From 355aeda74e2d8236c30ceb3a19396ef36ec62272 Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Mon, 14 Sep 2026 08:12:31 +0000 Subject: [PATCH] OCPSTRAT-3624: Validate GCP disk licenses in MAO --- go.mod | 1 + go.sum | 4 +- pkg/webhooks/machine_webhook.go | 8 + pkg/webhooks/machine_webhook_test.go | 100 + .../api/config/v1/types_authentication.go | 6 +- .../api/config/v1/types_infrastructure.go | 63 + .../openshift/api/config/v1/types_ingress.go | 6 +- .../api/config/v1/types_kmsencryption.go | 55 +- ...tor_01_apiservers-CustomNoUpgrade.crd.yaml | 107 +- ...01_apiservers-DevPreviewNoUpgrade.crd.yaml | 107 +- ...1_apiservers-TechPreviewNoUpgrade.crd.yaml | 107 +- ...1_authentications-CustomNoUpgrade.crd.yaml | 8 +- ...erator_01_authentications-Default.crd.yaml | 143 +- ...thentications-DevPreviewNoUