+ of platform components and how they interact with
+ the configured identity providers.
+ properties:
+ componentName:
+ description: |-
+ componentName is a required field that specifies the name of the platform
+ component using the identity provider as an authentication mode.
+ It is used in combination with componentNamespace as a unique identifier.
+
+ componentName must not be an empty string ("") and must not exceed 256 characters in length.
+ maxLength: 256
+ minLength: 1
+ type: string
+ componentNamespace:
+ description: |-
+ componentNamespace is a required field that specifies the namespace in which the
+ platform component using the identity provider as an authentication
+ mode is running.
+ It is used in combination with componentName as a unique identifier.
+
+ componentNamespace must not be an empty string ("") and must not exceed 63 characters in length.
+ maxLength: 63
+ minLength: 1
+ type: string
+ conditions:
+ description: |-
+ conditions are used to communicate the state of the `oidcClients` entry.
+
+ Supported conditions include Available, Degraded and Progressing.
+
+ If Available is true, the component is successfully using the configured client.
+ If Degraded is true, that means something has gone wrong trying to handle the client configuration.
+ If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or
+ in foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ consumingUsers:
+ description: |-
+ consumingUsers is an optional list of ServiceAccounts requiring
+ read permissions on the `clientSecret` secret.
+
+ consumingUsers must not exceed 5 entries.
+ items:
+ description: ConsumingUser is an alias for string
+ which we add validation to. Currently only service
+ accounts are supported.
+ maxLength: 512
+ minLength: 1
+ pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ maxItems: 5
+ type: array
+ x-kubernetes-list-type: set
+ currentOIDCClients:
+ description: |-
+ currentOIDCClients is an optional list of clients that the component is currently using.
+ Entries must have unique issuerURL/clientID pairs.
+ items:
+ description: |-
+ OIDCClientReference is a reference to a platform component
+ client configuration.
+ properties:
+ clientID:
+ description: |-
+ clientID is a required field that specifies the client identifier, from
+ the identity provider, that the platform component is using for authentication
+ requests made to the identity provider.
+
+ clientID must not be empty.
+ minLength: 1
+ type: string
+ issuerURL:
+ description: |-
+ issuerURL is a required field that specifies the URL of the identity
+ provider that this client is configured to make requests against.
+
+ issuerURL must use the 'https' scheme.
+ pattern: ^https:\/\/[^\s]
+ type: string
+ oidcProviderName:
+ description: |-
+ oidcProviderName is a required reference to the 'name' of the identity provider
+ configured in 'oidcProviders' that this client is associated with.
+
+ oidcProviderName must not be an empty string ("").
+ minLength: 1
+ type: string
+ required:
+ - clientID
+ - issuerURL
+ - oidcProviderName
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - issuerURL
+ - clientID
+ x-kubernetes-list-type: map
+ required:
+ - componentName
+ - componentNamespace
+ type: object
+ maxItems: 20
+ type: array
+ x-kubernetes-list-map-keys:
+ - componentNamespace
+ - componentName
+ x-kubernetes-list-type: map
+ type: object
+ type: object
+ controlPlaneEndpoint:
+ description: |-
+ controlPlaneEndpoint contains the endpoint information by which
+ external clients can access the control plane. This is populated
+ after the infrastructure is ready.
+ properties:
+ host:
+ description: host is the hostname on which the API server is serving.
+ maxLength: 255
+ type: string
+ port:
+ description: port is the port on which the API server is serving.
+ format: int32
+ type: integer
+ required:
+ - host
+ - port
+ type: object
+ customKubeconfig:
+ description: |-
+ customKubeconfig references an external custom kubeconfig secret.
+ This field is populated in the status when a custom kubeconfig secret has been generated
+ for the hosted cluster. It contains the name and key of the secret located in the
+ hostedCluster namespace. This field is only populated when kubeApiExternalName is set.
+ If this field is removed during a day 2 operation, the referenced secret will be deleted
+ and this field will be removed from the hostedCluster status.
+ properties:
+ key:
+ description: key is the key in the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ externalManagedControlPlane:
+ default: true
+ description: |-
+ externalManagedControlPlane indicates to cluster-api that the control plane
+ is managed by an external service.
+ https://github.com/kubernetes-sigs/cluster-api/blob/65e5385bffd71bf4aad3cf34a537f11b217c7fab/controllers/machine_controller.go#L468
+ type: boolean
+ initialized:
+ default: false
+ description: |-
+ initialized denotes whether or not the control plane has
+ provided a kubeadm-config.
+ Once this condition is marked true, its value is never changed. See the Ready condition for an indication of
+ the current readiness of the cluster's control plane.
+ This satisfies CAPI contract https://github.com/kubernetes-sigs/cluster-api/blob/cd3a694deac89d5ebeb888307deaa61487207aa0/controllers/cluster_controller_phases.go#L238-L252
+ type: boolean
+ kubeConfig:
+ description: |-
+ kubeConfig is a reference to the secret containing the default kubeconfig
+ for this control plane.
+ properties:
+ key:
+ description: key is the key in the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ kubeadminPassword:
+ description: |-
+ kubeadminPassword is a reference to the secret containing the initial kubeadmin password
+ for the guest cluster.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ lastReleaseImageTransitionTime:
+ description: |-
+ lastReleaseImageTransitionTime is the time of the last update to the current
+ releaseImage property.
+
+ Deprecated: Use versionStatus.history[0].startedTime instead.
+ format: date-time
+ type: string
+ nodeCount:
+ description: nodeCount tracks the number of nodes in the HostedControlPlane.
+ type: integer
+ oauthCallbackURLTemplate:
+ description: |-
+ oauthCallbackURLTemplate contains a template for the URL to use as a callback
+ for identity providers. The [identity-provider-name] placeholder must be replaced
+ with the name of an identity provider defined on the HostedCluster.
+ This is populated after the infrastructure is ready.
+ maxLength: 255
+ type: string
+ platform:
+ description: platform contains platform-specific status of the HostedCluster
+ properties:
+ aws:
+ description: aws contains platform-specific status for AWS
+ properties:
+ defaultWorkerSecurityGroupID:
+ description: |-
+ defaultWorkerSecurityGroupID is the ID of a security group created by
+ the control plane operator. It is always added to worker machines in
+ addition to any security groups specified in the NodePool.
+ maxLength: 255
+ type: string
+ type: object
+ type: object
+ ready:
+ default: false
+ description: |-
+ ready denotes that the HostedControlPlane API Server is ready to
+ receive requests
+ This satisfies CAPI contract https://github.com/kubernetes-sigs/cluster-api/blob/cd3a694deac89d5ebeb888307deaa61487207aa0/controllers/cluster_controller_phases.go#L226-L230
+ type: boolean
+ releaseImage:
+ description: |-
+ releaseImage is the release image applied to the hosted control plane.
+
+ Deprecated: Use versionStatus.desired.image instead.
+ maxLength: 255
+ type: string
+ version:
+ description: |-
+ version is the semantic version of the release applied by
+ the hosted control plane operator
+
+ Deprecated: Use versionStatus.desired.version instead.
+ maxLength: 255
+ type: string
+ versionStatus:
+ description: |-
+ versionStatus is the status of the release version applied by the
+ hosted control plane operator.
+ properties:
+ availableUpdates:
+ description: |-
+ availableUpdates contains updates recommended for this
+ cluster. Updates which appear in conditionalUpdates but not in
+ availableUpdates may expose this cluster to known issues. This list
+ may be empty if no updates are recommended, if the update service
+ is unavailable, or if an invalid channel has been specified.
+ items:
+ description: Release represents an OpenShift release image and
+ associated metadata.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ maxItems: 100
+ nullable: true
+ type: array
+ conditionalUpdates:
+ description: |-
+ conditionalUpdates contains the list of updates that may be
+ recommended for this cluster if it meets specific required
+ conditions. Consumers interested in the set of updates that are
+ actually recommended for this cluster should use
+ availableUpdates. This list may be empty if no updates are
+ recommended, if the update service is unavailable, or if an empty
+ or invalid channel has been specified.
+ items:
+ description: |-
+ ConditionalUpdate represents an update which is recommended to some
+ clusters on the version the current cluster is reconciling, but which
+ may not be recommended for the current cluster.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the observations of the conditional update's
+ current status. Known types are:
+ * Recommended, for whether the update is recommended for the current cluster.
+ items:
+ description: Condition contains details for one aspect
+ of the current state of this API Resource.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This may be an empty string.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: |-
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+ For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+ with respect to the current state of the instance.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+ Producers of specific condition types may define expected values and meanings for this field,
+ and whether the values are considered a guaranteed API.
+ The value should be a CamelCase string.
+ This field may not be empty.
+ maxLength: 1024
+ minLength: 1
+ pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+ type: string
+ status:
+ description: status of the condition, one of True,
+ False, Unknown.
+ enum:
+ - "True"
+ - "False"
+ - Unknown
+ type: string
+ type:
+ description: type of condition in CamelCase or in
+ foo.example.com/CamelCase.
+ maxLength: 316
+ pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+ type: string
+ required:
+ - lastTransitionTime
+ - message
+ - reason
+ - status
+ - type
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - type
+ x-kubernetes-list-type: map
+ release:
+ description: release is the target of the update.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ risks:
+ description: |-
+ risks represents the range of issues associated with
+ updating to the target release. The cluster-version
+ operator will evaluate all entries, and only recommend the
+ update if there is at least one entry and all entries
+ recommend the update.
+ items:
+ description: |-
+ ConditionalUpdateRisk represents a reason and cluster-state
+ for not recommending a conditional update.
+ properties:
+ matchingRules:
+ description: |-
+ matchingRules is a slice of conditions for deciding which
+ clusters match the risk and which do not. The slice is
+ ordered by decreasing precedence. The cluster-version
+ operator will walk the slice in order, and stop after the
+ first it can successfully evaluate. If no condition can be
+ successfully evaluated, the update will not be recommended.
+ items:
+ description: |-
+ ClusterCondition is a union of typed cluster conditions. The 'type'
+ property determines which of the type-specific properties are relevant.
+ When evaluated on a cluster, the condition may match, not match, or
+ fail to evaluate.
+ properties:
+ promql:
+ description: promql represents a cluster condition
+ based on PromQL.
+ properties:
+ promql:
+ description: |-
+ promql is a PromQL query classifying clusters. This query
+ query should return a 1 in the match case and a 0 in the
+ does-not-match case. Queries which return no time
+ series, or which return values besides 0 or 1, are
+ evaluation failures.
+ type: string
+ required:
+ - promql
+ type: object
+ type:
+ description: |-
+ type represents the cluster-condition type. This defines
+ the members and semantics of any additional properties.
+ enum:
+ - Always
+ - PromQL
+ type: string
+ required:
+ - type
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-type: atomic
+ message:
+ description: |-
+ message provides additional information about the risk of
+ updating, in the event that matchingRules match the cluster
+ state. This is only to be consumed by humans. It may
+ contain Line Feed characters (U+000A), which should be
+ rendered as new lines.
+ minLength: 1
+ type: string
+ name:
+ description: |-
+ name is the CamelCase reason for not recommending a
+ conditional update, in the event that matchingRules match the
+ cluster state.
+ minLength: 1
+ type: string
+ url:
+ description: url contains information about this risk.
+ format: uri
+ minLength: 1
+ type: string
+ required:
+ - matchingRules
+ - message
+ - name
+ - url
+ type: object
+ minItems: 1
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ required:
+ - release
+ - risks
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-type: atomic
+ desired:
+ description: |-
+ desired is the version that the cluster is reconciling towards.
+ If the cluster is not yet fully initialized desired will be set
+ with the information available, which may be an image or a tag.
+ properties:
+ channels:
+ description: |-
+ channels is the set of Cincinnati channels to which the release
+ currently belongs.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: set
+ image:
+ description: |-
+ image is a container image location that contains the update. When this
+ field is part of spec, image is optional if version is specified and the
+ availableUpdates field contains a matching version.
+ type: string
+ url:
+ description: |-
+ url contains information about this release. This URL is set by
+ the 'url' metadata property on a release or the metadata returned by
+ the update API and should be displayed as a link in user
+ interfaces. The URL field may not be set for test or nightly
+ releases.
+ type: string
+ version:
+ description: |-
+ version is a semantic version identifying the update version. When this
+ field is part of spec, version is optional if image is specified.
+ type: string
+ required:
+ - image
+ - version
+ type: object
+ history:
+ description: |-
+ history contains a list of the most recent versions applied to the cluster.
+ This value may be empty during cluster startup, and then will be updated
+ when a new update is being applied. The newest update is first in the
+ list and it is ordered by recency. Updates in the history have state
+ Completed if the rollout completed - if an update was failing or halfway
+ applied the state will be Partial. Only a limited amount of update history
+ is preserved.
+ items:
+ description: UpdateHistory is a single attempted update to the
+ cluster.
+ properties:
+ acceptedRisks:
+ description: |-
+ acceptedRisks records risks which were accepted to initiate the update.
+ For example, it may menition an Upgradeable=False or missing signature
+ that was overriden via desiredUpdate.force, or an update that was
+ initiated despite not being in the availableUpdates set of recommended
+ update targets.
+ type: string
+ completionTime:
+ description: |-
+ completionTime, if set, is when the update was fully applied. The update
+ that is currently being applied will have a null completion time.
+ Completion time will always be set for entries that are not the current
+ update (usually to the started time of the next update).
+ format: date-time
+ nullable: true
+ type: string
+ image:
+ description: |-
+ image is a container image location that contains the update. This value
+ is always populated.
+ type: string
+ startedTime:
+ description: startedTime is the time at which the update
+ was started.
+ format: date-time
+ type: string
+ state:
+ description: |-
+ state reflects whether the update was fully applied. The Partial state
+ indicates the update is not fully applied, while the Completed state
+ indicates the update was successfully rolled out at least once (all
+ parts of the update successfully applied).
+ type: string
+ verified:
+ description: |-
+ verified indicates whether the provided update was properly verified
+ before it was installed. If this is false the cluster may not be trusted.
+ Verified does not cover upgradeable checks that depend on the cluster
+ state at the time when the update target was accepted.
+ type: boolean
+ version:
+ description: |-
+ version is a semantic version identifying the update version. If the
+ requested image does not define a version, or if a failure occurs
+ retrieving the image, this value may be empty.
+ type: string
+ required:
+ - completionTime
+ - image
+ - startedTime
+ - state
+ - verified
+ type: object
+ type: array
+ observedGeneration:
+ description: |-
+ observedGeneration reports which version of the spec is being synced.
+ If this value is not equal to metadata.generation, then the desired
+ and conditions fields may represent a previous version.
+ format: int64
+ type: integer
+ required:
+ - availableUpdates
+ - desired
+ - observedGeneration
+ type: object
+ required:
+ - initialized
+ - ready
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/nodepools-CustomNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/nodepools-CustomNoUpgrade.crd.yaml
new file mode 100644
index 00000000000..eddf34ab46a
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/nodepools-CustomNoUpgrade.crd.yaml
@@ -0,0 +1,1801 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: CustomNoUpgrade
+ name: nodepools.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ kind: NodePool
+ listKind: NodePoolList
+ plural: nodepools
+ shortNames:
+ - np
+ - nps
+ singular: nodepool
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: Cluster
+ jsonPath: .spec.clusterName
+ name: Cluster
+ type: string
+ - description: Desired Nodes
+ jsonPath: .spec.replicas
+ name: Desired Nodes
+ type: integer
+ - description: Available Nodes
+ jsonPath: .status.replicas
+ name: Current Nodes
+ type: integer
+ - description: Autoscaling Enabled
+ jsonPath: .status.conditions[?(@.type=="AutoscalingEnabled")].status
+ name: Autoscaling
+ type: string
+ - description: Node Autorepair Enabled
+ jsonPath: .status.conditions[?(@.type=="AutorepairEnabled")].status
+ name: Autorepair
+ type: string
+ - description: Current version
+ jsonPath: .status.version
+ name: Version
+ type: string
+ - description: UpdatingVersion in progress
+ jsonPath: .status.conditions[?(@.type=="UpdatingVersion")].status
+ name: UpdatingVersion
+ type: string
+ - description: UpdatingConfig in progress
+ jsonPath: .status.conditions[?(@.type=="UpdatingConfig")].status
+ name: UpdatingConfig
+ type: string
+ - description: Message
+ jsonPath: .status.conditions[?(@.type=="Ready")].message
+ name: Message
+ type: string
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ NodePool is a scalable set of worker nodes attached to a HostedCluster.
+ NodePool machine architectures are uniform within a given pool, and are
+ independent of the control plane's underlying machine architecture.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the desired behavior of the NodePool.
+ properties:
+ arch:
+ default: amd64
+ description: "arch is the preferred processor architecture for the
+ NodePool. Different platforms might have different supported architectures.\n\thttps://github.com/kubernetes/kubernetes/issues/108768#issuecomment-1253912215"
+ enum:
+ - arm64
+ - amd64
+ - ppc64le
+ - s390x
+ type: string
+ x-kubernetes-validations:
+ - message: Arch is immutable
+ rule: self == oldSelf
+ autoScaling:
+ description: |-
+ autoScaling specifies auto-scaling behavior for the NodePool.
+ autoScaling is mutually exclusive with replicas. If replicas is set, this field must be omitted.
+ properties:
+ max:
+ description: max is the maximum number of nodes allowed in the
+ pool. Must be >= 1 and >= Min.
+ format: int32
+ minimum: 1
+ type: integer
+ min:
+ description: min is the minimum number of nodes to maintain in
+ the pool. Must be >= 1 and <= .Max.
+ format: int32
+ minimum: 1
+ type: integer
+ required:
+ - max
+ - min
+ type: object
+ x-kubernetes-validations:
+ - message: max must be equal or greater than min
+ rule: self.max >= self.min
+ clusterName:
+ description: |-
+ clusterName is the name of the HostedCluster this NodePool belongs to.
+ If a HostedCluster with this name doesn't exist, the controller will no-op until it exists.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: ClusterName is immutable
+ rule: self == oldSelf
+ - message: clusterName must consist of lowercase alphanumeric characters
+ or '-', start and end with an alphanumeric character, and be between
+ 1 and 253 characters
+ rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?$')
+ config:
+ description: |-
+ config is a list of references to ConfigMaps containing serialized
+ MachineConfig resources to be injected into the ignition configurations of
+ nodes in the NodePool. The MachineConfig API schema is defined here:
+
+ https://github.com/openshift/machine-config-operator/blob/18963e4f8fe66e8c513ca4b131620760a414997f/pkg/apis/machineconfiguration.openshift.io/v1/types.go#L185
+
+ Each ConfigMap must have a single key named "config" whose value is the YML
+ with one or more serialized machineconfiguration.openshift.io resources:
+
+ * KubeletConfig
+ * ContainerRuntimeConfig
+ * MachineConfig
+ * ClusterImagePolicy
+ * ImageContentSourcePolicy
+ * ImageDigestMirrorSet
+
+ This is validated in the backend and signaled back via validMachineConfig condition.
+ Changing this field will trigger a NodePool rollout.
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ maxItems: 10
+ type: array
+ management:
+ description: |-
+ management specifies behavior for managing nodes in the pool, such as
+ upgrade strategies and auto-repair behaviors.
+ properties:
+ autoRepair:
+ default: false
+ description: |-
+ autoRepair specifies whether health checks should be enabled for machines in the NodePool. The default is false.
+ Enabling this feature will cause the controller to automatically delete unhealthy machines.
+ The unhealthy criteria is reserved for the controller implementation and subject to change.
+ But generally it's determined by checking the Node ready condition is true and a timeout that might vary depending on the platform provider.
+ AutoRepair will no-op when more than 2 Nodes are unhealthy at the same time. Giving time for the cluster to stabilize or to the user to manually intervene.
+ type: boolean
+ inPlace:
+ description: inPlace is the configuration for in-place upgrades.
+ properties:
+ maxUnavailable:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ maxUnavailable is the maximum number of nodes that can be unavailable
+ during the update.
+
+ Value can be an absolute number (ex: 5) or a percentage of desired nodes
+ (ex: 10%).
+
+ Absolute number is calculated from percentage by rounding down.
+
+ Defaults to 1.
+
+ Example: when this is set to 30%, a max of 30% of the nodes can be made
+ unschedulable/unavailable immediately when the update starts. Once a set
+ of nodes is updated, more nodes can be made unschedulable for update,
+ ensuring that the total number of nodes schedulable at all times during
+ the update is at least 70% of desired nodes.
+ x-kubernetes-int-or-string: true
+ type: object
+ replace:
+ default:
+ rollingUpdate:
+ maxSurge: 1
+ maxUnavailable: 0
+ strategy: RollingUpdate
+ description: |-
+ replace is the configuration for rolling upgrades.
+ It defaults to a RollingUpdate strategy with maxSurge of 1 and maxUnavailable of 0.
+ properties:
+ rollingUpdate:
+ description: |-
+ rollingUpdate specifies a rolling update strategy which upgrades nodes by
+ creating new nodes and deleting the old ones.
+ properties:
+ maxSurge:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ maxSurge is the maximum number of nodes that can be provisioned above the
+ desired number of nodes.
+
+ Value can be an absolute number (ex: 5) or a percentage of desired nodes
+ (ex: 10%).
+
+ Absolute number is calculated from percentage by rounding up.
+
+ This can not be 0 if MaxUnavailable is 0.
+
+ Defaults to 1.
+
+ Example: when this is set to 30%, new nodes can be provisioned immediately
+ when the rolling update starts, such that the total number of old and new
+ nodes do not exceed 130% of desired nodes. Once old nodes have been
+ deleted, new nodes can be provisioned, ensuring that total number of nodes
+ running at any time during the update is at most 130% of desired nodes.
+ x-kubernetes-int-or-string: true
+ maxUnavailable:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ maxUnavailable is the maximum number of nodes that can be unavailable
+ during the update.
+
+ Value can be an absolute number (ex: 5) or a percentage of desired nodes
+ (ex: 10%).
+
+ Absolute number is calculated from percentage by rounding down.
+
+ This can not be 0 if MaxSurge is 0.
+
+ Defaults to 0.
+
+ Example: when this is set to 30%, old nodes can be deleted down to 70% of
+ desired nodes immediately when the rolling update starts. Once new nodes
+ are ready, more old nodes be deleted, followed by provisioning new nodes,
+ ensuring that the total number of nodes available at all times during the
+ update is at least 70% of desired nodes.
+ x-kubernetes-int-or-string: true
+ type: object
+ strategy:
+ description: |-
+ strategy is the node replacement strategy for nodes in the pool.
+ In can be either "RollingUpdate" or "OnDelete". RollingUpdate will rollout Nodes honoring maxSurge and maxUnavailable.
+ OnDelete provide more granular control and will replace nodes as the old ones are manually deleted.
+ enum:
+ - RollingUpdate
+ - OnDelete
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: The 'rollingUpdate' field can only be set when 'strategy'
+ is 'RollingUpdate'
+ rule: '!has(self.rollingUpdate) || self.strategy == ''RollingUpdate'''
+ upgradeType:
+ description: |-
+ upgradeType specifies the type of strategy for handling upgrades.
+ This can be either "Replace" or "InPlace".
+ "Replace" will update Nodes by recreating the underlying instances.
+ "InPlace" will update Nodes by applying changes to the existing instances. This might or might not result in a reboot.
+ enum:
+ - Replace
+ - InPlace
+ type: string
+ x-kubernetes-validations:
+ - message: UpgradeType is immutable
+ rule: self == oldSelf
+ required:
+ - upgradeType
+ type: object
+ x-kubernetes-validations:
+ - message: The 'inPlace' field can only be set when 'upgradeType'
+ is 'InPlace'
+ rule: '!has(self.inPlace) || self.upgradeType == ''InPlace'''
+ nodeDrainTimeout:
+ description: |-
+ nodeDrainTimeout is the maximum amount of time that the controller will spend on retrying to drain a node until it succeeds.
+ The default value is 0, meaning that the node can retry drain without any time limitations.
+ Changing this field propagate inplace into existing Nodes.
+ type: string
+ nodeLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeLabels propagates a list of labels to Nodes, only once on creation.
+ Valid values are those in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
+ type: object
+ nodeVolumeDetachTimeout:
+ description: |-
+ nodeVolumeDetachTimeout is the maximum amount of time that the controller will spend on detaching volumes from a node.
+ The default value is 0, meaning that the volumes will be detached from the node without any time limitations.
+ After the timeout, any remaining attached volumes will be ignored and the removal of the machine will continue.
+ Changing this field propagate inplace into existing Nodes.
+ type: string
+ pausedUntil:
+ description: |-
+ pausedUntil is a field that can be used to pause reconciliation on the NodePool controller. Resulting in any change to the NodePool being ignored.
+ Either a date can be provided in RFC3339 format or a boolean as in 'true', 'false', 'True', 'False'. If a date is
+ provided: reconciliation is paused on the resource until that date. If the boolean true is
+ provided: reconciliation is paused on the resource until the field is removed.
+ maxLength: 35
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: PausedUntil must be a date in RFC3339 format or 'True',
+ 'true', 'False' or 'false'
+ rule: self.matches('^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}.*$')
+ || self in ['true', 'false', 'True', 'False']
+ platform:
+ description: |-
+ platform specifies the underlying infrastructure provider for the NodePool
+ and is used to configure platform specific behavior.
+ properties:
+ agent:
+ description: agent specifies the configuration used when using
+ Agent platform.
+ properties:
+ agentLabelSelector:
+ description: |-
+ agentLabelSelector contains labels that must be set on an Agent in order to
+ be selected for a Machine.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector
+ requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector
+ applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ aws:
+ description: aws specifies the configuration used when operating
+ on AWS.
+ properties:
+ ami:
+ description: |-
+ ami is the image id to use for node instances. If unspecified, the default
+ is chosen based on the NodePool release payload image.
+ maxLength: 255
+ type: string
+ imageType:
+ description: |-
+ imageType specifies the type of image to use for node instances.
+ Valid values are "Linux" or "Windows"
+ When set to Windows, the controller will automatically populate the AMI field
+ with a Windows-compatible AMI based on the region and OpenShift version.
+ When the AMI field is also set, it will take precedence over automatic selection based
+ on imageType. Also note that Windows ImageType is only compatible with an Arch of amd64
+ enum:
+ - Windows
+ - Linux
+ type: string
+ instanceProfile:
+ description: instanceProfile is the AWS EC2 instance profile,
+ which is a container for an IAM role that the EC2 instance
+ uses.
+ maxLength: 255
+ type: string
+ instanceType:
+ description: instanceType is an ec2 instance type for node
+ instances (e.g. m5.large).
+ maxLength: 255
+ type: string
+ placement:
+ description: placement specifies the placement options for
+ the EC2 instances.
+ properties:
+ capacityReservation:
+ description: |-
+ capacityReservation specifies Capacity Reservation options for the NodePool instances.
+
+ Cannot be specified when tenancy is set to "host" as Dedicated Hosts
+ do not support Capacity Reservations. Compatible with "default" and "dedicated" tenancy.
+ properties:
+ id:
+ description: |-
+ id specifies the target Capacity Reservation into which the EC2 instances should be launched.
+ Must follow the format: cr- followed by 17 lowercase hexadecimal characters. For example: cr-0123456789abcdef0
+ When empty, no specific Capacity Reservation is targeted.
+
+ When specified, preference cannot be set to 'None' or 'Open' as these
+ are mutually exclusive with targeting a specific reservation. Use preference 'CapacityReservationsOnly'
+ or omit preference field when targeting a specific reservation.
+ maxLength: 20
+ type: string
+ x-kubernetes-validations:
+ - message: AWS Capacity Reservation ID must start
+ with 'cr-' followed by 17 lowercase hexadecimal
+ characters (e.g., cr-0123456789abcdef0)
+ rule: self.matches('^cr-[a-f0-9]{17}$')
+ marketType:
+ description: |-
+ marketType specifies the market type of the CapacityReservation for the EC2 instances. Valid values are OnDemand, CapacityBlocks and omitted:
+ - "OnDemand": EC2 instances run as standard On-Demand instances.
+ - "CapacityBlocks": scheduled pre-purchased compute capacity. Capacity Blocks is recommended when GPUs are needed to support ML workloads.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default value is CapacityBlocks.
+
+ When set to 'CapacityBlocks', a specific Capacity Reservation ID must be provided.
+ enum:
+ - OnDemand
+ - CapacityBlocks
+ type: string
+ preference:
+ description: |-
+ preference specifies the preference for use of Capacity Reservations by the instance. Valid values include:
+ - "": No preference (platform default)
+ - "Open": The instance may make use of open Capacity Reservations that match its AZ and InstanceType
+ - "None": The instance may not make use of any Capacity Reservations. This is to conserve open reservations for desired workloads
+ - "CapacityReservationsOnly": The instance will only run if matched or targeted to a Capacity Reservation
+
+ Cannot be set to 'None' or 'Open' when a specific Capacity Reservation ID is provided,
+ as targeting a specific reservation is mutually exclusive with these general preference settings.
+ enum:
+ - ""
+ - None
+ - CapacityReservationsOnly
+ - Open
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: AWS Capacity Reservation preference 'None'
+ or 'Open' is incompatible with specifying a Capacity
+ Reservation ID
+ rule: 'has(self.id) ? (!has(self.preference) || !(self.preference
+ in [''Open'',''None''])) : true'
+ - message: AWS Capacity Reservation market type 'CapacityBlocks'
+ requires a Capacity Reservation ID
+ rule: 'has(self.marketType) && self.marketType == ''CapacityBlocks''
+ ? has(self.id) : true'
+ tenancy:
+ description: |-
+ tenancy indicates if instance should run on shared or single-tenant hardware.
+
+ Possible values:
+ - "default": NodePool instances run on shared hardware.
+ - "dedicated": Each NodePool instance runs on single-tenant hardware (Dedicated Instances).
+ - "host": NodePool instances run on user's pre-allocated dedicated hosts (Dedicated Hosts).
+
+ When tenancy is set to "host", capacityReservation cannot be specified
+ as AWS does not support Capacity Reservations with Dedicated Hosts.
+ enum:
+ - default
+ - dedicated
+ - host
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: AWS Capacity Reservations cannot be used with Dedicated
+ Hosts (tenancy 'host')
+ rule: 'has(self.tenancy) && self.tenancy == ''host'' ? !has(self.capacityReservation)
+ : true'
+ resourceTags:
+ description: |-
+ resourceTags is an optional list of additional tags to apply to AWS node
+ instances. Changes to this field will be propagated in-place to AWS EC2 instances and their initial EBS volumes.
+ Volumes created by the storage operator and attached to instances after they are created do not get these tags applied.
+
+ These will be merged with HostedCluster scoped tags, which take precedence in case of conflicts.
+ These take precedence over tags defined out of band (i.e., tags added manually or by other tools outside of HyperShift) in AWS in case of conflicts.
+
+ See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for
+ information on tagging AWS resources. AWS supports a maximum of 50 tags per
+ resource. OpenShift reserves 25 tags for its use, leaving 25 tags available
+ for the user.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ value:
+ description: |-
+ value is the value of the tag.
+
+ Some AWS service do not support empty values. Since tags are added to
+ resources in many services, the length of the tag value must meet the
+ requirements of all services.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ rootVolume:
+ description: rootVolume specifies configuration for the root
+ volume of node instances.
+ properties:
+ encrypted:
+ description: encrypted indicates whether the EBS volume
+ should be encrypted or not.
+ type: boolean
+ encryptionKey:
+ description: encryptionKey is the KMS key to use for volume
+ encryption.
+ maxLength: 2048
+ type: string
+ iops:
+ description: |-
+ iops is the number of IOPS requested for the disk. This is only valid
+ for type io1.
+ format: int64
+ type: integer
+ size:
+ description: |-
+ size is the size of the volume in gibibytes (GiB).
+
+ Must be greater than the image snapshot size or 8 (whichever is greater).
+ format: int64
+ minimum: 8
+ type: integer
+ type:
+ description: type is the type of volume to provision.
+ maxLength: 255
+ type: string
+ required:
+ - size
+ - type
+ type: object
+ securityGroups:
+ description: |-
+ securityGroups is an optional set of security groups to associate with node
+ instances.
+ items:
+ description: |-
+ AWSResourceReference is a reference to a specific AWS resource by ID or filters.
+ Only one of ID or Filters may be specified. Specifying more than one will result in
+ a validation error.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify an
+ AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for the
+ filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ maxItems: 50
+ type: array
+ subnet:
+ description: subnet is the subnet to use for node instances.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify an
+ AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for the
+ filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: subnet is invalid, a valid subnet id or filters
+ must be set, but not both
+ rule: 'has(self.id) && self.id.startsWith(''subnet-'') ?
+ !has(self.filters) : size(self.filters) > 0'
+ required:
+ - instanceType
+ - subnet
+ type: object
+ azure:
+ description: azure specifies the configuration used when using
+ Azure platform.
+ properties:
+ availabilityZone:
+ description: |-
+ availabilityZone is the failure domain identifier where the VM should be attached to. This must not be specified
+ for clusters in a location that does not support AvailabilityZone because it would cause a failure from Azure API.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - rule: self in ['1', '2', '3']
+ diagnostics:
+ description: |-
+ diagnostics specifies the diagnostics settings for a virtual machine.
+ If not specified, then Boot diagnostics will be disabled.
+ properties:
+ storageAccountType:
+ allOf:
+ - enum:
+ - Managed
+ - UserManaged
+ - Disabled
+ - enum:
+ - Managed
+ - UserManaged
+ - Disabled
+ default: Disabled
+ description: |-
+ storageAccountType determines if the storage account for storing the diagnostics data
+ should be disabled (Disabled), provisioned by Azure (Managed) or by the user (UserManaged).
+ type: string
+ userManaged:
+ description: userManaged specifies the diagnostics settings
+ for a virtual machine when the storage account is managed
+ by the user.
+ properties:
+ storageAccountURI:
+ description: |-
+ storageAccountURI is the URI of the user-managed storage account.
+ The URI typically will be `https://.blob.core.windows.net/`
+ but may differ if you are using Azure DNS zone endpoints.
+ You can find the correct endpoint by looking for the Blob Primary Endpoint in the
+ endpoints tab in the Azure console or with the CLI by issuing
+ `az storage account list --query='[].{name: name, "resource group": resourceGroup, "blob endpoint": primaryEndpoints.blob}'`.
+ maxLength: 1024
+ type: string
+ x-kubernetes-validations:
+ - message: storageAccountURI must be a valid HTTPS
+ URL
+ rule: isURL(self) && url(self).getScheme() == 'https'
+ required:
+ - storageAccountURI
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: userManaged is required when storageAccountType
+ is UserManaged, and forbidden otherwise
+ rule: 'self.storageAccountType == ''UserManaged'' ? has(self.userManaged)
+ : !has(self.userManaged)'
+ encryptionAtHost:
+ default: Enabled
+ description: |-
+ encryptionAtHost enables encryption at host on virtual machines. According to Microsoft documentation, this
+ means data stored on the VM host is encrypted at rest and flows encrypted to the Storage service. See
+ https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal?tabs=azure-powershell
+ for more information.
+ enum:
+ - Enabled
+ - Disabled
+ type: string
+ image:
+ description: |-
+ image is used to configure the VM boot image. If unset, the default image at the location below will be used and
+ is expected to exist: subscription//resourceGroups//providers/Microsoft.Compute/images/rhcos.x86_64.vhd.
+ The and the are expected to be the same resource group documented in the
+ Hosted Cluster specification respectively, HostedCluster.Spec.Platform.Azure.SubscriptionID and
+ HostedCluster.Spec.Platform.Azure.ResourceGroupName.
+ properties:
+ azureMarketplace:
+ description: azureMarketplace contains the Azure Marketplace
+ image info to use to boot the Azure VMs from.
+ minProperties: 1
+ properties:
+ imageGeneration:
+ default: Gen2
+ description: |-
+ imageGeneration specifies the Hyper-V generation of the Azure Marketplace image to use for the nodes.
+ This field is used by HyperShift to select the appropriate marketplace image (Gen1 or Gen2)
+ from the release payload metadata when publisher, offer, sku, and version are not explicitly provided.
+ It is not passed to CAPZ (Cluster API Provider Azure); the generation information is
+ encoded into the SKU field that CAPZ uses.
+ Valid values are Gen1 and Gen2. If unspecified, defaults to Gen2.
+ enum:
+ - Gen1
+ - Gen2
+ type: string
+ offer:
+ description: offer specifies the name of a group of
+ related images created by the publisher.
+ maxLength: 255
+ minLength: 1
+ type: string
+ publisher:
+ description: |-
+ publisher is the name of the organization that created the image.
+ It must be between 3 and 50 characters in length, and consist of only lowercase letters, numbers, and hyphens (-) and underscores (_).
+ It must start with a lowercase letter or a number.
+ maxLength: 50
+ minLength: 3
+ pattern: ^[a-z0-9][a-z0-9-_]{2,49}$
+ type: string
+ sku:
+ description: |-
+ sku specifies an instance of an offer, such as a major release of a distribution.
+ For example, 22_04-lts-gen2, 8-lvm-gen2.
+ The value must consist only of lowercase letters, numbers, and hyphens (-) and underscores (_).
+ maxLength: 255
+ minLength: 1
+ pattern: ^[a-z0-9-_]+$
+ type: string
+ version:
+ description: |-
+ version specifies the version of an image sku. The allowed formats are Major.Minor.Build or 'latest'. Major,
+ Minor, and Build are decimal numbers, e.g. '1.2.0'. Specify 'latest' to use the latest version of an image available at
+ deployment time. Even if you use 'latest', the VM image will not automatically update after deploy time even if a
+ new version becomes available.
+ maxLength: 32
+ minLength: 1
+ pattern: ^[0-9]+\.[0-9]+\.[0-9]+$|^latest$
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: must specify imageGeneration or must specify
+ publisher, offer, sku and version
+ rule: has(self.imageGeneration) || has(self.publisher)
+ && has(self.offer) && has(self.sku) && has(self.version)
+ - message: publisher, offer, sku and version must either
+ be all set, or all omitted
+ rule: '[has(self.publisher), has(self.offer), has(self.sku),
+ has(self.version)].filter(x, x == true).size() ==
+ 0 || [has(self.publisher), has(self.offer), has(self.sku),
+ has(self.version)].filter(x, x == true).size() ==
+ 4'
+ imageID:
+ description: imageID is the Azure resource ID of a VHD
+ image to use to boot the Azure VMs from.
+ maxLength: 255
+ type: string
+ type:
+ description: |-
+ type is the type of image data that will be provided to the Azure VM.
+ Valid values are "ImageID" and "AzureMarketplace".
+ ImageID means is used for legacy managed VM images. This is where the user uploads a VM image directly to their resource group.
+ AzureMarketplace means the VM will boot from an Azure Marketplace image.
+ Marketplace images are preconfigured and published by the OS vendors and may include preconfigured software for the VM.
+ When Type is "AzureMarketplace", you can either:
+ 1. Specify only imageGeneration to use marketplace defaults from the release payload
+ 2. Specify publisher, offer, sku, and version to use an explicit marketplace image
+ 3. Specify all fields (imageGeneration along with publisher, offer, sku, version)
+ enum:
+ - ImageID
+ - AzureMarketplace
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: imageID is required when type is ImageID, and forbidden
+ otherwise
+ rule: 'has(self.type) && self.type == ''ImageID'' ? has(self.imageID)
+ : !has(self.imageID)'
+ - message: azureMarketplace is forbidden when type is not
+ AzureMarketplace
+ rule: 'has(self.type) && self.type == ''AzureMarketplace''
+ ? true : !has(self.azureMarketplace)'
+ osDisk:
+ description: |-
+ osDisk provides configuration for the OS disk for the nodepool.
+ This can be used to configure the size, storage account type, encryption options and whether the disk is persistent or ephemeral.
+ When not provided, the platform will choose reasonable defaults which are subject to change over time.
+ Review the fields within the osDisk for more details.
+ properties:
+ diskStorageAccountType:
+ description: |-
+ diskStorageAccountType is the disk storage account type to use.
+ Valid values are Premium_LRS, PremiumV2_LRS, Standard_LRS, StandardSSD_LRS, UltraSSD_LRS.
+ Note that Standard means a HDD.
+ The disk performance is tied to the disk type, please refer to the Azure documentation for further details
+ https://docs.microsoft.com/en-us/azure/virtual-machines/disks-types#disk-type-comparison.
+ When omitted this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is Premium SSD LRS.
+ enum:
+ - Premium_LRS
+ - PremiumV2_LRS
+ - Standard_LRS
+ - StandardSSD_LRS
+ - UltraSSD_LRS
+ type: string
+ encryptionSetID:
+ description: |-
+ encryptionSetID is the ID of the DiskEncryptionSet resource to use to encrypt the OS disks for the VMs.
+ Configuring a DiskEncyptionSet allows greater control over the encryption of the VM OS disk at rest.
+ Can be used with either platform (Azure) managed, or customer managed encryption keys.
+ This needs to exist in the same subscription id listed in the Hosted Cluster, HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ DiskEncryptionSetID should also exist in a resource group under the same subscription id and the same location
+ listed in the Hosted Cluster, HostedCluster.Spec.Platform.Azure.Location.
+ The encryptionSetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Copmute/diskEncryptionSets/{resourceName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The resourceName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores.
+ maxLength: 285
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/diskEncryptionSets/{resourceName}`
+ rule: size(self.split('/')) == 9 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Compute/diskEncryptionSets/.*$')
+ - message: the subscriptionId in the encryptionSetID must
+ be a valid UUID. It should be 5 groups of hyphen separated
+ hexadecimal characters in the form 8-4-4-4-12
+ rule: self.split('/')[2].matches('^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$')
+ - message: The resourceGroupName should be between 1 and
+ 90 characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the encryptionSetID
+ must not end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The resourceName should be between 1 and 80
+ characters, consisting only of alphanumeric characters,
+ hyphens and underscores
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_]{1,80}')
+ persistence:
+ description: |-
+ persistence determines whether the OS disk should be persisted beyond the life of the VM.
+ Valid values are Persistent and Ephemeral.
+ When set to Ephmeral, the OS disk will not be persisted to Azure storage and implies restrictions to the VM size and caching type.
+ Full details can be found in the Azure documentation https://learn.microsoft.com/en-us/azure/virtual-machines/ephemeral-os-disks.
+ Ephmeral disks are primarily used for stateless applications, provide lower latency than Persistent disks and also incur no storage costs.
+ When not set, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ enum:
+ - Persistent
+ - Ephemeral
+ type: string
+ sizeGiB:
+ description: |-
+ sizeGiB is the size in GiB (1024^3 bytes) to assign to the OS disk.
+ This should be between 16 and 65,536 when using the UltraSSD_LRS storage account type and between 16 and 32,767 when using any other storage account type.
+ When not set, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is 30.
+ format: int32
+ maximum: 65536
+ minimum: 16
+ type: integer
+ type: object
+ x-kubernetes-validations:
+ - message: When not using diskStorageAccountType UltraSSD_LRS,
+ the SizeGB value must be less than or equal to 32,767
+ rule: '!has(self.diskStorageAccountType) || self.diskStorageAccountType
+ != ''UltraSSD_LRS'' || self.sizeGiB <= 32767'
+ subnetID:
+ description: |-
+ subnetID is the subnet ID of an existing subnet where the nodes in the nodepool will be created. This can be a
+ different subnet than the one listed in the HostedCluster, HostedCluster.Spec.Platform.Azure.SubnetID, but must
+ exist in the same network, HostedCluster.Spec.Platform.Azure.VnetID, and must exist under the same subscription ID,
+ HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ subnetID is immutable once set.
+ The subnetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The vnetName should be between 2 and 64 characters, consisting only of alphanumeric characters, hyphens, underscores and periods and must not end with either a period (.) or hyphen (-) character.
+ The subnetName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores and must start with an alphanumeric character and must not end with a period (.) or hyphen (-) character.
+ maxLength: 355
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`
+ rule: size(self.split('/')) == 11 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Network/virtualNetworks/.*/subnets/.*$')
+ - message: the subscriptionId in the encryptionSetID must
+ be a valid UUID. It should be 5 groups of hyphen separated
+ hexadecimal characters in the form 8-4-4-4-12
+ rule: self.split('/')[2].matches('^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$')
+ - message: The resourceGroupName should be between 1 and 90
+ characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the subnetID must not
+ end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The vnetName should be between 2 and 64 characters,
+ consisting only of alphanumeric characters, hyphens, underscores
+ and periods
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_\\.]{2,64}')
+ - message: the vnetName in the subnetID must not end with
+ either a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[8].endsWith(''.'') && !self.split(''/'')[8].endsWith(''-'')'
+ - message: The subnetName should be between 1 and 80 characters,
+ consisting only of alphanumeric characters, hyphens and
+ underscores and must start with an alphanumeric character
+ rule: self.split('/')[10].matches('[a-zA-Z0-9][a-zA-Z0-9-_\\.]{0,79}')
+ - message: the subnetName in the subnetID must not end with
+ a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[10].endsWith(''.'') && !self.split(''/'')[10].endsWith(''-'')'
+ - message: SubnetID is immutable
+ rule: self == oldSelf
+ vmSize:
+ description: |-
+ vmSize is the Azure VM instance type to use for the nodes being created in the nodepool.
+ The size naming convention is documented here https://learn.microsoft.com/en-us/azure/virtual-machines/vm-naming-conventions.
+ Size names should start with a Family name, which is represented by one of more capital letters, and then be followed by the CPU count.
+ This is followed by 0 or more additional features, represented by a, b, d, i, l, m, p, t, s, C, and NP, refer to the Azure documentation for an explanation of these features.
+ Optionally an accelerator such as a GPU can be added, prefixed by an underscore, for example A100, H100 or MI300X.
+ The size may also be versioned, in which case it should be suffixed with _v where the version is a number.
+ For example, "D32ads_v5" would be a suitable general purpose VM size, or "ND96_MI300X_v5" would represent a GPU accelerated VM.
+ maxLength: 255
+ pattern: ^(Standard_|Basic_)?[A-Z]+[0-9]+(-[0-9]+)?[abdilmptsCNP]*(_[A-Z]*[0-9]+[A-Z]*)?(_v[0-9]+)?$
+ type: string
+ required:
+ - image
+ - osDisk
+ - subnetID
+ - vmSize
+ type: object
+ ibmcloud:
+ description: ibmcloud defines IBMCloud specific settings for components
+ properties:
+ providerType:
+ description: providerType is a specific supported infrastructure
+ provider within IBM Cloud.
+ type: string
+ type: object
+ kubevirt:
+ description: kubevirt specifies the configuration used when operating
+ on KubeVirt platform.
+ properties:
+ additionalNetworks:
+ description: additionalNetworks specify the extra networks
+ attached to the nodes
+ items:
+ description: |-
+ KubevirtNetwork specifies the configuration for a virtual machine
+ network interface
+ properties:
+ name:
+ description: |-
+ name specify the network attached to the nodes
+ it is a value with the format "[namespace]/[name]" to reference the
+ multus network attachment definition
+ maxLength: 255
+ type: string
+ required:
+ - name
+ type: object
+ maxItems: 20
+ type: array
+ attachDefaultNetwork:
+ default: true
+ description: |-
+ attachDefaultNetwork specify if the default pod network should be attached to the nodes
+ this can only be set to false if AdditionalNetworks are configured
+ type: boolean
+ compute:
+ default:
+ cores: 2
+ memory: 8Gi
+ description: compute contains values representing the virtual
+ hardware requested for the VM
+ properties:
+ cores:
+ description: cores is the number of CPU cores for the
+ KubeVirt VM.
+ format: int32
+ minimum: 1
+ type: integer
+ memory:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 8Gi
+ description: memory represents how much guest memory the
+ VM should have
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ qosClass:
+ default: Burstable
+ description: |-
+ qosClass if set to "Guaranteed", requests the scheduler to place the VirtualMachineInstance on a node with
+ limit memory and CPU, equal to be the requested values, to set the VMI as a Guaranteed QoS Class;
+ See here for more details:
+ https://kubevirt.io/user-guide/operations/node_overcommit/#requesting-the-right-qos-class-for-virtualmachineinstances
+ enum:
+ - Burstable
+ - Guaranteed
+ type: string
+ type: object
+ hostDevices:
+ description: |-
+ hostDevices specifies the host devices (e.g. GPU devices) to be passed
+ from the management cluster, to the nodepool nodes
+ items:
+ properties:
+ count:
+ default: 1
+ description: |-
+ count is the number of instances the specified host device will be attached to each of the
+ NodePool's nodes. Default is 1.
+ maximum: 2147483647
+ minimum: 1
+ type: integer
+ deviceName:
+ description: |-
+ deviceName is the name of the host device that is desired to be utilized in the HostedCluster's NodePool
+ The device can be any supported PCI device, including GPU, either as a passthrough or a vGPU slice.
+ maxLength: 255
+ type: string
+ required:
+ - deviceName
+ type: object
+ maxItems: 10
+ type: array
+ networkData:
+ description: |-
+ networkData is inline cloud-init network data configuration for VMs in this NodePool.
+ When specified, cloud-init volume changes from ConfigDrive to NoCloud.
+ This allows for static network configuration of VMs.
+ type: string
+ networkInterfaceMultiqueue:
+ default: Enable
+ description: |-
+ networkInterfaceMultiqueue if set to "Enable", virtual network interfaces configured with a virtio bus will also
+ enable the vhost multiqueue feature for network devices. The number of queues created depends on additional
+ factors of the VirtualMachineInstance, like the number of guest CPUs.
+ enum:
+ - Enable
+ - Disable
+ type: string
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is a selector which must be true for the kubevirt VirtualMachine to fit on a node.
+ Selector which must match a node's labels for the VM to be scheduled on that node. More info:
+ https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+ type: object
+ rootVolume:
+ default:
+ persistent:
+ size: 32Gi
+ type: Persistent
+ description: rootVolume represents values associated with
+ the VM volume that will host rhcos
+ properties:
+ cacheStrategy:
+ description: cacheStrategy defines the boot image caching
+ strategy. Default - no caching
+ properties:
+ type:
+ default: None
+ description: type is the type of the caching strategy
+ enum:
+ - None
+ - PVC
+ type: string
+ required:
+ - type
+ type: object
+ diskImage:
+ description: diskImage represents what rhcos image to
+ use for the node pool
+ properties:
+ containerDiskImage:
+ description: containerDiskImage is a string representing
+ the container image that holds the root disk
+ maxLength: 2048
+ type: string
+ type: object
+ persistent:
+ description: |-
+ persistent volume type means the VM's storage is backed by a PVC
+ VMs that use persistent volumes can survive disruption events like restart and eviction
+ This is the default type used when no storage type is defined.
+ properties:
+ accessModes:
+ description: |-
+ accessModes is an array that contains the desired Access Modes the root volume should have.
+ More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes
+ items:
+ enum:
+ - ReadWriteOnce
+ - ReadWriteMany
+ - ReadOnly
+ - ReadWriteOncePod
+ type: string
+ maxItems: 10
+ type: array
+ size:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 32Gi
+ description: size is the size of the persistent storage
+ volume
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ storageClass:
+ description: storageClass is the storageClass used
+ for the underlying PVC that hosts the volume
+ maxLength: 255
+ type: string
+ volumeMode:
+ description: |-
+ volumeMode defines what type of volume is required by the claim.
+ Value of Filesystem is implied when not included in claim spec.
+ enum:
+ - Filesystem
+ - Block
+ type: string
+ type: object
+ type:
+ default: Persistent
+ description: type represents the type of storage to associate
+ with the kubevirt VMs.
+ enum:
+ - Persistent
+ type: string
+ type: object
+ required:
+ - rootVolume
+ type: object
+ openstack:
+ description: openstack specifies the configuration used when using
+ OpenStack platform.
+ properties:
+ additionalPorts:
+ description: additionalPorts is a list of additional ports
+ to create on the node instances.
+ items:
+ description: PortSpec specifies the options for creating
+ a port.
+ properties:
+ allowedAddressPairs:
+ description: |-
+ allowedAddressPairs is a list of address pairs which Neutron will
+ allow the port to send traffic from in addition to the port's
+ addresses. If not specified, the MAC Address will be the MAC Address
+ of the port. Depending on the configuration of Neutron, it may be
+ supported to specify a CIDR instead of a specific IP address.
+ items:
+ properties:
+ ipAddress:
+ description: |-
+ ipAddress is the IP address of the allowed address pair. Depending on
+ the configuration of Neutron, it may be supported to specify a CIDR
+ instead of a specific IP address.
+ maxLength: 255
+ type: string
+ required:
+ - ipAddress
+ type: object
+ maxItems: 10
+ type: array
+ description:
+ description: description is a human-readable description
+ for the port.
+ maxLength: 255
+ type: string
+ network:
+ description: |-
+ network is a query for an openstack network that the port will be created or discovered on.
+ This will fail if the query returns more than one network.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select
+ an OpenStack network. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description
+ of the network to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the network
+ to filter by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of
+ the network to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the network to use.
+ If ID is provided, the other filters cannot be
+ provided. Must be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ portSecurityPolicy:
+ description: |-
+ portSecurityPolicy specifies whether or not to enable port security on the port.
+ Allowed values are "Enabled", "Disabled" and omitted.
+ When not set, it takes the value of the corresponding field at the network level.
+ enum:
+ - Enabled
+ - Disabled
+ - ""
+ type: string
+ vnicType:
+ description: |-
+ vnicType specifies the type of vNIC which this port should be
+ attached to. This is used to determine which mechanism driver(s) to
+ be used to bind the port. The valid values are normal, macvtap,
+ direct, baremetal, direct-physical, virtio-forwarder, smart-nic and
+ remote-managed, although these values will not be validated in this
+ API to ensure compatibility with future neutron changes or custom
+ implementations. What type of vNIC is actually available depends on
+ deployments. If not specified, the Neutron default value is used.
+ maxLength: 255
+ type: string
+ type: object
+ maxItems: 10
+ type: array
+ availabilityZone:
+ description: |-
+ availabilityZone is the nova availability zone in which the provider will create the VM.
+ If not specified, the VM will be created in the default availability zone specified in the nova configuration.
+ Availability zone names must NOT contain : since it is used by admin users to specify hosts where instances
+ are launched in server creation. Also, it must not contain spaces otherwise it will lead to node that belongs
+ to this availability zone register failure, see kubernetes/cloud-provider-openstack#1379 for further information.
+ The maximum length of availability zone name is 63 as per labels limits.
+ maxLength: 63
+ minLength: 1
+ pattern: '^[^: ]*$'
+ type: string
+ flavor:
+ description: flavor is the OpenStack flavor to use for the
+ node instances.
+ maxLength: 255
+ type: string
+ imageName:
+ description: |-
+ imageName is the OpenStack Glance image name to use for node instances. If unspecified, the default
+ is chosen based on the NodePool release payload image.
+ maxLength: 255
+ type: string
+ required:
+ - flavor
+ type: object
+ powervs:
+ description: powervs specifies the configuration used when using
+ IBMCloud PowerVS platform.
+ properties:
+ image:
+ description: |-
+ image used for deploying the nodes. If unspecified, the default
+ is chosen based on the NodePool release payload image.
+ properties:
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ name:
+ description: name of resource
+ maxLength: 255
+ type: string
+ type: object
+ imageDeletePolicy:
+ default: delete
+ description: |-
+ imageDeletePolicy is policy for the image deletion.
+
+ delete: delete the image from the infrastructure.
+ retain: delete the image from the openshift but retain in the infrastructure.
+
+ The default is delete
+ enum:
+ - delete
+ - retain
+ type: string
+ memoryGiB:
+ default: 32
+ description: |-
+ memoryGiB is the size of a virtual machine's memory, in GiB.
+ maximum value for the MemoryGiB depends on the selected SystemType.
+ when SystemType is set to e880 maximum MemoryGiB value is 7463 GiB.
+ when SystemType is set to e980 maximum MemoryGiB value is 15307 GiB.
+ when SystemType is set to s922 maximum MemoryGiB value is 942 GiB.
+ The minimum memory is 32 GiB.
+
+ When omitted, this means the user has no opinion and the platform is left to choose a reasonable
+ default. The current default is 32.
+ format: int32
+ type: integer
+ processorType:
+ default: shared
+ description: |-
+ processorType is the VM instance processor type.
+ It must be set to one of the following values: Dedicated, Capped or Shared.
+
+ Dedicated: resources are allocated for a specific client, The hypervisor makes a 1:1 binding of a partition's processor to a physical processor core.
+ Shared: Shared among other clients.
+ Capped: Shared, but resources do not expand beyond those that are requested, the amount of CPU time is Capped to the value specified for the entitlement.
+
+ if the processorType is selected as Dedicated, then Processors value cannot be fractional.
+ When omitted, this means that the user has no opinion and the platform is left to choose a
+ reasonable default. The current default is shared.
+ enum:
+ - dedicated
+ - shared
+ - capped
+ type: string
+ processors:
+ anyOf:
+ - type: integer
+ - type: string
+ default: "0.5"
+ description: |-
+ processors is the number of virtual processors in a virtual machine.
+ when the processorType is selected as Dedicated the processors value cannot be fractional.
+ maximum value for the Processors depends on the selected SystemType.
+ when SystemType is set to e880 or e980 maximum Processors value is 143.
+ when SystemType is set to s922 maximum Processors value is 15.
+ minimum value for Processors depends on the selected ProcessorType.
+ when ProcessorType is set as Shared or Capped, The minimum processors is 0.5.
+ when ProcessorType is set as Dedicated, The minimum processors is 1.
+ When omitted, this means that the user has no opinion and the platform is left to choose a
+ reasonable default. The default is set based on the selected ProcessorType.
+ when ProcessorType selected as Dedicated, the default is set to 1.
+ when ProcessorType selected as Shared or Capped, the default is set to 0.5.
+ x-kubernetes-int-or-string: true
+ storageType:
+ default: tier1
+ description: |-
+ storageType for the image and nodes, this will be ignored if Image is specified.
+ The storage tiers in PowerVS are based on I/O operations per second (IOPS).
+ It means that the performance of your storage volumes is limited to the maximum number of IOPS based on volume size and storage tier.
+ Although, the exact numbers might change over time, the Tier 3 storage is currently set to 3 IOPS/GB, and the Tier 1 storage is currently set to 10 IOPS/GB.
+
+ The default is tier1
+ enum:
+ - tier1
+ - tier3
+ type: string
+ systemType:
+ default: s922
+ description: |-
+ systemType is the System type used to host the instance.
+ systemType determines the number of cores and memory that is available.
+ Few of the supported SystemTypes are s922,e880,e980.
+ e880 systemType available only in Dallas Datacenters.
+ e980 systemType available in Datacenters except Dallas and Washington.
+ When omitted, this means that the user has no opinion and the platform is left to choose a
+ reasonable default. The current default is s922 which is generally available.
+ maxLength: 255
+ type: string
+ type: object
+ type:
+ description: type specifies the platform name.
+ enum:
+ - AWS
+ - Azure
+ - IBMCloud
+ - KubeVirt
+ - Agent
+ - PowerVS
+ - None
+ - OpenStack
+ maxLength: 100
+ type: string
+ x-kubernetes-validations:
+ - message: Type is immutable
+ rule: self == oldSelf
+ required:
+ - type
+ type: object
+ release:
+ description: |-
+ release specifies the OCP release used for this NodePool. It drives the machine ignition configuration (including
+ the kubelet version) and other platform-specific properties (e.g. an AMI on AWS).
+
+ Version-skew rules and effects:
+ - The minor-version skew relative to the control-plane release must be <= N-2.
+ This is not currently enforced, but exceeding this limit is unsupported and
+ may lead to unpredictable behavior.
+ - If the specified release is higher than the HostedCluster's release, the
+ NodePool will be degraded and the ValidReleaseImage condition will be false.
+ - If the specified release is lower than the NodePool's current y-stream,
+ the NodePool will be degraded and the ValidReleaseImage condition will be false.
+
+ Changing this field triggers a NodePool rollout.
+ properties:
+ image:
+ description: |-
+ image is the image pullspec of an OCP release payload image.
+ See https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags for a list of available images.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: Image must start with a word character (letters, digits,
+ or underscores) and contain no white spaces
+ rule: self.matches('^(\\w+\\S+)$')
+ required:
+ - image
+ type: object
+ replicas:
+ description: |-
+ replicas is the desired number of nodes the pool should maintain. If unset, the controller default value is 0.
+ replicas is mutually exclusive with autoscaling. If autoscaling is configured, replicas must be omitted and autoscaling will control the NodePool size internally.
+ format: int32
+ type: integer
+ taints:
+ description: |-
+ taints if specified, propagates a list of taints to Nodes, only once on creation.
+ These taints are additive to the ones applied by other controllers
+ items:
+ description: |-
+ taint is as v1 Core but without TimeAdded.
+ https://github.com/kubernetes/kubernetes/blob/ed8cad1e80d096257921908a52ac69cf1f41a098/staging/src/k8s.io/api/core/v1/types.go#L3037-L3053
+ Validation replicates the same validation as the upstream https://github.com/kubernetes/kubernetes/blob/9a2a7537f035969a68e432b4cc276dbce8ce1735/pkg/util/taints/taints.go#L273.
+ See also https://kubernetes.io/docs/concepts/overview/working-with-objects/names/.
+ properties:
+ effect:
+ description: |-
+ effect is the effect of the taint on pods
+ that do not tolerate the taint.
+ Valid effects are NoSchedule, PreferNoSchedule and NoExecute.
+ enum:
+ - NoSchedule
+ - PreferNoSchedule
+ - NoExecute
+ type: string
+ key:
+ description: key is the taint key to be applied to a node.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: key must be a qualified name with an optional subdomain
+ prefix e.g. example.com/MyName
+ rule: self.matches('^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/)?[A-Za-z0-9]([-A-Za-z0-9_.]{0,61}[A-Za-z0-9])?$')
+ value:
+ description: value is the taint value corresponding to the taint
+ key.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: Value must start and end with alphanumeric characters
+ and can only contain '-', '_', '.' in the middle
+ rule: self.matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$')
+ required:
+ - effect
+ - key
+ type: object
+ maxItems: 50
+ type: array
+ tuningConfig:
+ description: |-
+ tuningConfig is a list of references to ConfigMaps containing serialized
+ Tuned or PerformanceProfile resources to define the tuning configuration to be applied to
+ nodes in the NodePool. The Tuned API is defined here:
+
+ https://github.com/openshift/cluster-node-tuning-operator/blob/2c76314fb3cc8f12aef4a0dcd67ddc3677d5b54f/pkg/apis/tuned/v1/tuned_types.go
+
+ The PerformanceProfile API is defined here:
+ https://github.com/openshift/cluster-node-tuning-operator/tree/b41042d42d4ba5bb2e99960248cf1d6ae4935018/pkg/apis/performanceprofile/v2
+
+ Each ConfigMap must have a single key named "tuning" whose value is the
+ JSON or YAML of a serialized Tuned or PerformanceProfile.
+ Changing this field will trigger a NodePool rollout.
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ maxItems: 10
+ type: array
+ required:
+ - clusterName
+ - management
+ - platform
+ - release
+ type: object
+ x-kubernetes-validations:
+ - message: Arch is required once set
+ rule: '!has(oldSelf.arch) || has(self.arch)'
+ - message: Setting Arch to arm64 is only supported for AWS, Azure, Agent
+ and None
+ rule: self.arch != 'arm64' || has(self.platform.aws) || has(self.platform.azure)
+ || has(self.platform.agent) || self.platform.type == 'None'
+ - message: Both replicas or autoScaling should not be set
+ rule: '!has(self.replicas) || !has(self.autoScaling)'
+ - message: s390x is only supported on KubeVirt platform
+ rule: self.arch != 's390x' || has(self.platform.kubevirt)
+ - message: ImageType 'Windows' requires arch 'amd64' (AWS only)
+ rule: '(has(self.platform.aws) && has(self.platform.aws.imageType) &&
+ self.platform.aws.imageType == ''Windows'') ? self.arch == ''amd64''
+ : true'
+ status:
+ description: status is the latest observed status of the NodePool.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the latest available observations of the node pool's
+ current state.
+ items:
+ description: |-
+ We define our own condition type since metav1.Condition has validation
+ for Reason that might be broken by what we bubble up from CAPI.
+ NodePoolCondition defines an observation of NodePool resource operational state.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when
+ the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This field may be empty.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: observedGeneration represents the .metadata.generation
+ that the condition was set based upon.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason for the condition's last transition in CamelCase.
+ The specific API may choose whether or not this field is considered a guaranteed API.
+ This field may not be empty.
+ maxLength: 1024
+ type: string
+ severity:
+ description: |-
+ severity provides an explicit classification of Reason code, so the users or machines can immediately
+ understand the current situation and act accordingly.
+ The Severity field MUST be set only when Status=False.
+ maxLength: 1024
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ type: string
+ type:
+ description: |-
+ type of condition in CamelCase or in foo.example.com/CamelCase.
+ Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
+ can be useful (see .node.status.conditions), the ability to deconflict is important.
+ maxLength: 316
+ type: string
+ required:
+ - lastTransitionTime
+ - status
+ - type
+ type: object
+ maxItems: 100
+ type: array
+ platform:
+ description: platform holds the specific statuses
+ properties:
+ kubeVirt:
+ description: kubeVirt contains the KubeVirt platform statuses
+ properties:
+ cacheName:
+ description: cacheName holds the name of the cache DataVolume,
+ if exists
+ maxLength: 255
+ type: string
+ credentials:
+ description: |-
+ credentials shows the client credentials used when creating KubeVirt virtual machines.
+ This filed is only exists when the KubeVirt virtual machines are being placed
+ on a cluster separate from the one hosting the Hosted Control Plane components.
+
+ The default behavior when Credentials is not defined is for the KubeVirt VMs to be placed on
+ the same cluster and namespace as the Hosted Control Plane.
+ properties:
+ infraKubeConfigSecret:
+ description: |-
+ infraKubeConfigSecret is a reference to the secret containing the kubeconfig
+ of an external infrastructure cluster for kubevirt provider
+ properties:
+ key:
+ description: key is the key in the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: infraKubeConfigSecret is immutable
+ rule: self == oldSelf
+ infraNamespace:
+ description: |-
+ infraNamespace is the namespace in the external infrastructure cluster
+ where kubevirt resources will be created
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: infraNamespace is immutable
+ rule: self == oldSelf
+ required:
+ - infraNamespace
+ type: object
+ type: object
+ type: object
+ replicas:
+ description: replicas is the latest observed number of nodes in the
+ pool.
+ format: int32
+ type: integer
+ version:
+ description: |-
+ version is the semantic version of the latest applied release specified by
+ the NodePool.
+ maxLength: 64
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ scale:
+ specReplicasPath: .spec.replicas
+ statusReplicasPath: .status.replicas
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/nodepools-Default.crd.yaml b/cmd/install/assets/hypershift-operator/nodepools-Default.crd.yaml
new file mode 100644
index 00000000000..cc6ff0f2cf4
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/nodepools-Default.crd.yaml
@@ -0,0 +1,1615 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: Default
+ name: nodepools.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ kind: NodePool
+ listKind: NodePoolList
+ plural: nodepools
+ shortNames:
+ - np
+ - nps
+ singular: nodepool
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: Cluster
+ jsonPath: .spec.clusterName
+ name: Cluster
+ type: string
+ - description: Desired Nodes
+ jsonPath: .spec.replicas
+ name: Desired Nodes
+ type: integer
+ - description: Available Nodes
+ jsonPath: .status.replicas
+ name: Current Nodes
+ type: integer
+ - description: Autoscaling Enabled
+ jsonPath: .status.conditions[?(@.type=="AutoscalingEnabled")].status
+ name: Autoscaling
+ type: string
+ - description: Node Autorepair Enabled
+ jsonPath: .status.conditions[?(@.type=="AutorepairEnabled")].status
+ name: Autorepair
+ type: string
+ - description: Current version
+ jsonPath: .status.version
+ name: Version
+ type: string
+ - description: UpdatingVersion in progress
+ jsonPath: .status.conditions[?(@.type=="UpdatingVersion")].status
+ name: UpdatingVersion
+ type: string
+ - description: UpdatingConfig in progress
+ jsonPath: .status.conditions[?(@.type=="UpdatingConfig")].status
+ name: UpdatingConfig
+ type: string
+ - description: Message
+ jsonPath: .status.conditions[?(@.type=="Ready")].message
+ name: Message
+ type: string
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ NodePool is a scalable set of worker nodes attached to a HostedCluster.
+ NodePool machine architectures are uniform within a given pool, and are
+ independent of the control plane's underlying machine architecture.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the desired behavior of the NodePool.
+ properties:
+ arch:
+ default: amd64
+ description: "arch is the preferred processor architecture for the
+ NodePool. Different platforms might have different supported architectures.\n\thttps://github.com/kubernetes/kubernetes/issues/108768#issuecomment-1253912215"
+ enum:
+ - arm64
+ - amd64
+ - ppc64le
+ - s390x
+ type: string
+ x-kubernetes-validations:
+ - message: Arch is immutable
+ rule: self == oldSelf
+ autoScaling:
+ description: |-
+ autoScaling specifies auto-scaling behavior for the NodePool.
+ autoScaling is mutually exclusive with replicas. If replicas is set, this field must be omitted.
+ properties:
+ max:
+ description: max is the maximum number of nodes allowed in the
+ pool. Must be >= 1 and >= Min.
+ format: int32
+ minimum: 1
+ type: integer
+ min:
+ description: min is the minimum number of nodes to maintain in
+ the pool. Must be >= 1 and <= .Max.
+ format: int32
+ minimum: 1
+ type: integer
+ required:
+ - max
+ - min
+ type: object
+ x-kubernetes-validations:
+ - message: max must be equal or greater than min
+ rule: self.max >= self.min
+ clusterName:
+ description: |-
+ clusterName is the name of the HostedCluster this NodePool belongs to.
+ If a HostedCluster with this name doesn't exist, the controller will no-op until it exists.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: ClusterName is immutable
+ rule: self == oldSelf
+ - message: clusterName must consist of lowercase alphanumeric characters
+ or '-', start and end with an alphanumeric character, and be between
+ 1 and 253 characters
+ rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?$')
+ config:
+ description: |-
+ config is a list of references to ConfigMaps containing serialized
+ MachineConfig resources to be injected into the ignition configurations of
+ nodes in the NodePool. The MachineConfig API schema is defined here:
+
+ https://github.com/openshift/machine-config-operator/blob/18963e4f8fe66e8c513ca4b131620760a414997f/pkg/apis/machineconfiguration.openshift.io/v1/types.go#L185
+
+ Each ConfigMap must have a single key named "config" whose value is the YML
+ with one or more serialized machineconfiguration.openshift.io resources:
+
+ * KubeletConfig
+ * ContainerRuntimeConfig
+ * MachineConfig
+ * ClusterImagePolicy
+ * ImageContentSourcePolicy
+ * ImageDigestMirrorSet
+
+ This is validated in the backend and signaled back via validMachineConfig condition.
+ Changing this field will trigger a NodePool rollout.
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ maxItems: 10
+ type: array
+ management:
+ description: |-
+ management specifies behavior for managing nodes in the pool, such as
+ upgrade strategies and auto-repair behaviors.
+ properties:
+ autoRepair:
+ default: false
+ description: |-
+ autoRepair specifies whether health checks should be enabled for machines in the NodePool. The default is false.
+ Enabling this feature will cause the controller to automatically delete unhealthy machines.
+ The unhealthy criteria is reserved for the controller implementation and subject to change.
+ But generally it's determined by checking the Node ready condition is true and a timeout that might vary depending on the platform provider.
+ AutoRepair will no-op when more than 2 Nodes are unhealthy at the same time. Giving time for the cluster to stabilize or to the user to manually intervene.
+ type: boolean
+ inPlace:
+ description: inPlace is the configuration for in-place upgrades.
+ properties:
+ maxUnavailable:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ maxUnavailable is the maximum number of nodes that can be unavailable
+ during the update.
+
+ Value can be an absolute number (ex: 5) or a percentage of desired nodes
+ (ex: 10%).
+
+ Absolute number is calculated from percentage by rounding down.
+
+ Defaults to 1.
+
+ Example: when this is set to 30%, a max of 30% of the nodes can be made
+ unschedulable/unavailable immediately when the update starts. Once a set
+ of nodes is updated, more nodes can be made unschedulable for update,
+ ensuring that the total number of nodes schedulable at all times during
+ the update is at least 70% of desired nodes.
+ x-kubernetes-int-or-string: true
+ type: object
+ replace:
+ default:
+ rollingUpdate:
+ maxSurge: 1
+ maxUnavailable: 0
+ strategy: RollingUpdate
+ description: |-
+ replace is the configuration for rolling upgrades.
+ It defaults to a RollingUpdate strategy with maxSurge of 1 and maxUnavailable of 0.
+ properties:
+ rollingUpdate:
+ description: |-
+ rollingUpdate specifies a rolling update strategy which upgrades nodes by
+ creating new nodes and deleting the old ones.
+ properties:
+ maxSurge:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ maxSurge is the maximum number of nodes that can be provisioned above the
+ desired number of nodes.
+
+ Value can be an absolute number (ex: 5) or a percentage of desired nodes
+ (ex: 10%).
+
+ Absolute number is calculated from percentage by rounding up.
+
+ This can not be 0 if MaxUnavailable is 0.
+
+ Defaults to 1.
+
+ Example: when this is set to 30%, new nodes can be provisioned immediately
+ when the rolling update starts, such that the total number of old and new
+ nodes do not exceed 130% of desired nodes. Once old nodes have been
+ deleted, new nodes can be provisioned, ensuring that total number of nodes
+ running at any time during the update is at most 130% of desired nodes.
+ x-kubernetes-int-or-string: true
+ maxUnavailable:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ maxUnavailable is the maximum number of nodes that can be unavailable
+ during the update.
+
+ Value can be an absolute number (ex: 5) or a percentage of desired nodes
+ (ex: 10%).
+
+ Absolute number is calculated from percentage by rounding down.
+
+ This can not be 0 if MaxSurge is 0.
+
+ Defaults to 0.
+
+ Example: when this is set to 30%, old nodes can be deleted down to 70% of
+ desired nodes immediately when the rolling update starts. Once new nodes
+ are ready, more old nodes be deleted, followed by provisioning new nodes,
+ ensuring that the total number of nodes available at all times during the
+ update is at least 70% of desired nodes.
+ x-kubernetes-int-or-string: true
+ type: object
+ strategy:
+ description: |-
+ strategy is the node replacement strategy for nodes in the pool.
+ In can be either "RollingUpdate" or "OnDelete". RollingUpdate will rollout Nodes honoring maxSurge and maxUnavailable.
+ OnDelete provide more granular control and will replace nodes as the old ones are manually deleted.
+ enum:
+ - RollingUpdate
+ - OnDelete
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: The 'rollingUpdate' field can only be set when 'strategy'
+ is 'RollingUpdate'
+ rule: '!has(self.rollingUpdate) || self.strategy == ''RollingUpdate'''
+ upgradeType:
+ description: |-
+ upgradeType specifies the type of strategy for handling upgrades.
+ This can be either "Replace" or "InPlace".
+ "Replace" will update Nodes by recreating the underlying instances.
+ "InPlace" will update Nodes by applying changes to the existing instances. This might or might not result in a reboot.
+ enum:
+ - Replace
+ - InPlace
+ type: string
+ x-kubernetes-validations:
+ - message: UpgradeType is immutable
+ rule: self == oldSelf
+ required:
+ - upgradeType
+ type: object
+ x-kubernetes-validations:
+ - message: The 'inPlace' field can only be set when 'upgradeType'
+ is 'InPlace'
+ rule: '!has(self.inPlace) || self.upgradeType == ''InPlace'''
+ nodeDrainTimeout:
+ description: |-
+ nodeDrainTimeout is the maximum amount of time that the controller will spend on retrying to drain a node until it succeeds.
+ The default value is 0, meaning that the node can retry drain without any time limitations.
+ Changing this field propagate inplace into existing Nodes.
+ type: string
+ nodeLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeLabels propagates a list of labels to Nodes, only once on creation.
+ Valid values are those in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
+ type: object
+ nodeVolumeDetachTimeout:
+ description: |-
+ nodeVolumeDetachTimeout is the maximum amount of time that the controller will spend on detaching volumes from a node.
+ The default value is 0, meaning that the volumes will be detached from the node without any time limitations.
+ After the timeout, any remaining attached volumes will be ignored and the removal of the machine will continue.
+ Changing this field propagate inplace into existing Nodes.
+ type: string
+ pausedUntil:
+ description: |-
+ pausedUntil is a field that can be used to pause reconciliation on the NodePool controller. Resulting in any change to the NodePool being ignored.
+ Either a date can be provided in RFC3339 format or a boolean as in 'true', 'false', 'True', 'False'. If a date is
+ provided: reconciliation is paused on the resource until that date. If the boolean true is
+ provided: reconciliation is paused on the resource until the field is removed.
+ maxLength: 35
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: PausedUntil must be a date in RFC3339 format or 'True',
+ 'true', 'False' or 'false'
+ rule: self.matches('^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}.*$')
+ || self in ['true', 'false', 'True', 'False']
+ platform:
+ description: |-
+ platform specifies the underlying infrastructure provider for the NodePool
+ and is used to configure platform specific behavior.
+ properties:
+ agent:
+ description: agent specifies the configuration used when using
+ Agent platform.
+ properties:
+ agentLabelSelector:
+ description: |-
+ agentLabelSelector contains labels that must be set on an Agent in order to
+ be selected for a Machine.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector
+ requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector
+ applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ aws:
+ description: aws specifies the configuration used when operating
+ on AWS.
+ properties:
+ ami:
+ description: |-
+ ami is the image id to use for node instances. If unspecified, the default
+ is chosen based on the NodePool release payload image.
+ maxLength: 255
+ type: string
+ imageType:
+ description: |-
+ imageType specifies the type of image to use for node instances.
+ Valid values are "Linux" or "Windows"
+ When set to Windows, the controller will automatically populate the AMI field
+ with a Windows-compatible AMI based on the region and OpenShift version.
+ When the AMI field is also set, it will take precedence over automatic selection based
+ on imageType. Also note that Windows ImageType is only compatible with an Arch of amd64
+ enum:
+ - Windows
+ - Linux
+ type: string
+ instanceProfile:
+ description: instanceProfile is the AWS EC2 instance profile,
+ which is a container for an IAM role that the EC2 instance
+ uses.
+ maxLength: 255
+ type: string
+ instanceType:
+ description: instanceType is an ec2 instance type for node
+ instances (e.g. m5.large).
+ maxLength: 255
+ type: string
+ placement:
+ description: placement specifies the placement options for
+ the EC2 instances.
+ properties:
+ capacityReservation:
+ description: |-
+ capacityReservation specifies Capacity Reservation options for the NodePool instances.
+
+ Cannot be specified when tenancy is set to "host" as Dedicated Hosts
+ do not support Capacity Reservations. Compatible with "default" and "dedicated" tenancy.
+ properties:
+ id:
+ description: |-
+ id specifies the target Capacity Reservation into which the EC2 instances should be launched.
+ Must follow the format: cr- followed by 17 lowercase hexadecimal characters. For example: cr-0123456789abcdef0
+ When empty, no specific Capacity Reservation is targeted.
+
+ When specified, preference cannot be set to 'None' or 'Open' as these
+ are mutually exclusive with targeting a specific reservation. Use preference 'CapacityReservationsOnly'
+ or omit preference field when targeting a specific reservation.
+ maxLength: 20
+ type: string
+ x-kubernetes-validations:
+ - message: AWS Capacity Reservation ID must start
+ with 'cr-' followed by 17 lowercase hexadecimal
+ characters (e.g., cr-0123456789abcdef0)
+ rule: self.matches('^cr-[a-f0-9]{17}$')
+ marketType:
+ description: |-
+ marketType specifies the market type of the CapacityReservation for the EC2 instances. Valid values are OnDemand, CapacityBlocks and omitted:
+ - "OnDemand": EC2 instances run as standard On-Demand instances.
+ - "CapacityBlocks": scheduled pre-purchased compute capacity. Capacity Blocks is recommended when GPUs are needed to support ML workloads.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default value is CapacityBlocks.
+
+ When set to 'CapacityBlocks', a specific Capacity Reservation ID must be provided.
+ enum:
+ - OnDemand
+ - CapacityBlocks
+ type: string
+ preference:
+ description: |-
+ preference specifies the preference for use of Capacity Reservations by the instance. Valid values include:
+ - "": No preference (platform default)
+ - "Open": The instance may make use of open Capacity Reservations that match its AZ and InstanceType
+ - "None": The instance may not make use of any Capacity Reservations. This is to conserve open reservations for desired workloads
+ - "CapacityReservationsOnly": The instance will only run if matched or targeted to a Capacity Reservation
+
+ Cannot be set to 'None' or 'Open' when a specific Capacity Reservation ID is provided,
+ as targeting a specific reservation is mutually exclusive with these general preference settings.
+ enum:
+ - ""
+ - None
+ - CapacityReservationsOnly
+ - Open
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: AWS Capacity Reservation preference 'None'
+ or 'Open' is incompatible with specifying a Capacity
+ Reservation ID
+ rule: 'has(self.id) ? (!has(self.preference) || !(self.preference
+ in [''Open'',''None''])) : true'
+ - message: AWS Capacity Reservation market type 'CapacityBlocks'
+ requires a Capacity Reservation ID
+ rule: 'has(self.marketType) && self.marketType == ''CapacityBlocks''
+ ? has(self.id) : true'
+ tenancy:
+ description: |-
+ tenancy indicates if instance should run on shared or single-tenant hardware.
+
+ Possible values:
+ - "default": NodePool instances run on shared hardware.
+ - "dedicated": Each NodePool instance runs on single-tenant hardware (Dedicated Instances).
+ - "host": NodePool instances run on user's pre-allocated dedicated hosts (Dedicated Hosts).
+
+ When tenancy is set to "host", capacityReservation cannot be specified
+ as AWS does not support Capacity Reservations with Dedicated Hosts.
+ enum:
+ - default
+ - dedicated
+ - host
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: AWS Capacity Reservations cannot be used with Dedicated
+ Hosts (tenancy 'host')
+ rule: 'has(self.tenancy) && self.tenancy == ''host'' ? !has(self.capacityReservation)
+ : true'
+ resourceTags:
+ description: |-
+ resourceTags is an optional list of additional tags to apply to AWS node
+ instances. Changes to this field will be propagated in-place to AWS EC2 instances and their initial EBS volumes.
+ Volumes created by the storage operator and attached to instances after they are created do not get these tags applied.
+
+ These will be merged with HostedCluster scoped tags, which take precedence in case of conflicts.
+ These take precedence over tags defined out of band (i.e., tags added manually or by other tools outside of HyperShift) in AWS in case of conflicts.
+
+ See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for
+ information on tagging AWS resources. AWS supports a maximum of 50 tags per
+ resource. OpenShift reserves 25 tags for its use, leaving 25 tags available
+ for the user.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ value:
+ description: |-
+ value is the value of the tag.
+
+ Some AWS service do not support empty values. Since tags are added to
+ resources in many services, the length of the tag value must meet the
+ requirements of all services.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ rootVolume:
+ description: rootVolume specifies configuration for the root
+ volume of node instances.
+ properties:
+ encrypted:
+ description: encrypted indicates whether the EBS volume
+ should be encrypted or not.
+ type: boolean
+ encryptionKey:
+ description: encryptionKey is the KMS key to use for volume
+ encryption.
+ maxLength: 2048
+ type: string
+ iops:
+ description: |-
+ iops is the number of IOPS requested for the disk. This is only valid
+ for type io1.
+ format: int64
+ type: integer
+ size:
+ description: |-
+ size is the size of the volume in gibibytes (GiB).
+
+ Must be greater than the image snapshot size or 8 (whichever is greater).
+ format: int64
+ minimum: 8
+ type: integer
+ type:
+ description: type is the type of volume to provision.
+ maxLength: 255
+ type: string
+ required:
+ - size
+ - type
+ type: object
+ securityGroups:
+ description: |-
+ securityGroups is an optional set of security groups to associate with node
+ instances.
+ items:
+ description: |-
+ AWSResourceReference is a reference to a specific AWS resource by ID or filters.
+ Only one of ID or Filters may be specified. Specifying more than one will result in
+ a validation error.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify an
+ AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for the
+ filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ maxItems: 50
+ type: array
+ subnet:
+ description: subnet is the subnet to use for node instances.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify an
+ AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for the
+ filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: subnet is invalid, a valid subnet id or filters
+ must be set, but not both
+ rule: 'has(self.id) && self.id.startsWith(''subnet-'') ?
+ !has(self.filters) : size(self.filters) > 0'
+ required:
+ - instanceType
+ - subnet
+ type: object
+ azure:
+ description: azure specifies the configuration used when using
+ Azure platform.
+ properties:
+ availabilityZone:
+ description: |-
+ availabilityZone is the failure domain identifier where the VM should be attached to. This must not be specified
+ for clusters in a location that does not support AvailabilityZone because it would cause a failure from Azure API.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - rule: self in ['1', '2', '3']
+ diagnostics:
+ description: |-
+ diagnostics specifies the diagnostics settings for a virtual machine.
+ If not specified, then Boot diagnostics will be disabled.
+ properties:
+ storageAccountType:
+ allOf:
+ - enum:
+ - Managed
+ - UserManaged
+ - Disabled
+ - enum:
+ - Managed
+ - UserManaged
+ - Disabled
+ default: Disabled
+ description: |-
+ storageAccountType determines if the storage account for storing the diagnostics data
+ should be disabled (Disabled), provisioned by Azure (Managed) or by the user (UserManaged).
+ type: string
+ userManaged:
+ description: userManaged specifies the diagnostics settings
+ for a virtual machine when the storage account is managed
+ by the user.
+ properties:
+ storageAccountURI:
+ description: |-
+ storageAccountURI is the URI of the user-managed storage account.
+ The URI typically will be `https://.blob.core.windows.net/`
+ but may differ if you are using Azure DNS zone endpoints.
+ You can find the correct endpoint by looking for the Blob Primary Endpoint in the
+ endpoints tab in the Azure console or with the CLI by issuing
+ `az storage account list --query='[].{name: name, "resource group": resourceGroup, "blob endpoint": primaryEndpoints.blob}'`.
+ maxLength: 1024
+ type: string
+ x-kubernetes-validations:
+ - message: storageAccountURI must be a valid HTTPS
+ URL
+ rule: isURL(self) && url(self).getScheme() == 'https'
+ required:
+ - storageAccountURI
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: userManaged is required when storageAccountType
+ is UserManaged, and forbidden otherwise
+ rule: 'self.storageAccountType == ''UserManaged'' ? has(self.userManaged)
+ : !has(self.userManaged)'
+ encryptionAtHost:
+ default: Enabled
+ description: |-
+ encryptionAtHost enables encryption at host on virtual machines. According to Microsoft documentation, this
+ means data stored on the VM host is encrypted at rest and flows encrypted to the Storage service. See
+ https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal?tabs=azure-powershell
+ for more information.
+ enum:
+ - Enabled
+ - Disabled
+ type: string
+ image:
+ description: |-
+ image is used to configure the VM boot image. If unset, the default image at the location below will be used and
+ is expected to exist: subscription//resourceGroups//providers/Microsoft.Compute/images/rhcos.x86_64.vhd.
+ The and the are expected to be the same resource group documented in the
+ Hosted Cluster specification respectively, HostedCluster.Spec.Platform.Azure.SubscriptionID and
+ HostedCluster.Spec.Platform.Azure.ResourceGroupName.
+ properties:
+ azureMarketplace:
+ description: azureMarketplace contains the Azure Marketplace
+ image info to use to boot the Azure VMs from.
+ minProperties: 1
+ properties:
+ imageGeneration:
+ default: Gen2
+ description: |-
+ imageGeneration specifies the Hyper-V generation of the Azure Marketplace image to use for the nodes.
+ This field is used by HyperShift to select the appropriate marketplace image (Gen1 or Gen2)
+ from the release payload metadata when publisher, offer, sku, and version are not explicitly provided.
+ It is not passed to CAPZ (Cluster API Provider Azure); the generation information is
+ encoded into the SKU field that CAPZ uses.
+ Valid values are Gen1 and Gen2. If unspecified, defaults to Gen2.
+ enum:
+ - Gen1
+ - Gen2
+ type: string
+ offer:
+ description: offer specifies the name of a group of
+ related images created by the publisher.
+ maxLength: 255
+ minLength: 1
+ type: string
+ publisher:
+ description: |-
+ publisher is the name of the organization that created the image.
+ It must be between 3 and 50 characters in length, and consist of only lowercase letters, numbers, and hyphens (-) and underscores (_).
+ It must start with a lowercase letter or a number.
+ maxLength: 50
+ minLength: 3
+ pattern: ^[a-z0-9][a-z0-9-_]{2,49}$
+ type: string
+ sku:
+ description: |-
+ sku specifies an instance of an offer, such as a major release of a distribution.
+ For example, 22_04-lts-gen2, 8-lvm-gen2.
+ The value must consist only of lowercase letters, numbers, and hyphens (-) and underscores (_).
+ maxLength: 255
+ minLength: 1
+ pattern: ^[a-z0-9-_]+$
+ type: string
+ version:
+ description: |-
+ version specifies the version of an image sku. The allowed formats are Major.Minor.Build or 'latest'. Major,
+ Minor, and Build are decimal numbers, e.g. '1.2.0'. Specify 'latest' to use the latest version of an image available at
+ deployment time. Even if you use 'latest', the VM image will not automatically update after deploy time even if a
+ new version becomes available.
+ maxLength: 32
+ minLength: 1
+ pattern: ^[0-9]+\.[0-9]+\.[0-9]+$|^latest$
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: must specify imageGeneration or must specify
+ publisher, offer, sku and version
+ rule: has(self.imageGeneration) || has(self.publisher)
+ && has(self.offer) && has(self.sku) && has(self.version)
+ - message: publisher, offer, sku and version must either
+ be all set, or all omitted
+ rule: '[has(self.publisher), has(self.offer), has(self.sku),
+ has(self.version)].filter(x, x == true).size() ==
+ 0 || [has(self.publisher), has(self.offer), has(self.sku),
+ has(self.version)].filter(x, x == true).size() ==
+ 4'
+ imageID:
+ description: imageID is the Azure resource ID of a VHD
+ image to use to boot the Azure VMs from.
+ maxLength: 255
+ type: string
+ type:
+ description: |-
+ type is the type of image data that will be provided to the Azure VM.
+ Valid values are "ImageID" and "AzureMarketplace".
+ ImageID means is used for legacy managed VM images. This is where the user uploads a VM image directly to their resource group.
+ AzureMarketplace means the VM will boot from an Azure Marketplace image.
+ Marketplace images are preconfigured and published by the OS vendors and may include preconfigured software for the VM.
+ When Type is "AzureMarketplace", you can either:
+ 1. Specify only imageGeneration to use marketplace defaults from the release payload
+ 2. Specify publisher, offer, sku, and version to use an explicit marketplace image
+ 3. Specify all fields (imageGeneration along with publisher, offer, sku, version)
+ enum:
+ - ImageID
+ - AzureMarketplace
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: imageID is required when type is ImageID, and forbidden
+ otherwise
+ rule: 'has(self.type) && self.type == ''ImageID'' ? has(self.imageID)
+ : !has(self.imageID)'
+ - message: azureMarketplace is forbidden when type is not
+ AzureMarketplace
+ rule: 'has(self.type) && self.type == ''AzureMarketplace''
+ ? true : !has(self.azureMarketplace)'
+ osDisk:
+ description: |-
+ osDisk provides configuration for the OS disk for the nodepool.
+ This can be used to configure the size, storage account type, encryption options and whether the disk is persistent or ephemeral.
+ When not provided, the platform will choose reasonable defaults which are subject to change over time.
+ Review the fields within the osDisk for more details.
+ properties:
+ diskStorageAccountType:
+ description: |-
+ diskStorageAccountType is the disk storage account type to use.
+ Valid values are Premium_LRS, PremiumV2_LRS, Standard_LRS, StandardSSD_LRS, UltraSSD_LRS.
+ Note that Standard means a HDD.
+ The disk performance is tied to the disk type, please refer to the Azure documentation for further details
+ https://docs.microsoft.com/en-us/azure/virtual-machines/disks-types#disk-type-comparison.
+ When omitted this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is Premium SSD LRS.
+ enum:
+ - Premium_LRS
+ - PremiumV2_LRS
+ - Standard_LRS
+ - StandardSSD_LRS
+ - UltraSSD_LRS
+ type: string
+ encryptionSetID:
+ description: |-
+ encryptionSetID is the ID of the DiskEncryptionSet resource to use to encrypt the OS disks for the VMs.
+ Configuring a DiskEncyptionSet allows greater control over the encryption of the VM OS disk at rest.
+ Can be used with either platform (Azure) managed, or customer managed encryption keys.
+ This needs to exist in the same subscription id listed in the Hosted Cluster, HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ DiskEncryptionSetID should also exist in a resource group under the same subscription id and the same location
+ listed in the Hosted Cluster, HostedCluster.Spec.Platform.Azure.Location.
+ The encryptionSetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Copmute/diskEncryptionSets/{resourceName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The resourceName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores.
+ maxLength: 285
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/diskEncryptionSets/{resourceName}`
+ rule: size(self.split('/')) == 9 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Compute/diskEncryptionSets/.*$')
+ - message: the subscriptionId in the encryptionSetID must
+ be a valid UUID. It should be 5 groups of hyphen separated
+ hexadecimal characters in the form 8-4-4-4-12
+ rule: self.split('/')[2].matches('^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$')
+ - message: The resourceGroupName should be between 1 and
+ 90 characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the encryptionSetID
+ must not end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The resourceName should be between 1 and 80
+ characters, consisting only of alphanumeric characters,
+ hyphens and underscores
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_]{1,80}')
+ persistence:
+ description: |-
+ persistence determines whether the OS disk should be persisted beyond the life of the VM.
+ Valid values are Persistent and Ephemeral.
+ When set to Ephmeral, the OS disk will not be persisted to Azure storage and implies restrictions to the VM size and caching type.
+ Full details can be found in the Azure documentation https://learn.microsoft.com/en-us/azure/virtual-machines/ephemeral-os-disks.
+ Ephmeral disks are primarily used for stateless applications, provide lower latency than Persistent disks and also incur no storage costs.
+ When not set, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ enum:
+ - Persistent
+ - Ephemeral
+ type: string
+ sizeGiB:
+ description: |-
+ sizeGiB is the size in GiB (1024^3 bytes) to assign to the OS disk.
+ This should be between 16 and 65,536 when using the UltraSSD_LRS storage account type and between 16 and 32,767 when using any other storage account type.
+ When not set, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is 30.
+ format: int32
+ maximum: 65536
+ minimum: 16
+ type: integer
+ type: object
+ x-kubernetes-validations:
+ - message: When not using diskStorageAccountType UltraSSD_LRS,
+ the SizeGB value must be less than or equal to 32,767
+ rule: '!has(self.diskStorageAccountType) || self.diskStorageAccountType
+ != ''UltraSSD_LRS'' || self.sizeGiB <= 32767'
+ subnetID:
+ description: |-
+ subnetID is the subnet ID of an existing subnet where the nodes in the nodepool will be created. This can be a
+ different subnet than the one listed in the HostedCluster, HostedCluster.Spec.Platform.Azure.SubnetID, but must
+ exist in the same network, HostedCluster.Spec.Platform.Azure.VnetID, and must exist under the same subscription ID,
+ HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ subnetID is immutable once set.
+ The subnetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The vnetName should be between 2 and 64 characters, consisting only of alphanumeric characters, hyphens, underscores and periods and must not end with either a period (.) or hyphen (-) character.
+ The subnetName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores and must start with an alphanumeric character and must not end with a period (.) or hyphen (-) character.
+ maxLength: 355
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`
+ rule: size(self.split('/')) == 11 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Network/virtualNetworks/.*/subnets/.*$')
+ - message: the subscriptionId in the encryptionSetID must
+ be a valid UUID. It should be 5 groups of hyphen separated
+ hexadecimal characters in the form 8-4-4-4-12
+ rule: self.split('/')[2].matches('^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$')
+ - message: The resourceGroupName should be between 1 and 90
+ characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the subnetID must not
+ end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The vnetName should be between 2 and 64 characters,
+ consisting only of alphanumeric characters, hyphens, underscores
+ and periods
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_\\.]{2,64}')
+ - message: the vnetName in the subnetID must not end with
+ either a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[8].endsWith(''.'') && !self.split(''/'')[8].endsWith(''-'')'
+ - message: The subnetName should be between 1 and 80 characters,
+ consisting only of alphanumeric characters, hyphens and
+ underscores and must start with an alphanumeric character
+ rule: self.split('/')[10].matches('[a-zA-Z0-9][a-zA-Z0-9-_\\.]{0,79}')
+ - message: the subnetName in the subnetID must not end with
+ a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[10].endsWith(''.'') && !self.split(''/'')[10].endsWith(''-'')'
+ - message: SubnetID is immutable
+ rule: self == oldSelf
+ vmSize:
+ description: |-
+ vmSize is the Azure VM instance type to use for the nodes being created in the nodepool.
+ The size naming convention is documented here https://learn.microsoft.com/en-us/azure/virtual-machines/vm-naming-conventions.
+ Size names should start with a Family name, which is represented by one of more capital letters, and then be followed by the CPU count.
+ This is followed by 0 or more additional features, represented by a, b, d, i, l, m, p, t, s, C, and NP, refer to the Azure documentation for an explanation of these features.
+ Optionally an accelerator such as a GPU can be added, prefixed by an underscore, for example A100, H100 or MI300X.
+ The size may also be versioned, in which case it should be suffixed with _v where the version is a number.
+ For example, "D32ads_v5" would be a suitable general purpose VM size, or "ND96_MI300X_v5" would represent a GPU accelerated VM.
+ maxLength: 255
+ pattern: ^(Standard_|Basic_)?[A-Z]+[0-9]+(-[0-9]+)?[abdilmptsCNP]*(_[A-Z]*[0-9]+[A-Z]*)?(_v[0-9]+)?$
+ type: string
+ required:
+ - image
+ - osDisk
+ - subnetID
+ - vmSize
+ type: object
+ ibmcloud:
+ description: ibmcloud defines IBMCloud specific settings for components
+ properties:
+ providerType:
+ description: providerType is a specific supported infrastructure
+ provider within IBM Cloud.
+ type: string
+ type: object
+ kubevirt:
+ description: kubevirt specifies the configuration used when operating
+ on KubeVirt platform.
+ properties:
+ additionalNetworks:
+ description: additionalNetworks specify the extra networks
+ attached to the nodes
+ items:
+ description: |-
+ KubevirtNetwork specifies the configuration for a virtual machine
+ network interface
+ properties:
+ name:
+ description: |-
+ name specify the network attached to the nodes
+ it is a value with the format "[namespace]/[name]" to reference the
+ multus network attachment definition
+ maxLength: 255
+ type: string
+ required:
+ - name
+ type: object
+ maxItems: 20
+ type: array
+ attachDefaultNetwork:
+ default: true
+ description: |-
+ attachDefaultNetwork specify if the default pod network should be attached to the nodes
+ this can only be set to false if AdditionalNetworks are configured
+ type: boolean
+ compute:
+ default:
+ cores: 2
+ memory: 8Gi
+ description: compute contains values representing the virtual
+ hardware requested for the VM
+ properties:
+ cores:
+ description: cores is the number of CPU cores for the
+ KubeVirt VM.
+ format: int32
+ minimum: 1
+ type: integer
+ memory:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 8Gi
+ description: memory represents how much guest memory the
+ VM should have
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ qosClass:
+ default: Burstable
+ description: |-
+ qosClass if set to "Guaranteed", requests the scheduler to place the VirtualMachineInstance on a node with
+ limit memory and CPU, equal to be the requested values, to set the VMI as a Guaranteed QoS Class;
+ See here for more details:
+ https://kubevirt.io/user-guide/operations/node_overcommit/#requesting-the-right-qos-class-for-virtualmachineinstances
+ enum:
+ - Burstable
+ - Guaranteed
+ type: string
+ type: object
+ hostDevices:
+ description: |-
+ hostDevices specifies the host devices (e.g. GPU devices) to be passed
+ from the management cluster, to the nodepool nodes
+ items:
+ properties:
+ count:
+ default: 1
+ description: |-
+ count is the number of instances the specified host device will be attached to each of the
+ NodePool's nodes. Default is 1.
+ maximum: 2147483647
+ minimum: 1
+ type: integer
+ deviceName:
+ description: |-
+ deviceName is the name of the host device that is desired to be utilized in the HostedCluster's NodePool
+ The device can be any supported PCI device, including GPU, either as a passthrough or a vGPU slice.
+ maxLength: 255
+ type: string
+ required:
+ - deviceName
+ type: object
+ maxItems: 10
+ type: array
+ networkData:
+ description: |-
+ networkData is inline cloud-init network data configuration for VMs in this NodePool.
+ When specified, cloud-init volume changes from ConfigDrive to NoCloud.
+ This allows for static network configuration of VMs.
+ type: string
+ networkInterfaceMultiqueue:
+ default: Enable
+ description: |-
+ networkInterfaceMultiqueue if set to "Enable", virtual network interfaces configured with a virtio bus will also
+ enable the vhost multiqueue feature for network devices. The number of queues created depends on additional
+ factors of the VirtualMachineInstance, like the number of guest CPUs.
+ enum:
+ - Enable
+ - Disable
+ type: string
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is a selector which must be true for the kubevirt VirtualMachine to fit on a node.
+ Selector which must match a node's labels for the VM to be scheduled on that node. More info:
+ https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+ type: object
+ rootVolume:
+ default:
+ persistent:
+ size: 32Gi
+ type: Persistent
+ description: rootVolume represents values associated with
+ the VM volume that will host rhcos
+ properties:
+ cacheStrategy:
+ description: cacheStrategy defines the boot image caching
+ strategy. Default - no caching
+ properties:
+ type:
+ default: None
+ description: type is the type of the caching strategy
+ enum:
+ - None
+ - PVC
+ type: string
+ required:
+ - type
+ type: object
+ diskImage:
+ description: diskImage represents what rhcos image to
+ use for the node pool
+ properties:
+ containerDiskImage:
+ description: containerDiskImage is a string representing
+ the container image that holds the root disk
+ maxLength: 2048
+ type: string
+ type: object
+ persistent:
+ description: |-
+ persistent volume type means the VM's storage is backed by a PVC
+ VMs that use persistent volumes can survive disruption events like restart and eviction
+ This is the default type used when no storage type is defined.
+ properties:
+ accessModes:
+ description: |-
+ accessModes is an array that contains the desired Access Modes the root volume should have.
+ More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes
+ items:
+ enum:
+ - ReadWriteOnce
+ - ReadWriteMany
+ - ReadOnly
+ - ReadWriteOncePod
+ type: string
+ maxItems: 10
+ type: array
+ size:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 32Gi
+ description: size is the size of the persistent storage
+ volume
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ storageClass:
+ description: storageClass is the storageClass used
+ for the underlying PVC that hosts the volume
+ maxLength: 255
+ type: string
+ volumeMode:
+ description: |-
+ volumeMode defines what type of volume is required by the claim.
+ Value of Filesystem is implied when not included in claim spec.
+ enum:
+ - Filesystem
+ - Block
+ type: string
+ type: object
+ type:
+ default: Persistent
+ description: type represents the type of storage to associate
+ with the kubevirt VMs.
+ enum:
+ - Persistent
+ type: string
+ type: object
+ required:
+ - rootVolume
+ type: object
+ powervs:
+ description: powervs specifies the configuration used when using
+ IBMCloud PowerVS platform.
+ properties:
+ image:
+ description: |-
+ image used for deploying the nodes. If unspecified, the default
+ is chosen based on the NodePool release payload image.
+ properties:
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ name:
+ description: name of resource
+ maxLength: 255
+ type: string
+ type: object
+ imageDeletePolicy:
+ default: delete
+ description: |-
+ imageDeletePolicy is policy for the image deletion.
+
+ delete: delete the image from the infrastructure.
+ retain: delete the image from the openshift but retain in the infrastructure.
+
+ The default is delete
+ enum:
+ - delete
+ - retain
+ type: string
+ memoryGiB:
+ default: 32
+ description: |-
+ memoryGiB is the size of a virtual machine's memory, in GiB.
+ maximum value for the MemoryGiB depends on the selected SystemType.
+ when SystemType is set to e880 maximum MemoryGiB value is 7463 GiB.
+ when SystemType is set to e980 maximum MemoryGiB value is 15307 GiB.
+ when SystemType is set to s922 maximum MemoryGiB value is 942 GiB.
+ The minimum memory is 32 GiB.
+
+ When omitted, this means the user has no opinion and the platform is left to choose a reasonable
+ default. The current default is 32.
+ format: int32
+ type: integer
+ processorType:
+ default: shared
+ description: |-
+ processorType is the VM instance processor type.
+ It must be set to one of the following values: Dedicated, Capped or Shared.
+
+ Dedicated: resources are allocated for a specific client, The hypervisor makes a 1:1 binding of a partition's processor to a physical processor core.
+ Shared: Shared among other clients.
+ Capped: Shared, but resources do not expand beyond those that are requested, the amount of CPU time is Capped to the value specified for the entitlement.
+
+ if the processorType is selected as Dedicated, then Processors value cannot be fractional.
+ When omitted, this means that the user has no opinion and the platform is left to choose a
+ reasonable default. The current default is shared.
+ enum:
+ - dedicated
+ - shared
+ - capped
+ type: string
+ processors:
+ anyOf:
+ - type: integer
+ - type: string
+ default: "0.5"
+ description: |-
+ processors is the number of virtual processors in a virtual machine.
+ when the processorType is selected as Dedicated the processors value cannot be fractional.
+ maximum value for the Processors depends on the selected SystemType.
+ when SystemType is set to e880 or e980 maximum Processors value is 143.
+ when SystemType is set to s922 maximum Processors value is 15.
+ minimum value for Processors depends on the selected ProcessorType.
+ when ProcessorType is set as Shared or Capped, The minimum processors is 0.5.
+ when ProcessorType is set as Dedicated, The minimum processors is 1.
+ When omitted, this means that the user has no opinion and the platform is left to choose a
+ reasonable default. The default is set based on the selected ProcessorType.
+ when ProcessorType selected as Dedicated, the default is set to 1.
+ when ProcessorType selected as Shared or Capped, the default is set to 0.5.
+ x-kubernetes-int-or-string: true
+ storageType:
+ default: tier1
+ description: |-
+ storageType for the image and nodes, this will be ignored if Image is specified.
+ The storage tiers in PowerVS are based on I/O operations per second (IOPS).
+ It means that the performance of your storage volumes is limited to the maximum number of IOPS based on volume size and storage tier.
+ Although, the exact numbers might change over time, the Tier 3 storage is currently set to 3 IOPS/GB, and the Tier 1 storage is currently set to 10 IOPS/GB.
+
+ The default is tier1
+ enum:
+ - tier1
+ - tier3
+ type: string
+ systemType:
+ default: s922
+ description: |-
+ systemType is the System type used to host the instance.
+ systemType determines the number of cores and memory that is available.
+ Few of the supported SystemTypes are s922,e880,e980.
+ e880 systemType available only in Dallas Datacenters.
+ e980 systemType available in Datacenters except Dallas and Washington.
+ When omitted, this means that the user has no opinion and the platform is left to choose a
+ reasonable default. The current default is s922 which is generally available.
+ maxLength: 255
+ type: string
+ type: object
+ type:
+ description: type specifies the platform name.
+ enum:
+ - AWS
+ - Azure
+ - IBMCloud
+ - KubeVirt
+ - Agent
+ - PowerVS
+ - None
+ maxLength: 100
+ type: string
+ x-kubernetes-validations:
+ - message: Type is immutable
+ rule: self == oldSelf
+ required:
+ - type
+ type: object
+ release:
+ description: |-
+ release specifies the OCP release used for this NodePool. It drives the machine ignition configuration (including
+ the kubelet version) and other platform-specific properties (e.g. an AMI on AWS).
+
+ Version-skew rules and effects:
+ - The minor-version skew relative to the control-plane release must be <= N-2.
+ This is not currently enforced, but exceeding this limit is unsupported and
+ may lead to unpredictable behavior.
+ - If the specified release is higher than the HostedCluster's release, the
+ NodePool will be degraded and the ValidReleaseImage condition will be false.
+ - If the specified release is lower than the NodePool's current y-stream,
+ the NodePool will be degraded and the ValidReleaseImage condition will be false.
+
+ Changing this field triggers a NodePool rollout.
+ properties:
+ image:
+ description: |-
+ image is the image pullspec of an OCP release payload image.
+ See https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags for a list of available images.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: Image must start with a word character (letters, digits,
+ or underscores) and contain no white spaces
+ rule: self.matches('^(\\w+\\S+)$')
+ required:
+ - image
+ type: object
+ replicas:
+ description: |-
+ replicas is the desired number of nodes the pool should maintain. If unset, the controller default value is 0.
+ replicas is mutually exclusive with autoscaling. If autoscaling is configured, replicas must be omitted and autoscaling will control the NodePool size internally.
+ format: int32
+ type: integer
+ taints:
+ description: |-
+ taints if specified, propagates a list of taints to Nodes, only once on creation.
+ These taints are additive to the ones applied by other controllers
+ items:
+ description: |-
+ taint is as v1 Core but without TimeAdded.
+ https://github.com/kubernetes/kubernetes/blob/ed8cad1e80d096257921908a52ac69cf1f41a098/staging/src/k8s.io/api/core/v1/types.go#L3037-L3053
+ Validation replicates the same validation as the upstream https://github.com/kubernetes/kubernetes/blob/9a2a7537f035969a68e432b4cc276dbce8ce1735/pkg/util/taints/taints.go#L273.
+ See also https://kubernetes.io/docs/concepts/overview/working-with-objects/names/.
+ properties:
+ effect:
+ description: |-
+ effect is the effect of the taint on pods
+ that do not tolerate the taint.
+ Valid effects are NoSchedule, PreferNoSchedule and NoExecute.
+ enum:
+ - NoSchedule
+ - PreferNoSchedule
+ - NoExecute
+ type: string
+ key:
+ description: key is the taint key to be applied to a node.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: key must be a qualified name with an optional subdomain
+ prefix e.g. example.com/MyName
+ rule: self.matches('^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/)?[A-Za-z0-9]([-A-Za-z0-9_.]{0,61}[A-Za-z0-9])?$')
+ value:
+ description: value is the taint value corresponding to the taint
+ key.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: Value must start and end with alphanumeric characters
+ and can only contain '-', '_', '.' in the middle
+ rule: self.matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$')
+ required:
+ - effect
+ - key
+ type: object
+ maxItems: 50
+ type: array
+ tuningConfig:
+ description: |-
+ tuningConfig is a list of references to ConfigMaps containing serialized
+ Tuned or PerformanceProfile resources to define the tuning configuration to be applied to
+ nodes in the NodePool. The Tuned API is defined here:
+
+ https://github.com/openshift/cluster-node-tuning-operator/blob/2c76314fb3cc8f12aef4a0dcd67ddc3677d5b54f/pkg/apis/tuned/v1/tuned_types.go
+
+ The PerformanceProfile API is defined here:
+ https://github.com/openshift/cluster-node-tuning-operator/tree/b41042d42d4ba5bb2e99960248cf1d6ae4935018/pkg/apis/performanceprofile/v2
+
+ Each ConfigMap must have a single key named "tuning" whose value is the
+ JSON or YAML of a serialized Tuned or PerformanceProfile.
+ Changing this field will trigger a NodePool rollout.
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ maxItems: 10
+ type: array
+ required:
+ - clusterName
+ - management
+ - platform
+ - release
+ type: object
+ x-kubernetes-validations:
+ - message: Arch is required once set
+ rule: '!has(oldSelf.arch) || has(self.arch)'
+ - message: Setting Arch to arm64 is only supported for AWS, Azure, Agent
+ and None
+ rule: self.arch != 'arm64' || has(self.platform.aws) || has(self.platform.azure)
+ || has(self.platform.agent) || self.platform.type == 'None'
+ - message: Both replicas or autoScaling should not be set
+ rule: '!has(self.replicas) || !has(self.autoScaling)'
+ - message: s390x is only supported on KubeVirt platform
+ rule: self.arch != 's390x' || has(self.platform.kubevirt)
+ - message: ImageType 'Windows' requires arch 'amd64' (AWS only)
+ rule: '(has(self.platform.aws) && has(self.platform.aws.imageType) &&
+ self.platform.aws.imageType == ''Windows'') ? self.arch == ''amd64''
+ : true'
+ status:
+ description: status is the latest observed status of the NodePool.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the latest available observations of the node pool's
+ current state.
+ items:
+ description: |-
+ We define our own condition type since metav1.Condition has validation
+ for Reason that might be broken by what we bubble up from CAPI.
+ NodePoolCondition defines an observation of NodePool resource operational state.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when
+ the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This field may be empty.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: observedGeneration represents the .metadata.generation
+ that the condition was set based upon.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason for the condition's last transition in CamelCase.
+ The specific API may choose whether or not this field is considered a guaranteed API.
+ This field may not be empty.
+ maxLength: 1024
+ type: string
+ severity:
+ description: |-
+ severity provides an explicit classification of Reason code, so the users or machines can immediately
+ understand the current situation and act accordingly.
+ The Severity field MUST be set only when Status=False.
+ maxLength: 1024
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ type: string
+ type:
+ description: |-
+ type of condition in CamelCase or in foo.example.com/CamelCase.
+ Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
+ can be useful (see .node.status.conditions), the ability to deconflict is important.
+ maxLength: 316
+ type: string
+ required:
+ - lastTransitionTime
+ - status
+ - type
+ type: object
+ maxItems: 100
+ type: array
+ platform:
+ description: platform holds the specific statuses
+ properties:
+ kubeVirt:
+ description: kubeVirt contains the KubeVirt platform statuses
+ properties:
+ cacheName:
+ description: cacheName holds the name of the cache DataVolume,
+ if exists
+ maxLength: 255
+ type: string
+ credentials:
+ description: |-
+ credentials shows the client credentials used when creating KubeVirt virtual machines.
+ This filed is only exists when the KubeVirt virtual machines are being placed
+ on a cluster separate from the one hosting the Hosted Control Plane components.
+
+ The default behavior when Credentials is not defined is for the KubeVirt VMs to be placed on
+ the same cluster and namespace as the Hosted Control Plane.
+ properties:
+ infraKubeConfigSecret:
+ description: |-
+ infraKubeConfigSecret is a reference to the secret containing the kubeconfig
+ of an external infrastructure cluster for kubevirt provider
+ properties:
+ key:
+ description: key is the key in the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: infraKubeConfigSecret is immutable
+ rule: self == oldSelf
+ infraNamespace:
+ description: |-
+ infraNamespace is the namespace in the external infrastructure cluster
+ where kubevirt resources will be created
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: infraNamespace is immutable
+ rule: self == oldSelf
+ required:
+ - infraNamespace
+ type: object
+ type: object
+ type: object
+ replicas:
+ description: replicas is the latest observed number of nodes in the
+ pool.
+ format: int32
+ type: integer
+ version:
+ description: |-
+ version is the semantic version of the latest applied release specified by
+ the NodePool.
+ maxLength: 64
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ scale:
+ specReplicasPath: .spec.replicas
+ statusReplicasPath: .status.replicas
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/nodepools-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/nodepools-TechPreviewNoUpgrade.crd.yaml
new file mode 100644
index 00000000000..5e13a23b14b
--- /dev/null
+++ b/cmd/install/assets/hypershift-operator/nodepools-TechPreviewNoUpgrade.crd.yaml
@@ -0,0 +1,1801 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ api.openshift.io/merged-by-featuregates: "true"
+ include.release.openshift.io/ibm-cloud-managed: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ release.openshift.io/feature-set: TechPreviewNoUpgrade
+ name: nodepools.hypershift.openshift.io
+spec:
+ group: hypershift.openshift.io
+ names:
+ kind: NodePool
+ listKind: NodePoolList
+ plural: nodepools
+ shortNames:
+ - np
+ - nps
+ singular: nodepool
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: Cluster
+ jsonPath: .spec.clusterName
+ name: Cluster
+ type: string
+ - description: Desired Nodes
+ jsonPath: .spec.replicas
+ name: Desired Nodes
+ type: integer
+ - description: Available Nodes
+ jsonPath: .status.replicas
+ name: Current Nodes
+ type: integer
+ - description: Autoscaling Enabled
+ jsonPath: .status.conditions[?(@.type=="AutoscalingEnabled")].status
+ name: Autoscaling
+ type: string
+ - description: Node Autorepair Enabled
+ jsonPath: .status.conditions[?(@.type=="AutorepairEnabled")].status
+ name: Autorepair
+ type: string
+ - description: Current version
+ jsonPath: .status.version
+ name: Version
+ type: string
+ - description: UpdatingVersion in progress
+ jsonPath: .status.conditions[?(@.type=="UpdatingVersion")].status
+ name: UpdatingVersion
+ type: string
+ - description: UpdatingConfig in progress
+ jsonPath: .status.conditions[?(@.type=="UpdatingConfig")].status
+ name: UpdatingConfig
+ type: string
+ - description: Message
+ jsonPath: .status.conditions[?(@.type=="Ready")].message
+ name: Message
+ type: string
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ NodePool is a scalable set of worker nodes attached to a HostedCluster.
+ NodePool machine architectures are uniform within a given pool, and are
+ independent of the control plane's underlying machine architecture.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: spec is the desired behavior of the NodePool.
+ properties:
+ arch:
+ default: amd64
+ description: "arch is the preferred processor architecture for the
+ NodePool. Different platforms might have different supported architectures.\n\thttps://github.com/kubernetes/kubernetes/issues/108768#issuecomment-1253912215"
+ enum:
+ - arm64
+ - amd64
+ - ppc64le
+ - s390x
+ type: string
+ x-kubernetes-validations:
+ - message: Arch is immutable
+ rule: self == oldSelf
+ autoScaling:
+ description: |-
+ autoScaling specifies auto-scaling behavior for the NodePool.
+ autoScaling is mutually exclusive with replicas. If replicas is set, this field must be omitted.
+ properties:
+ max:
+ description: max is the maximum number of nodes allowed in the
+ pool. Must be >= 1 and >= Min.
+ format: int32
+ minimum: 1
+ type: integer
+ min:
+ description: min is the minimum number of nodes to maintain in
+ the pool. Must be >= 1 and <= .Max.
+ format: int32
+ minimum: 1
+ type: integer
+ required:
+ - max
+ - min
+ type: object
+ x-kubernetes-validations:
+ - message: max must be equal or greater than min
+ rule: self.max >= self.min
+ clusterName:
+ description: |-
+ clusterName is the name of the HostedCluster this NodePool belongs to.
+ If a HostedCluster with this name doesn't exist, the controller will no-op until it exists.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: ClusterName is immutable
+ rule: self == oldSelf
+ - message: clusterName must consist of lowercase alphanumeric characters
+ or '-', start and end with an alphanumeric character, and be between
+ 1 and 253 characters
+ rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?$')
+ config:
+ description: |-
+ config is a list of references to ConfigMaps containing serialized
+ MachineConfig resources to be injected into the ignition configurations of
+ nodes in the NodePool. The MachineConfig API schema is defined here:
+
+ https://github.com/openshift/machine-config-operator/blob/18963e4f8fe66e8c513ca4b131620760a414997f/pkg/apis/machineconfiguration.openshift.io/v1/types.go#L185
+
+ Each ConfigMap must have a single key named "config" whose value is the YML
+ with one or more serialized machineconfiguration.openshift.io resources:
+
+ * KubeletConfig
+ * ContainerRuntimeConfig
+ * MachineConfig
+ * ClusterImagePolicy
+ * ImageContentSourcePolicy
+ * ImageDigestMirrorSet
+
+ This is validated in the backend and signaled back via validMachineConfig condition.
+ Changing this field will trigger a NodePool rollout.
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ maxItems: 10
+ type: array
+ management:
+ description: |-
+ management specifies behavior for managing nodes in the pool, such as
+ upgrade strategies and auto-repair behaviors.
+ properties:
+ autoRepair:
+ default: false
+ description: |-
+ autoRepair specifies whether health checks should be enabled for machines in the NodePool. The default is false.
+ Enabling this feature will cause the controller to automatically delete unhealthy machines.
+ The unhealthy criteria is reserved for the controller implementation and subject to change.
+ But generally it's determined by checking the Node ready condition is true and a timeout that might vary depending on the platform provider.
+ AutoRepair will no-op when more than 2 Nodes are unhealthy at the same time. Giving time for the cluster to stabilize or to the user to manually intervene.
+ type: boolean
+ inPlace:
+ description: inPlace is the configuration for in-place upgrades.
+ properties:
+ maxUnavailable:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ maxUnavailable is the maximum number of nodes that can be unavailable
+ during the update.
+
+ Value can be an absolute number (ex: 5) or a percentage of desired nodes
+ (ex: 10%).
+
+ Absolute number is calculated from percentage by rounding down.
+
+ Defaults to 1.
+
+ Example: when this is set to 30%, a max of 30% of the nodes can be made
+ unschedulable/unavailable immediately when the update starts. Once a set
+ of nodes is updated, more nodes can be made unschedulable for update,
+ ensuring that the total number of nodes schedulable at all times during
+ the update is at least 70% of desired nodes.
+ x-kubernetes-int-or-string: true
+ type: object
+ replace:
+ default:
+ rollingUpdate:
+ maxSurge: 1
+ maxUnavailable: 0
+ strategy: RollingUpdate
+ description: |-
+ replace is the configuration for rolling upgrades.
+ It defaults to a RollingUpdate strategy with maxSurge of 1 and maxUnavailable of 0.
+ properties:
+ rollingUpdate:
+ description: |-
+ rollingUpdate specifies a rolling update strategy which upgrades nodes by
+ creating new nodes and deleting the old ones.
+ properties:
+ maxSurge:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ maxSurge is the maximum number of nodes that can be provisioned above the
+ desired number of nodes.
+
+ Value can be an absolute number (ex: 5) or a percentage of desired nodes
+ (ex: 10%).
+
+ Absolute number is calculated from percentage by rounding up.
+
+ This can not be 0 if MaxUnavailable is 0.
+
+ Defaults to 1.
+
+ Example: when this is set to 30%, new nodes can be provisioned immediately
+ when the rolling update starts, such that the total number of old and new
+ nodes do not exceed 130% of desired nodes. Once old nodes have been
+ deleted, new nodes can be provisioned, ensuring that total number of nodes
+ running at any time during the update is at most 130% of desired nodes.
+ x-kubernetes-int-or-string: true
+ maxUnavailable:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ maxUnavailable is the maximum number of nodes that can be unavailable
+ during the update.
+
+ Value can be an absolute number (ex: 5) or a percentage of desired nodes
+ (ex: 10%).
+
+ Absolute number is calculated from percentage by rounding down.
+
+ This can not be 0 if MaxSurge is 0.
+
+ Defaults to 0.
+
+ Example: when this is set to 30%, old nodes can be deleted down to 70% of
+ desired nodes immediately when the rolling update starts. Once new nodes
+ are ready, more old nodes be deleted, followed by provisioning new nodes,
+ ensuring that the total number of nodes available at all times during the
+ update is at least 70% of desired nodes.
+ x-kubernetes-int-or-string: true
+ type: object
+ strategy:
+ description: |-
+ strategy is the node replacement strategy for nodes in the pool.
+ In can be either "RollingUpdate" or "OnDelete". RollingUpdate will rollout Nodes honoring maxSurge and maxUnavailable.
+ OnDelete provide more granular control and will replace nodes as the old ones are manually deleted.
+ enum:
+ - RollingUpdate
+ - OnDelete
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: The 'rollingUpdate' field can only be set when 'strategy'
+ is 'RollingUpdate'
+ rule: '!has(self.rollingUpdate) || self.strategy == ''RollingUpdate'''
+ upgradeType:
+ description: |-
+ upgradeType specifies the type of strategy for handling upgrades.
+ This can be either "Replace" or "InPlace".
+ "Replace" will update Nodes by recreating the underlying instances.
+ "InPlace" will update Nodes by applying changes to the existing instances. This might or might not result in a reboot.
+ enum:
+ - Replace
+ - InPlace
+ type: string
+ x-kubernetes-validations:
+ - message: UpgradeType is immutable
+ rule: self == oldSelf
+ required:
+ - upgradeType
+ type: object
+ x-kubernetes-validations:
+ - message: The 'inPlace' field can only be set when 'upgradeType'
+ is 'InPlace'
+ rule: '!has(self.inPlace) || self.upgradeType == ''InPlace'''
+ nodeDrainTimeout:
+ description: |-
+ nodeDrainTimeout is the maximum amount of time that the controller will spend on retrying to drain a node until it succeeds.
+ The default value is 0, meaning that the node can retry drain without any time limitations.
+ Changing this field propagate inplace into existing Nodes.
+ type: string
+ nodeLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeLabels propagates a list of labels to Nodes, only once on creation.
+ Valid values are those in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
+ type: object
+ nodeVolumeDetachTimeout:
+ description: |-
+ nodeVolumeDetachTimeout is the maximum amount of time that the controller will spend on detaching volumes from a node.
+ The default value is 0, meaning that the volumes will be detached from the node without any time limitations.
+ After the timeout, any remaining attached volumes will be ignored and the removal of the machine will continue.
+ Changing this field propagate inplace into existing Nodes.
+ type: string
+ pausedUntil:
+ description: |-
+ pausedUntil is a field that can be used to pause reconciliation on the NodePool controller. Resulting in any change to the NodePool being ignored.
+ Either a date can be provided in RFC3339 format or a boolean as in 'true', 'false', 'True', 'False'. If a date is
+ provided: reconciliation is paused on the resource until that date. If the boolean true is
+ provided: reconciliation is paused on the resource until the field is removed.
+ maxLength: 35
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: PausedUntil must be a date in RFC3339 format or 'True',
+ 'true', 'False' or 'false'
+ rule: self.matches('^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}.*$')
+ || self in ['true', 'false', 'True', 'False']
+ platform:
+ description: |-
+ platform specifies the underlying infrastructure provider for the NodePool
+ and is used to configure platform specific behavior.
+ properties:
+ agent:
+ description: agent specifies the configuration used when using
+ Agent platform.
+ properties:
+ agentLabelSelector:
+ description: |-
+ agentLabelSelector contains labels that must be set on an Agent in order to
+ be selected for a Machine.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector
+ requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector
+ applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ aws:
+ description: aws specifies the configuration used when operating
+ on AWS.
+ properties:
+ ami:
+ description: |-
+ ami is the image id to use for node instances. If unspecified, the default
+ is chosen based on the NodePool release payload image.
+ maxLength: 255
+ type: string
+ imageType:
+ description: |-
+ imageType specifies the type of image to use for node instances.
+ Valid values are "Linux" or "Windows"
+ When set to Windows, the controller will automatically populate the AMI field
+ with a Windows-compatible AMI based on the region and OpenShift version.
+ When the AMI field is also set, it will take precedence over automatic selection based
+ on imageType. Also note that Windows ImageType is only compatible with an Arch of amd64
+ enum:
+ - Windows
+ - Linux
+ type: string
+ instanceProfile:
+ description: instanceProfile is the AWS EC2 instance profile,
+ which is a container for an IAM role that the EC2 instance
+ uses.
+ maxLength: 255
+ type: string
+ instanceType:
+ description: instanceType is an ec2 instance type for node
+ instances (e.g. m5.large).
+ maxLength: 255
+ type: string
+ placement:
+ description: placement specifies the placement options for
+ the EC2 instances.
+ properties:
+ capacityReservation:
+ description: |-
+ capacityReservation specifies Capacity Reservation options for the NodePool instances.
+
+ Cannot be specified when tenancy is set to "host" as Dedicated Hosts
+ do not support Capacity Reservations. Compatible with "default" and "dedicated" tenancy.
+ properties:
+ id:
+ description: |-
+ id specifies the target Capacity Reservation into which the EC2 instances should be launched.
+ Must follow the format: cr- followed by 17 lowercase hexadecimal characters. For example: cr-0123456789abcdef0
+ When empty, no specific Capacity Reservation is targeted.
+
+ When specified, preference cannot be set to 'None' or 'Open' as these
+ are mutually exclusive with targeting a specific reservation. Use preference 'CapacityReservationsOnly'
+ or omit preference field when targeting a specific reservation.
+ maxLength: 20
+ type: string
+ x-kubernetes-validations:
+ - message: AWS Capacity Reservation ID must start
+ with 'cr-' followed by 17 lowercase hexadecimal
+ characters (e.g., cr-0123456789abcdef0)
+ rule: self.matches('^cr-[a-f0-9]{17}$')
+ marketType:
+ description: |-
+ marketType specifies the market type of the CapacityReservation for the EC2 instances. Valid values are OnDemand, CapacityBlocks and omitted:
+ - "OnDemand": EC2 instances run as standard On-Demand instances.
+ - "CapacityBlocks": scheduled pre-purchased compute capacity. Capacity Blocks is recommended when GPUs are needed to support ML workloads.
+ When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default value is CapacityBlocks.
+
+ When set to 'CapacityBlocks', a specific Capacity Reservation ID must be provided.
+ enum:
+ - OnDemand
+ - CapacityBlocks
+ type: string
+ preference:
+ description: |-
+ preference specifies the preference for use of Capacity Reservations by the instance. Valid values include:
+ - "": No preference (platform default)
+ - "Open": The instance may make use of open Capacity Reservations that match its AZ and InstanceType
+ - "None": The instance may not make use of any Capacity Reservations. This is to conserve open reservations for desired workloads
+ - "CapacityReservationsOnly": The instance will only run if matched or targeted to a Capacity Reservation
+
+ Cannot be set to 'None' or 'Open' when a specific Capacity Reservation ID is provided,
+ as targeting a specific reservation is mutually exclusive with these general preference settings.
+ enum:
+ - ""
+ - None
+ - CapacityReservationsOnly
+ - Open
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: AWS Capacity Reservation preference 'None'
+ or 'Open' is incompatible with specifying a Capacity
+ Reservation ID
+ rule: 'has(self.id) ? (!has(self.preference) || !(self.preference
+ in [''Open'',''None''])) : true'
+ - message: AWS Capacity Reservation market type 'CapacityBlocks'
+ requires a Capacity Reservation ID
+ rule: 'has(self.marketType) && self.marketType == ''CapacityBlocks''
+ ? has(self.id) : true'
+ tenancy:
+ description: |-
+ tenancy indicates if instance should run on shared or single-tenant hardware.
+
+ Possible values:
+ - "default": NodePool instances run on shared hardware.
+ - "dedicated": Each NodePool instance runs on single-tenant hardware (Dedicated Instances).
+ - "host": NodePool instances run on user's pre-allocated dedicated hosts (Dedicated Hosts).
+
+ When tenancy is set to "host", capacityReservation cannot be specified
+ as AWS does not support Capacity Reservations with Dedicated Hosts.
+ enum:
+ - default
+ - dedicated
+ - host
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: AWS Capacity Reservations cannot be used with Dedicated
+ Hosts (tenancy 'host')
+ rule: 'has(self.tenancy) && self.tenancy == ''host'' ? !has(self.capacityReservation)
+ : true'
+ resourceTags:
+ description: |-
+ resourceTags is an optional list of additional tags to apply to AWS node
+ instances. Changes to this field will be propagated in-place to AWS EC2 instances and their initial EBS volumes.
+ Volumes created by the storage operator and attached to instances after they are created do not get these tags applied.
+
+ These will be merged with HostedCluster scoped tags, which take precedence in case of conflicts.
+ These take precedence over tags defined out of band (i.e., tags added manually or by other tools outside of HyperShift) in AWS in case of conflicts.
+
+ See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for
+ information on tagging AWS resources. AWS supports a maximum of 50 tags per
+ resource. OpenShift reserves 25 tags for its use, leaving 25 tags available
+ for the user.
+ items:
+ description: AWSResourceTag is a tag to apply to AWS resources
+ created for the cluster.
+ properties:
+ key:
+ description: key is the key of the tag.
+ maxLength: 128
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ value:
+ description: |-
+ value is the value of the tag.
+
+ Some AWS service do not support empty values. Since tags are added to
+ resources in many services, the length of the tag value must meet the
+ requirements of all services.
+ maxLength: 256
+ minLength: 1
+ pattern: ^[0-9A-Za-z_.:/=+-@]+$
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ maxItems: 25
+ type: array
+ rootVolume:
+ description: rootVolume specifies configuration for the root
+ volume of node instances.
+ properties:
+ encrypted:
+ description: encrypted indicates whether the EBS volume
+ should be encrypted or not.
+ type: boolean
+ encryptionKey:
+ description: encryptionKey is the KMS key to use for volume
+ encryption.
+ maxLength: 2048
+ type: string
+ iops:
+ description: |-
+ iops is the number of IOPS requested for the disk. This is only valid
+ for type io1.
+ format: int64
+ type: integer
+ size:
+ description: |-
+ size is the size of the volume in gibibytes (GiB).
+
+ Must be greater than the image snapshot size or 8 (whichever is greater).
+ format: int64
+ minimum: 8
+ type: integer
+ type:
+ description: type is the type of volume to provision.
+ maxLength: 255
+ type: string
+ required:
+ - size
+ - type
+ type: object
+ securityGroups:
+ description: |-
+ securityGroups is an optional set of security groups to associate with node
+ instances.
+ items:
+ description: |-
+ AWSResourceReference is a reference to a specific AWS resource by ID or filters.
+ Only one of ID or Filters may be specified. Specifying more than one will result in
+ a validation error.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify an
+ AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for the
+ filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ maxItems: 50
+ type: array
+ subnet:
+ description: subnet is the subnet to use for node instances.
+ properties:
+ filters:
+ description: |-
+ filters is a set of key/value pairs used to identify a resource
+ They are applied according to the rules defined by the AWS API:
+ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
+ items:
+ description: Filter is a filter used to identify an
+ AWS resource
+ properties:
+ name:
+ description: name is the name of the filter.
+ maxLength: 255
+ type: string
+ values:
+ description: values is a list of values for the
+ filter.
+ items:
+ maxLength: 255
+ type: string
+ maxItems: 50
+ type: array
+ required:
+ - name
+ - values
+ type: object
+ maxItems: 50
+ type: array
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: subnet is invalid, a valid subnet id or filters
+ must be set, but not both
+ rule: 'has(self.id) && self.id.startsWith(''subnet-'') ?
+ !has(self.filters) : size(self.filters) > 0'
+ required:
+ - instanceType
+ - subnet
+ type: object
+ azure:
+ description: azure specifies the configuration used when using
+ Azure platform.
+ properties:
+ availabilityZone:
+ description: |-
+ availabilityZone is the failure domain identifier where the VM should be attached to. This must not be specified
+ for clusters in a location that does not support AvailabilityZone because it would cause a failure from Azure API.
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - rule: self in ['1', '2', '3']
+ diagnostics:
+ description: |-
+ diagnostics specifies the diagnostics settings for a virtual machine.
+ If not specified, then Boot diagnostics will be disabled.
+ properties:
+ storageAccountType:
+ allOf:
+ - enum:
+ - Managed
+ - UserManaged
+ - Disabled
+ - enum:
+ - Managed
+ - UserManaged
+ - Disabled
+ default: Disabled
+ description: |-
+ storageAccountType determines if the storage account for storing the diagnostics data
+ should be disabled (Disabled), provisioned by Azure (Managed) or by the user (UserManaged).
+ type: string
+ userManaged:
+ description: userManaged specifies the diagnostics settings
+ for a virtual machine when the storage account is managed
+ by the user.
+ properties:
+ storageAccountURI:
+ description: |-
+ storageAccountURI is the URI of the user-managed storage account.
+ The URI typically will be `https://.blob.core.windows.net/`
+ but may differ if you are using Azure DNS zone endpoints.
+ You can find the correct endpoint by looking for the Blob Primary Endpoint in the
+ endpoints tab in the Azure console or with the CLI by issuing
+ `az storage account list --query='[].{name: name, "resource group": resourceGroup, "blob endpoint": primaryEndpoints.blob}'`.
+ maxLength: 1024
+ type: string
+ x-kubernetes-validations:
+ - message: storageAccountURI must be a valid HTTPS
+ URL
+ rule: isURL(self) && url(self).getScheme() == 'https'
+ required:
+ - storageAccountURI
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: userManaged is required when storageAccountType
+ is UserManaged, and forbidden otherwise
+ rule: 'self.storageAccountType == ''UserManaged'' ? has(self.userManaged)
+ : !has(self.userManaged)'
+ encryptionAtHost:
+ default: Enabled
+ description: |-
+ encryptionAtHost enables encryption at host on virtual machines. According to Microsoft documentation, this
+ means data stored on the VM host is encrypted at rest and flows encrypted to the Storage service. See
+ https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal?tabs=azure-powershell
+ for more information.
+ enum:
+ - Enabled
+ - Disabled
+ type: string
+ image:
+ description: |-
+ image is used to configure the VM boot image. If unset, the default image at the location below will be used and
+ is expected to exist: subscription//resourceGroups//providers/Microsoft.Compute/images/rhcos.x86_64.vhd.
+ The and the are expected to be the same resource group documented in the
+ Hosted Cluster specification respectively, HostedCluster.Spec.Platform.Azure.SubscriptionID and
+ HostedCluster.Spec.Platform.Azure.ResourceGroupName.
+ properties:
+ azureMarketplace:
+ description: azureMarketplace contains the Azure Marketplace
+ image info to use to boot the Azure VMs from.
+ minProperties: 1
+ properties:
+ imageGeneration:
+ default: Gen2
+ description: |-
+ imageGeneration specifies the Hyper-V generation of the Azure Marketplace image to use for the nodes.
+ This field is used by HyperShift to select the appropriate marketplace image (Gen1 or Gen2)
+ from the release payload metadata when publisher, offer, sku, and version are not explicitly provided.
+ It is not passed to CAPZ (Cluster API Provider Azure); the generation information is
+ encoded into the SKU field that CAPZ uses.
+ Valid values are Gen1 and Gen2. If unspecified, defaults to Gen2.
+ enum:
+ - Gen1
+ - Gen2
+ type: string
+ offer:
+ description: offer specifies the name of a group of
+ related images created by the publisher.
+ maxLength: 255
+ minLength: 1
+ type: string
+ publisher:
+ description: |-
+ publisher is the name of the organization that created the image.
+ It must be between 3 and 50 characters in length, and consist of only lowercase letters, numbers, and hyphens (-) and underscores (_).
+ It must start with a lowercase letter or a number.
+ maxLength: 50
+ minLength: 3
+ pattern: ^[a-z0-9][a-z0-9-_]{2,49}$
+ type: string
+ sku:
+ description: |-
+ sku specifies an instance of an offer, such as a major release of a distribution.
+ For example, 22_04-lts-gen2, 8-lvm-gen2.
+ The value must consist only of lowercase letters, numbers, and hyphens (-) and underscores (_).
+ maxLength: 255
+ minLength: 1
+ pattern: ^[a-z0-9-_]+$
+ type: string
+ version:
+ description: |-
+ version specifies the version of an image sku. The allowed formats are Major.Minor.Build or 'latest'. Major,
+ Minor, and Build are decimal numbers, e.g. '1.2.0'. Specify 'latest' to use the latest version of an image available at
+ deployment time. Even if you use 'latest', the VM image will not automatically update after deploy time even if a
+ new version becomes available.
+ maxLength: 32
+ minLength: 1
+ pattern: ^[0-9]+\.[0-9]+\.[0-9]+$|^latest$
+ type: string
+ type: object
+ x-kubernetes-validations:
+ - message: must specify imageGeneration or must specify
+ publisher, offer, sku and version
+ rule: has(self.imageGeneration) || has(self.publisher)
+ && has(self.offer) && has(self.sku) && has(self.version)
+ - message: publisher, offer, sku and version must either
+ be all set, or all omitted
+ rule: '[has(self.publisher), has(self.offer), has(self.sku),
+ has(self.version)].filter(x, x == true).size() ==
+ 0 || [has(self.publisher), has(self.offer), has(self.sku),
+ has(self.version)].filter(x, x == true).size() ==
+ 4'
+ imageID:
+ description: imageID is the Azure resource ID of a VHD
+ image to use to boot the Azure VMs from.
+ maxLength: 255
+ type: string
+ type:
+ description: |-
+ type is the type of image data that will be provided to the Azure VM.
+ Valid values are "ImageID" and "AzureMarketplace".
+ ImageID means is used for legacy managed VM images. This is where the user uploads a VM image directly to their resource group.
+ AzureMarketplace means the VM will boot from an Azure Marketplace image.
+ Marketplace images are preconfigured and published by the OS vendors and may include preconfigured software for the VM.
+ When Type is "AzureMarketplace", you can either:
+ 1. Specify only imageGeneration to use marketplace defaults from the release payload
+ 2. Specify publisher, offer, sku, and version to use an explicit marketplace image
+ 3. Specify all fields (imageGeneration along with publisher, offer, sku, version)
+ enum:
+ - ImageID
+ - AzureMarketplace
+ type: string
+ required:
+ - type
+ type: object
+ x-kubernetes-validations:
+ - message: imageID is required when type is ImageID, and forbidden
+ otherwise
+ rule: 'has(self.type) && self.type == ''ImageID'' ? has(self.imageID)
+ : !has(self.imageID)'
+ - message: azureMarketplace is forbidden when type is not
+ AzureMarketplace
+ rule: 'has(self.type) && self.type == ''AzureMarketplace''
+ ? true : !has(self.azureMarketplace)'
+ osDisk:
+ description: |-
+ osDisk provides configuration for the OS disk for the nodepool.
+ This can be used to configure the size, storage account type, encryption options and whether the disk is persistent or ephemeral.
+ When not provided, the platform will choose reasonable defaults which are subject to change over time.
+ Review the fields within the osDisk for more details.
+ properties:
+ diskStorageAccountType:
+ description: |-
+ diskStorageAccountType is the disk storage account type to use.
+ Valid values are Premium_LRS, PremiumV2_LRS, Standard_LRS, StandardSSD_LRS, UltraSSD_LRS.
+ Note that Standard means a HDD.
+ The disk performance is tied to the disk type, please refer to the Azure documentation for further details
+ https://docs.microsoft.com/en-us/azure/virtual-machines/disks-types#disk-type-comparison.
+ When omitted this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is Premium SSD LRS.
+ enum:
+ - Premium_LRS
+ - PremiumV2_LRS
+ - Standard_LRS
+ - StandardSSD_LRS
+ - UltraSSD_LRS
+ type: string
+ encryptionSetID:
+ description: |-
+ encryptionSetID is the ID of the DiskEncryptionSet resource to use to encrypt the OS disks for the VMs.
+ Configuring a DiskEncyptionSet allows greater control over the encryption of the VM OS disk at rest.
+ Can be used with either platform (Azure) managed, or customer managed encryption keys.
+ This needs to exist in the same subscription id listed in the Hosted Cluster, HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ DiskEncryptionSetID should also exist in a resource group under the same subscription id and the same location
+ listed in the Hosted Cluster, HostedCluster.Spec.Platform.Azure.Location.
+ The encryptionSetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Copmute/diskEncryptionSets/{resourceName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The resourceName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores.
+ maxLength: 285
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/diskEncryptionSets/{resourceName}`
+ rule: size(self.split('/')) == 9 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Compute/diskEncryptionSets/.*$')
+ - message: the subscriptionId in the encryptionSetID must
+ be a valid UUID. It should be 5 groups of hyphen separated
+ hexadecimal characters in the form 8-4-4-4-12
+ rule: self.split('/')[2].matches('^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$')
+ - message: The resourceGroupName should be between 1 and
+ 90 characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the encryptionSetID
+ must not end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The resourceName should be between 1 and 80
+ characters, consisting only of alphanumeric characters,
+ hyphens and underscores
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_]{1,80}')
+ persistence:
+ description: |-
+ persistence determines whether the OS disk should be persisted beyond the life of the VM.
+ Valid values are Persistent and Ephemeral.
+ When set to Ephmeral, the OS disk will not be persisted to Azure storage and implies restrictions to the VM size and caching type.
+ Full details can be found in the Azure documentation https://learn.microsoft.com/en-us/azure/virtual-machines/ephemeral-os-disks.
+ Ephmeral disks are primarily used for stateless applications, provide lower latency than Persistent disks and also incur no storage costs.
+ When not set, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ enum:
+ - Persistent
+ - Ephemeral
+ type: string
+ sizeGiB:
+ description: |-
+ sizeGiB is the size in GiB (1024^3 bytes) to assign to the OS disk.
+ This should be between 16 and 65,536 when using the UltraSSD_LRS storage account type and between 16 and 32,767 when using any other storage account type.
+ When not set, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+ The current default is 30.
+ format: int32
+ maximum: 65536
+ minimum: 16
+ type: integer
+ type: object
+ x-kubernetes-validations:
+ - message: When not using diskStorageAccountType UltraSSD_LRS,
+ the SizeGB value must be less than or equal to 32,767
+ rule: '!has(self.diskStorageAccountType) || self.diskStorageAccountType
+ != ''UltraSSD_LRS'' || self.sizeGiB <= 32767'
+ subnetID:
+ description: |-
+ subnetID is the subnet ID of an existing subnet where the nodes in the nodepool will be created. This can be a
+ different subnet than the one listed in the HostedCluster, HostedCluster.Spec.Platform.Azure.SubnetID, but must
+ exist in the same network, HostedCluster.Spec.Platform.Azure.VnetID, and must exist under the same subscription ID,
+ HostedCluster.Spec.Platform.Azure.SubscriptionID.
+ subnetID is immutable once set.
+ The subnetID should be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`.
+ The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
+ The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
+ The vnetName should be between 2 and 64 characters, consisting only of alphanumeric characters, hyphens, underscores and periods and must not end with either a period (.) or hyphen (-) character.
+ The subnetName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores and must start with an alphanumeric character and must not end with a period (.) or hyphen (-) character.
+ maxLength: 355
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: encryptionSetID must be in the format `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}`
+ rule: size(self.split('/')) == 11 && self.matches('^/subscriptions/.*/resourceGroups/.*/providers/Microsoft.Network/virtualNetworks/.*/subnets/.*$')
+ - message: the subscriptionId in the encryptionSetID must
+ be a valid UUID. It should be 5 groups of hyphen separated
+ hexadecimal characters in the form 8-4-4-4-12
+ rule: self.split('/')[2].matches('^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$')
+ - message: The resourceGroupName should be between 1 and 90
+ characters, consisting only of alphanumeric characters,
+ hyphens, underscores, periods and parenthesis
+ rule: self.split('/')[4].matches('[a-zA-Z0-9-_\\(\\)\\.]{1,90}')
+ - message: the resourceGroupName in the subnetID must not
+ end with a period (.) character
+ rule: '!self.split(''/'')[4].endsWith(''.'')'
+ - message: The vnetName should be between 2 and 64 characters,
+ consisting only of alphanumeric characters, hyphens, underscores
+ and periods
+ rule: self.split('/')[8].matches('[a-zA-Z0-9-_\\.]{2,64}')
+ - message: the vnetName in the subnetID must not end with
+ either a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[8].endsWith(''.'') && !self.split(''/'')[8].endsWith(''-'')'
+ - message: The subnetName should be between 1 and 80 characters,
+ consisting only of alphanumeric characters, hyphens and
+ underscores and must start with an alphanumeric character
+ rule: self.split('/')[10].matches('[a-zA-Z0-9][a-zA-Z0-9-_\\.]{0,79}')
+ - message: the subnetName in the subnetID must not end with
+ a period (.) or hyphen (-) character
+ rule: '!self.split(''/'')[10].endsWith(''.'') && !self.split(''/'')[10].endsWith(''-'')'
+ - message: SubnetID is immutable
+ rule: self == oldSelf
+ vmSize:
+ description: |-
+ vmSize is the Azure VM instance type to use for the nodes being created in the nodepool.
+ The size naming convention is documented here https://learn.microsoft.com/en-us/azure/virtual-machines/vm-naming-conventions.
+ Size names should start with a Family name, which is represented by one of more capital letters, and then be followed by the CPU count.
+ This is followed by 0 or more additional features, represented by a, b, d, i, l, m, p, t, s, C, and NP, refer to the Azure documentation for an explanation of these features.
+ Optionally an accelerator such as a GPU can be added, prefixed by an underscore, for example A100, H100 or MI300X.
+ The size may also be versioned, in which case it should be suffixed with _v where the version is a number.
+ For example, "D32ads_v5" would be a suitable general purpose VM size, or "ND96_MI300X_v5" would represent a GPU accelerated VM.
+ maxLength: 255
+ pattern: ^(Standard_|Basic_)?[A-Z]+[0-9]+(-[0-9]+)?[abdilmptsCNP]*(_[A-Z]*[0-9]+[A-Z]*)?(_v[0-9]+)?$
+ type: string
+ required:
+ - image
+ - osDisk
+ - subnetID
+ - vmSize
+ type: object
+ ibmcloud:
+ description: ibmcloud defines IBMCloud specific settings for components
+ properties:
+ providerType:
+ description: providerType is a specific supported infrastructure
+ provider within IBM Cloud.
+ type: string
+ type: object
+ kubevirt:
+ description: kubevirt specifies the configuration used when operating
+ on KubeVirt platform.
+ properties:
+ additionalNetworks:
+ description: additionalNetworks specify the extra networks
+ attached to the nodes
+ items:
+ description: |-
+ KubevirtNetwork specifies the configuration for a virtual machine
+ network interface
+ properties:
+ name:
+ description: |-
+ name specify the network attached to the nodes
+ it is a value with the format "[namespace]/[name]" to reference the
+ multus network attachment definition
+ maxLength: 255
+ type: string
+ required:
+ - name
+ type: object
+ maxItems: 20
+ type: array
+ attachDefaultNetwork:
+ default: true
+ description: |-
+ attachDefaultNetwork specify if the default pod network should be attached to the nodes
+ this can only be set to false if AdditionalNetworks are configured
+ type: boolean
+ compute:
+ default:
+ cores: 2
+ memory: 8Gi
+ description: compute contains values representing the virtual
+ hardware requested for the VM
+ properties:
+ cores:
+ description: cores is the number of CPU cores for the
+ KubeVirt VM.
+ format: int32
+ minimum: 1
+ type: integer
+ memory:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 8Gi
+ description: memory represents how much guest memory the
+ VM should have
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ qosClass:
+ default: Burstable
+ description: |-
+ qosClass if set to "Guaranteed", requests the scheduler to place the VirtualMachineInstance on a node with
+ limit memory and CPU, equal to be the requested values, to set the VMI as a Guaranteed QoS Class;
+ See here for more details:
+ https://kubevirt.io/user-guide/operations/node_overcommit/#requesting-the-right-qos-class-for-virtualmachineinstances
+ enum:
+ - Burstable
+ - Guaranteed
+ type: string
+ type: object
+ hostDevices:
+ description: |-
+ hostDevices specifies the host devices (e.g. GPU devices) to be passed
+ from the management cluster, to the nodepool nodes
+ items:
+ properties:
+ count:
+ default: 1
+ description: |-
+ count is the number of instances the specified host device will be attached to each of the
+ NodePool's nodes. Default is 1.
+ maximum: 2147483647
+ minimum: 1
+ type: integer
+ deviceName:
+ description: |-
+ deviceName is the name of the host device that is desired to be utilized in the HostedCluster's NodePool
+ The device can be any supported PCI device, including GPU, either as a passthrough or a vGPU slice.
+ maxLength: 255
+ type: string
+ required:
+ - deviceName
+ type: object
+ maxItems: 10
+ type: array
+ networkData:
+ description: |-
+ networkData is inline cloud-init network data configuration for VMs in this NodePool.
+ When specified, cloud-init volume changes from ConfigDrive to NoCloud.
+ This allows for static network configuration of VMs.
+ type: string
+ networkInterfaceMultiqueue:
+ default: Enable
+ description: |-
+ networkInterfaceMultiqueue if set to "Enable", virtual network interfaces configured with a virtio bus will also
+ enable the vhost multiqueue feature for network devices. The number of queues created depends on additional
+ factors of the VirtualMachineInstance, like the number of guest CPUs.
+ enum:
+ - Enable
+ - Disable
+ type: string
+ nodeSelector:
+ additionalProperties:
+ type: string
+ description: |-
+ nodeSelector is a selector which must be true for the kubevirt VirtualMachine to fit on a node.
+ Selector which must match a node's labels for the VM to be scheduled on that node. More info:
+ https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+ type: object
+ rootVolume:
+ default:
+ persistent:
+ size: 32Gi
+ type: Persistent
+ description: rootVolume represents values associated with
+ the VM volume that will host rhcos
+ properties:
+ cacheStrategy:
+ description: cacheStrategy defines the boot image caching
+ strategy. Default - no caching
+ properties:
+ type:
+ default: None
+ description: type is the type of the caching strategy
+ enum:
+ - None
+ - PVC
+ type: string
+ required:
+ - type
+ type: object
+ diskImage:
+ description: diskImage represents what rhcos image to
+ use for the node pool
+ properties:
+ containerDiskImage:
+ description: containerDiskImage is a string representing
+ the container image that holds the root disk
+ maxLength: 2048
+ type: string
+ type: object
+ persistent:
+ description: |-
+ persistent volume type means the VM's storage is backed by a PVC
+ VMs that use persistent volumes can survive disruption events like restart and eviction
+ This is the default type used when no storage type is defined.
+ properties:
+ accessModes:
+ description: |-
+ accessModes is an array that contains the desired Access Modes the root volume should have.
+ More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes
+ items:
+ enum:
+ - ReadWriteOnce
+ - ReadWriteMany
+ - ReadOnly
+ - ReadWriteOncePod
+ type: string
+ maxItems: 10
+ type: array
+ size:
+ anyOf:
+ - type: integer
+ - type: string
+ default: 32Gi
+ description: size is the size of the persistent storage
+ volume
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ storageClass:
+ description: storageClass is the storageClass used
+ for the underlying PVC that hosts the volume
+ maxLength: 255
+ type: string
+ volumeMode:
+ description: |-
+ volumeMode defines what type of volume is required by the claim.
+ Value of Filesystem is implied when not included in claim spec.
+ enum:
+ - Filesystem
+ - Block
+ type: string
+ type: object
+ type:
+ default: Persistent
+ description: type represents the type of storage to associate
+ with the kubevirt VMs.
+ enum:
+ - Persistent
+ type: string
+ type: object
+ required:
+ - rootVolume
+ type: object
+ openstack:
+ description: openstack specifies the configuration used when using
+ OpenStack platform.
+ properties:
+ additionalPorts:
+ description: additionalPorts is a list of additional ports
+ to create on the node instances.
+ items:
+ description: PortSpec specifies the options for creating
+ a port.
+ properties:
+ allowedAddressPairs:
+ description: |-
+ allowedAddressPairs is a list of address pairs which Neutron will
+ allow the port to send traffic from in addition to the port's
+ addresses. If not specified, the MAC Address will be the MAC Address
+ of the port. Depending on the configuration of Neutron, it may be
+ supported to specify a CIDR instead of a specific IP address.
+ items:
+ properties:
+ ipAddress:
+ description: |-
+ ipAddress is the IP address of the allowed address pair. Depending on
+ the configuration of Neutron, it may be supported to specify a CIDR
+ instead of a specific IP address.
+ maxLength: 255
+ type: string
+ required:
+ - ipAddress
+ type: object
+ maxItems: 10
+ type: array
+ description:
+ description: description is a human-readable description
+ for the port.
+ maxLength: 255
+ type: string
+ network:
+ description: |-
+ network is a query for an openstack network that the port will be created or discovered on.
+ This will fail if the query returns more than one network.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ filter:
+ description: filter specifies a filter to select
+ an OpenStack network. If provided, cannot be empty.
+ minProperties: 1
+ properties:
+ description:
+ description: description is the description
+ of the network to filter by.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the network
+ to filter by.
+ maxLength: 255
+ type: string
+ notTags:
+ description: |-
+ notTags is a list of tags to filter by. If specified, resources which
+ contain all of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ notTagsAny:
+ description: |-
+ notTagsAny is a list of tags to filter by. If specified, resources
+ which contain any of the given tags will be excluded from the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ projectID:
+ description: projectID is the project ID of
+ the network to filter by.
+ maxLength: 255
+ type: string
+ tags:
+ description: |-
+ tags is a list of tags to filter by. If specified, the resource must
+ have all of the tags specified to be included in the result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ tagsAny:
+ description: |-
+ tagsAny is a list of tags to filter by. If specified, the resource
+ must have at least one of the tags specified to be included in the
+ result.
+ items:
+ description: |-
+ NeutronTag represents a tag on a Neutron resource.
+ It may not be empty and may not contain commas.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^,]+$
+ type: string
+ maxItems: 50
+ type: array
+ x-kubernetes-list-type: set
+ type: object
+ id:
+ description: id is the ID of the network to use.
+ If ID is provided, the other filters cannot be
+ provided. Must be in UUID format.
+ format: uuid
+ maxLength: 36
+ type: string
+ type: object
+ portSecurityPolicy:
+ description: |-
+ portSecurityPolicy specifies whether or not to enable port security on the port.
+ Allowed values are "Enabled", "Disabled" and omitted.
+ When not set, it takes the value of the corresponding field at the network level.
+ enum:
+ - Enabled
+ - Disabled
+ - ""
+ type: string
+ vnicType:
+ description: |-
+ vnicType specifies the type of vNIC which this port should be
+ attached to. This is used to determine which mechanism driver(s) to
+ be used to bind the port. The valid values are normal, macvtap,
+ direct, baremetal, direct-physical, virtio-forwarder, smart-nic and
+ remote-managed, although these values will not be validated in this
+ API to ensure compatibility with future neutron changes or custom
+ implementations. What type of vNIC is actually available depends on
+ deployments. If not specified, the Neutron default value is used.
+ maxLength: 255
+ type: string
+ type: object
+ maxItems: 10
+ type: array
+ availabilityZone:
+ description: |-
+ availabilityZone is the nova availability zone in which the provider will create the VM.
+ If not specified, the VM will be created in the default availability zone specified in the nova configuration.
+ Availability zone names must NOT contain : since it is used by admin users to specify hosts where instances
+ are launched in server creation. Also, it must not contain spaces otherwise it will lead to node that belongs
+ to this availability zone register failure, see kubernetes/cloud-provider-openstack#1379 for further information.
+ The maximum length of availability zone name is 63 as per labels limits.
+ maxLength: 63
+ minLength: 1
+ pattern: '^[^: ]*$'
+ type: string
+ flavor:
+ description: flavor is the OpenStack flavor to use for the
+ node instances.
+ maxLength: 255
+ type: string
+ imageName:
+ description: |-
+ imageName is the OpenStack Glance image name to use for node instances. If unspecified, the default
+ is chosen based on the NodePool release payload image.
+ maxLength: 255
+ type: string
+ required:
+ - flavor
+ type: object
+ powervs:
+ description: powervs specifies the configuration used when using
+ IBMCloud PowerVS platform.
+ properties:
+ image:
+ description: |-
+ image used for deploying the nodes. If unspecified, the default
+ is chosen based on the NodePool release payload image.
+ properties:
+ id:
+ description: id of resource
+ maxLength: 255
+ type: string
+ name:
+ description: name of resource
+ maxLength: 255
+ type: string
+ type: object
+ imageDeletePolicy:
+ default: delete
+ description: |-
+ imageDeletePolicy is policy for the image deletion.
+
+ delete: delete the image from the infrastructure.
+ retain: delete the image from the openshift but retain in the infrastructure.
+
+ The default is delete
+ enum:
+ - delete
+ - retain
+ type: string
+ memoryGiB:
+ default: 32
+ description: |-
+ memoryGiB is the size of a virtual machine's memory, in GiB.
+ maximum value for the MemoryGiB depends on the selected SystemType.
+ when SystemType is set to e880 maximum MemoryGiB value is 7463 GiB.
+ when SystemType is set to e980 maximum MemoryGiB value is 15307 GiB.
+ when SystemType is set to s922 maximum MemoryGiB value is 942 GiB.
+ The minimum memory is 32 GiB.
+
+ When omitted, this means the user has no opinion and the platform is left to choose a reasonable
+ default. The current default is 32.
+ format: int32
+ type: integer
+ processorType:
+ default: shared
+ description: |-
+ processorType is the VM instance processor type.
+ It must be set to one of the following values: Dedicated, Capped or Shared.
+
+ Dedicated: resources are allocated for a specific client, The hypervisor makes a 1:1 binding of a partition's processor to a physical processor core.
+ Shared: Shared among other clients.
+ Capped: Shared, but resources do not expand beyond those that are requested, the amount of CPU time is Capped to the value specified for the entitlement.
+
+ if the processorType is selected as Dedicated, then Processors value cannot be fractional.
+ When omitted, this means that the user has no opinion and the platform is left to choose a
+ reasonable default. The current default is shared.
+ enum:
+ - dedicated
+ - shared
+ - capped
+ type: string
+ processors:
+ anyOf:
+ - type: integer
+ - type: string
+ default: "0.5"
+ description: |-
+ processors is the number of virtual processors in a virtual machine.
+ when the processorType is selected as Dedicated the processors value cannot be fractional.
+ maximum value for the Processors depends on the selected SystemType.
+ when SystemType is set to e880 or e980 maximum Processors value is 143.
+ when SystemType is set to s922 maximum Processors value is 15.
+ minimum value for Processors depends on the selected ProcessorType.
+ when ProcessorType is set as Shared or Capped, The minimum processors is 0.5.
+ when ProcessorType is set as Dedicated, The minimum processors is 1.
+ When omitted, this means that the user has no opinion and the platform is left to choose a
+ reasonable default. The default is set based on the selected ProcessorType.
+ when ProcessorType selected as Dedicated, the default is set to 1.
+ when ProcessorType selected as Shared or Capped, the default is set to 0.5.
+ x-kubernetes-int-or-string: true
+ storageType:
+ default: tier1
+ description: |-
+ storageType for the image and nodes, this will be ignored if Image is specified.
+ The storage tiers in PowerVS are based on I/O operations per second (IOPS).
+ It means that the performance of your storage volumes is limited to the maximum number of IOPS based on volume size and storage tier.
+ Although, the exact numbers might change over time, the Tier 3 storage is currently set to 3 IOPS/GB, and the Tier 1 storage is currently set to 10 IOPS/GB.
+
+ The default is tier1
+ enum:
+ - tier1
+ - tier3
+ type: string
+ systemType:
+ default: s922
+ description: |-
+ systemType is the System type used to host the instance.
+ systemType determines the number of cores and memory that is available.
+ Few of the supported SystemTypes are s922,e880,e980.
+ e880 systemType available only in Dallas Datacenters.
+ e980 systemType available in Datacenters except Dallas and Washington.
+ When omitted, this means that the user has no opinion and the platform is left to choose a
+ reasonable default. The current default is s922 which is generally available.
+ maxLength: 255
+ type: string
+ type: object
+ type:
+ description: type specifies the platform name.
+ enum:
+ - AWS
+ - Azure
+ - IBMCloud
+ - KubeVirt
+ - Agent
+ - PowerVS
+ - None
+ - OpenStack
+ maxLength: 100
+ type: string
+ x-kubernetes-validations:
+ - message: Type is immutable
+ rule: self == oldSelf
+ required:
+ - type
+ type: object
+ release:
+ description: |-
+ release specifies the OCP release used for this NodePool. It drives the machine ignition configuration (including
+ the kubelet version) and other platform-specific properties (e.g. an AMI on AWS).
+
+ Version-skew rules and effects:
+ - The minor-version skew relative to the control-plane release must be <= N-2.
+ This is not currently enforced, but exceeding this limit is unsupported and
+ may lead to unpredictable behavior.
+ - If the specified release is higher than the HostedCluster's release, the
+ NodePool will be degraded and the ValidReleaseImage condition will be false.
+ - If the specified release is lower than the NodePool's current y-stream,
+ the NodePool will be degraded and the ValidReleaseImage condition will be false.
+
+ Changing this field triggers a NodePool rollout.
+ properties:
+ image:
+ description: |-
+ image is the image pullspec of an OCP release payload image.
+ See https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags for a list of available images.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: Image must start with a word character (letters, digits,
+ or underscores) and contain no white spaces
+ rule: self.matches('^(\\w+\\S+)$')
+ required:
+ - image
+ type: object
+ replicas:
+ description: |-
+ replicas is the desired number of nodes the pool should maintain. If unset, the controller default value is 0.
+ replicas is mutually exclusive with autoscaling. If autoscaling is configured, replicas must be omitted and autoscaling will control the NodePool size internally.
+ format: int32
+ type: integer
+ taints:
+ description: |-
+ taints if specified, propagates a list of taints to Nodes, only once on creation.
+ These taints are additive to the ones applied by other controllers
+ items:
+ description: |-
+ taint is as v1 Core but without TimeAdded.
+ https://github.com/kubernetes/kubernetes/blob/ed8cad1e80d096257921908a52ac69cf1f41a098/staging/src/k8s.io/api/core/v1/types.go#L3037-L3053
+ Validation replicates the same validation as the upstream https://github.com/kubernetes/kubernetes/blob/9a2a7537f035969a68e432b4cc276dbce8ce1735/pkg/util/taints/taints.go#L273.
+ See also https://kubernetes.io/docs/concepts/overview/working-with-objects/names/.
+ properties:
+ effect:
+ description: |-
+ effect is the effect of the taint on pods
+ that do not tolerate the taint.
+ Valid effects are NoSchedule, PreferNoSchedule and NoExecute.
+ enum:
+ - NoSchedule
+ - PreferNoSchedule
+ - NoExecute
+ type: string
+ key:
+ description: key is the taint key to be applied to a node.
+ maxLength: 253
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: key must be a qualified name with an optional subdomain
+ prefix e.g. example.com/MyName
+ rule: self.matches('^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/)?[A-Za-z0-9]([-A-Za-z0-9_.]{0,61}[A-Za-z0-9])?$')
+ value:
+ description: value is the taint value corresponding to the taint
+ key.
+ maxLength: 253
+ type: string
+ x-kubernetes-validations:
+ - message: Value must start and end with alphanumeric characters
+ and can only contain '-', '_', '.' in the middle
+ rule: self.matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$')
+ required:
+ - effect
+ - key
+ type: object
+ maxItems: 50
+ type: array
+ tuningConfig:
+ description: |-
+ tuningConfig is a list of references to ConfigMaps containing serialized
+ Tuned or PerformanceProfile resources to define the tuning configuration to be applied to
+ nodes in the NodePool. The Tuned API is defined here:
+
+ https://github.com/openshift/cluster-node-tuning-operator/blob/2c76314fb3cc8f12aef4a0dcd67ddc3677d5b54f/pkg/apis/tuned/v1/tuned_types.go
+
+ The PerformanceProfile API is defined here:
+ https://github.com/openshift/cluster-node-tuning-operator/tree/b41042d42d4ba5bb2e99960248cf1d6ae4935018/pkg/apis/performanceprofile/v2
+
+ Each ConfigMap must have a single key named "tuning" whose value is the
+ JSON or YAML of a serialized Tuned or PerformanceProfile.
+ Changing this field will trigger a NodePool rollout.
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ maxItems: 10
+ type: array
+ required:
+ - clusterName
+ - management
+ - platform
+ - release
+ type: object
+ x-kubernetes-validations:
+ - message: Arch is required once set
+ rule: '!has(oldSelf.arch) || has(self.arch)'
+ - message: Setting Arch to arm64 is only supported for AWS, Azure, Agent
+ and None
+ rule: self.arch != 'arm64' || has(self.platform.aws) || has(self.platform.azure)
+ || has(self.platform.agent) || self.platform.type == 'None'
+ - message: Both replicas or autoScaling should not be set
+ rule: '!has(self.replicas) || !has(self.autoScaling)'
+ - message: s390x is only supported on KubeVirt platform
+ rule: self.arch != 's390x' || has(self.platform.kubevirt)
+ - message: ImageType 'Windows' requires arch 'amd64' (AWS only)
+ rule: '(has(self.platform.aws) && has(self.platform.aws.imageType) &&
+ self.platform.aws.imageType == ''Windows'') ? self.arch == ''amd64''
+ : true'
+ status:
+ description: status is the latest observed status of the NodePool.
+ properties:
+ conditions:
+ description: |-
+ conditions represents the latest available observations of the node pool's
+ current state.
+ items:
+ description: |-
+ We define our own condition type since metav1.Condition has validation
+ for Reason that might be broken by what we bubble up from CAPI.
+ NodePoolCondition defines an observation of NodePool resource operational state.
+ properties:
+ lastTransitionTime:
+ description: |-
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+ This should be when the underlying condition changed. If that is not known, then using the time when
+ the API field changed is acceptable.
+ format: date-time
+ type: string
+ message:
+ description: |-
+ message is a human readable message indicating details about the transition.
+ This field may be empty.
+ maxLength: 32768
+ type: string
+ observedGeneration:
+ description: observedGeneration represents the .metadata.generation
+ that the condition was set based upon.
+ format: int64
+ minimum: 0
+ type: integer
+ reason:
+ description: |-
+ reason for the condition's last transition in CamelCase.
+ The specific API may choose whether or not this field is considered a guaranteed API.
+ This field may not be empty.
+ maxLength: 1024
+ type: string
+ severity:
+ description: |-
+ severity provides an explicit classification of Reason code, so the users or machines can immediately
+ understand the current situation and act accordingly.
+ The Severity field MUST be set only when Status=False.
+ maxLength: 1024
+ type: string
+ status:
+ description: status of the condition, one of True, False, Unknown.
+ type: string
+ type:
+ description: |-
+ type of condition in CamelCase or in foo.example.com/CamelCase.
+ Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
+ can be useful (see .node.status.conditions), the ability to deconflict is important.
+ maxLength: 316
+ type: string
+ required:
+ - lastTransitionTime
+ - status
+ - type
+ type: object
+ maxItems: 100
+ type: array
+ platform:
+ description: platform holds the specific statuses
+ properties:
+ kubeVirt:
+ description: kubeVirt contains the KubeVirt platform statuses
+ properties:
+ cacheName:
+ description: cacheName holds the name of the cache DataVolume,
+ if exists
+ maxLength: 255
+ type: string
+ credentials:
+ description: |-
+ credentials shows the client credentials used when creating KubeVirt virtual machines.
+ This filed is only exists when the KubeVirt virtual machines are being placed
+ on a cluster separate from the one hosting the Hosted Control Plane components.
+
+ The default behavior when Credentials is not defined is for the KubeVirt VMs to be placed on
+ the same cluster and namespace as the Hosted Control Plane.
+ properties:
+ infraKubeConfigSecret:
+ description: |-
+ infraKubeConfigSecret is a reference to the secret containing the kubeconfig
+ of an external infrastructure cluster for kubevirt provider
+ properties:
+ key:
+ description: key is the key in the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ name:
+ description: name is the name of the secret containing
+ the kubeconfig.
+ maxLength: 255
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: infraKubeConfigSecret is immutable
+ rule: self == oldSelf
+ infraNamespace:
+ description: |-
+ infraNamespace is the namespace in the external infrastructure cluster
+ where kubevirt resources will be created
+ maxLength: 255
+ type: string
+ x-kubernetes-validations:
+ - message: infraNamespace is immutable
+ rule: self == oldSelf
+ required:
+ - infraNamespace
+ type: object
+ type: object
+ type: object
+ replicas:
+ description: replicas is the latest observed number of nodes in the
+ pool.
+ format: int32
+ type: integer
+ version:
+ description: |-
+ version is the semantic version of the latest applied release specified by
+ the NodePool.
+ maxLength: 64
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ scale:
+ specReplicasPath: .spec.replicas
+ statusReplicasPath: .status.replicas
+ status: {}
diff --git a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml
index 5a7a59c3333..fe8aeb433d4 100644
--- a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml
+++ b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-CustomNoUpgrade.crd.yaml
@@ -1105,6 +1105,13 @@ spec:
type: object
maxItems: 10
type: array
+ networkData:
+ description: |-
+ networkData is inline cloud-init network data configuration for VMs in this NodePool.
+ When specified, cloud-init volume changes from ConfigDrive to NoCloud.
+ This allows for static network configuration of VMs.
+ maxLength: 2048
+ type: string
networkInterfaceMultiqueue:
default: Enable
description: |-
diff --git a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml
index 09e3ab7a85b..75f4f44ffca 100644
--- a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml
+++ b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-Default.crd.yaml
@@ -1105,6 +1105,13 @@ spec:
type: object
maxItems: 10
type: array
+ networkData:
+ description: |-
+ networkData is inline cloud-init network data configuration for VMs in this NodePool.
+ When specified, cloud-init volume changes from ConfigDrive to NoCloud.
+ This allows for static network configuration of VMs.
+ maxLength: 2048
+ type: string
networkInterfaceMultiqueue:
default: Enable
description: |-
diff --git a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml
index 98b64e2db56..c7db266bd88 100644
--- a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml
+++ b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/nodepools-TechPreviewNoUpgrade.crd.yaml
@@ -1105,6 +1105,13 @@ spec:
type: object
maxItems: 10
type: array
+ networkData:
+ description: |-
+ networkData is inline cloud-init network data configuration for VMs in this NodePool.
+ When specified, cloud-init volume changes from ConfigDrive to NoCloud.
+ This allows for static network configuration of VMs.
+ maxLength: 2048
+ type: string
networkInterfaceMultiqueue:
default: Enable
description: |-
diff --git a/docs/content/reference/api.md b/docs/content/reference/api.md
index d8f4f2ac57f..069526b8256 100644
--- a/docs/content/reference/api.md
+++ b/docs/content/reference/api.md
@@ -8716,6 +8716,20 @@ Selector which must match a node’s labels for the VM to be scheduled on th
from the management cluster, to the nodepool nodes
+
+
+networkData
+
+string
+
+
+
+(Optional)
+networkData is inline cloud-init network data configuration for VMs in this NodePool.
+When specified, cloud-init volume changes from ConfigDrive to NoCloud.
+This allows for static network configuration of VMs.
+
+
###KubevirtPersistentVolume { #hypershift.openshift.io/v1beta1.KubevirtPersistentVolume }
diff --git a/go.mod b/go.mod
index 54a24c46c2e..136e26f5ba8 100644
--- a/go.mod
+++ b/go.mod
@@ -298,3 +298,5 @@ replace github.com/aws/karpenter-provider-aws => github.com/openshift/karpenter-
// k8s.io/apiserver => k8s.io/apiserver v0.32.3
// k8s.io/client-go => k8s.io/client-go v0.32.3
// )
+
+replace sigs.k8s.io/cluster-api-provider-kubevirt => github.com/qinqon/cluster-api-provider-kubevirt v0.1.0-rc.0.0.20251127145124-f47c5db784fd
diff --git a/go.sum b/go.sum
index b860550de1e..518565b74a3 100644
--- a/go.sum
+++ b/go.sum
@@ -605,6 +605,8 @@ github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsT
github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/qinqon/cluster-api-provider-kubevirt v0.1.0-rc.0.0.20251127145124-f47c5db784fd h1:deKohERu8G86J3IlzdBG2QoEsQIaVRG0/awTlKY8MJQ=
+github.com/qinqon/cluster-api-provider-kubevirt v0.1.0-rc.0.0.20251127145124-f47c5db784fd/go.mod h1:RlF7CASVT4vaBRLu45Y2dprAnEPoDGvMaImXz13Ntks=
github.com/robfig/cron v1.2.0 h1:ZjScXvvxeQ63Dbyxy76Fj3AT3Ut0aKsyd2/tl3DTMuQ=
github.com/robfig/cron v1.2.0/go.mod h1:JGuDeoQd7Z6yL4zQhZ3OPEVHB7fL6Ka6skscFHfmt2k=
github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
@@ -1033,8 +1035,6 @@ sigs.k8s.io/cluster-api-provider-azure v1.21.0 h1:8SYwQX4ANgy2CAa2NEk41mqBZrmyAH
sigs.k8s.io/cluster-api-provider-azure v1.21.0/go.mod h1:NJMrRzRf/Ua5Uhm9qmuK4M/4Jl/f74jBpkgPqJN0vQQ=
sigs.k8s.io/cluster-api-provider-ibmcloud v0.11.0 h1:aunR3nnDzQ5x1Qj1hJbR3Xq4SCZth4XyTWAyUCN46kE=
sigs.k8s.io/cluster-api-provider-ibmcloud v0.11.0/go.mod h1:9yPLATyiqLx4crMzbX11YQU+GuR5txjtiCt8z9sxDfM=
-sigs.k8s.io/cluster-api-provider-kubevirt v0.1.9 h1:hQO7Y5GP7FMnH6Aono9WVE90I3vRLBxw/48iKHerjtg=
-sigs.k8s.io/cluster-api-provider-kubevirt v0.1.9/go.mod h1:RlF7CASVT4vaBRLu45Y2dprAnEPoDGvMaImXz13Ntks=
sigs.k8s.io/cluster-api-provider-openstack v0.12.1 h1:IK8GRmQKTwgft6PwaLC4r69O5hV7ykr4l7eJ8pQ3EIU=
sigs.k8s.io/cluster-api-provider-openstack v0.12.1/go.mod h1:lm2AXy1bfJEVKU4RfxwPdJgPbJDNiUAfva+IIf8Gqzo=
sigs.k8s.io/cluster-api-provider-openstack/orc v0.0.0-20250113192833-e4f56a2b4f32 h1:AkFSgi+dAnPLtg+SXjtCf3rDzjI/mskDiJ1PWHZoRno=
diff --git a/hypershift-operator/controllers/nodepool/kubevirt/kubevirt.go b/hypershift-operator/controllers/nodepool/kubevirt/kubevirt.go
index ddf7f555b77..6b1a72999d3 100644
--- a/hypershift-operator/controllers/nodepool/kubevirt/kubevirt.go
+++ b/hypershift-operator/controllers/nodepool/kubevirt/kubevirt.go
@@ -25,18 +25,16 @@ import (
"kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1"
)
-var (
- LocalStorageVolumes = []string{
- "private",
- "public",
- "sockets",
- "virt-bin-share-dir",
- "libvirt-runtime",
- "ephemeral-disks",
- "container-disks",
- "hotplug-disks",
- }
-)
+var LocalStorageVolumes = []string{
+ "private",
+ "public",
+ "sockets",
+ "virt-bin-share-dir",
+ "libvirt-runtime",
+ "ephemeral-disks",
+ "container-disks",
+ "hotplug-disks",
+}
func defaultImage(nodePoolArch string, releaseImage *releaseinfo.ReleaseImage) (string, string, error) {
var archName string
@@ -289,7 +287,6 @@ func virtualMachineTemplateBase(nodePool *hyperv1.NodePool, bootImage BootImage)
hostDevices = append(hostDevices, kvHostDevice)
deviceCounter++
}
-
}
template.Spec.Template.Spec.Domain.Devices.HostDevices = hostDevices
}
@@ -344,6 +341,7 @@ func virtualMachineNetworks(kvPlatform *hyperv1.KubevirtNodePoolPlatform) []kube
}
return networks
}
+
func shouldAttachDefaultNetwork(kvPlatform *hyperv1.KubevirtNodePoolPlatform) bool {
return kvPlatform.AttachDefaultNetwork == nil || *kvPlatform.AttachDefaultNetwork
}
@@ -445,12 +443,21 @@ func MachineTemplateSpec(nodePool *hyperv1.NodePool, hcluster *hyperv1.HostedClu
return nil, err
}
+ machineSpec := capikubevirt.KubevirtMachineSpec{
+ VirtualMachineTemplate: *vmTemplate,
+ BootstrapCheckSpec: capikubevirt.VirtualMachineBootstrapCheckSpec{CheckStrategy: "none"},
+ }
+
+ kvPlatform := nodePool.Spec.Platform.Kubevirt
+
+ // Propagate NetworkData from NodePool to CAPK machine spec
+ if kvPlatform.NetworkData != nil {
+ machineSpec.NetworkData = kvPlatform.NetworkData
+ }
+
return &capikubevirt.KubevirtMachineTemplateSpec{
Template: capikubevirt.KubevirtMachineTemplateResource{
- Spec: capikubevirt.KubevirtMachineSpec{
- VirtualMachineTemplate: *vmTemplate,
- BootstrapCheckSpec: capikubevirt.VirtualMachineBootstrapCheckSpec{CheckStrategy: "none"},
- },
+ Spec: machineSpec,
},
}, nil
}
diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/kubevirt.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/kubevirt.go
index cc83e14d45b..90fa6284f29 100644
--- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/kubevirt.go
+++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/kubevirt.go
@@ -191,6 +191,13 @@ type KubevirtNodePoolPlatform struct {
// +optional
// +kubebuilder:validation:MaxItems=10
KubevirtHostDevices []KubevirtHostDevice `json:"hostDevices,omitempty"`
+
+ // networkData is inline cloud-init network data configuration for VMs in this NodePool.
+ // When specified, cloud-init volume changes from ConfigDrive to NoCloud.
+ // This allows for static network configuration of VMs.
+ // +kubebuilder:validation:MaxLength=2048
+ // +optional
+ NetworkData *string `json:"networkData,omitempty"`
}
// KubevirtNetwork specifies the configuration for a virtual machine
diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go
index 7681b2a70ae..a4693d4844a 100644
--- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go
+++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.deepcopy.go
@@ -2503,6 +2503,11 @@ func (in *KubevirtNodePoolPlatform) DeepCopyInto(out *KubevirtNodePoolPlatform)
*out = make([]KubevirtHostDevice, len(*in))
copy(*out, *in)
}
+ if in.NetworkData != nil {
+ in, out := &in.NetworkData, &out.NetworkData
+ *out = new(string)
+ **out = **in
+ }
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubevirtNodePoolPlatform.
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 5d375118c37..509b402d6b7 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -2510,7 +2510,7 @@ sigs.k8s.io/cluster-api-provider-azure/util/webhook
## explicit; go 1.23.2
sigs.k8s.io/cluster-api-provider-ibmcloud/api/v1beta1
sigs.k8s.io/cluster-api-provider-ibmcloud/api/v1beta2
-# sigs.k8s.io/cluster-api-provider-kubevirt v0.1.9
+# sigs.k8s.io/cluster-api-provider-kubevirt v0.1.9 => github.com/qinqon/cluster-api-provider-kubevirt v0.1.0-rc.0.0.20251127145124-f47c5db784fd
## explicit; go 1.22.0
sigs.k8s.io/cluster-api-provider-kubevirt/api/v1alpha1
# sigs.k8s.io/cluster-api-provider-openstack v0.12.1
@@ -2682,3 +2682,4 @@ sigs.k8s.io/yaml/goyaml.v3
# github.com/golang-jwt/jwt/v4 => github.com/golang-jwt/jwt/v4 v4.5.2
# sigs.k8s.io/controller-runtime => sigs.k8s.io/controller-runtime v0.19.7
# github.com/aws/karpenter-provider-aws => github.com/openshift/karpenter-provider-aws v0.0.0-20250409201301-54ec662a99e7
+# sigs.k8s.io/cluster-api-provider-kubevirt => github.com/qinqon/cluster-api-provider-kubevirt v0.1.0-rc.0.0.20251127145124-f47c5db784fd
diff --git a/vendor/sigs.k8s.io/cluster-api-provider-kubevirt/api/v1alpha1/kubevirtmachine_types.go b/vendor/sigs.k8s.io/cluster-api-provider-kubevirt/api/v1alpha1/kubevirtmachine_types.go
index 94e2bcf9257..79e4589c529 100644
--- a/vendor/sigs.k8s.io/cluster-api-provider-kubevirt/api/v1alpha1/kubevirtmachine_types.go
+++ b/vendor/sigs.k8s.io/cluster-api-provider-kubevirt/api/v1alpha1/kubevirtmachine_types.go
@@ -55,6 +55,11 @@ type KubevirtMachineSpec struct {
// When nil, this defaults to the value present in the KubevirtCluster object's spec associated with this machine.
// +optional
InfraClusterSecretRef *corev1.ObjectReference `json:"infraClusterSecretRef,omitempty"`
+
+ // NetworkData contains inline cloud-init network data configuration.
+ // When specified, the cloud-init volume will use NoCloud instead of ConfigDrive.
+ // +optional
+ NetworkData *string `json:"networkData,omitempty"`
}
// VirtualMachineBootstrapCheckSpec defines how the controller will remotely check CAPI Sentinel file content.
diff --git a/vendor/sigs.k8s.io/cluster-api-provider-kubevirt/api/v1alpha1/zz_generated.deepcopy.go b/vendor/sigs.k8s.io/cluster-api-provider-kubevirt/api/v1alpha1/zz_generated.deepcopy.go
index 930b4d4f1a9..2eed00fcc3f 100644
--- a/vendor/sigs.k8s.io/cluster-api-provider-kubevirt/api/v1alpha1/zz_generated.deepcopy.go
+++ b/vendor/sigs.k8s.io/cluster-api-provider-kubevirt/api/v1alpha1/zz_generated.deepcopy.go
@@ -335,6 +335,11 @@ func (in *KubevirtMachineSpec) DeepCopyInto(out *KubevirtMachineSpec) {
*out = new(v1.ObjectReference)
**out = **in
}
+ if in.NetworkData != nil {
+ in, out := &in.NetworkData, &out.NetworkData
+ *out = new(string)
+ **out = **in
+ }
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubevirtMachineSpec.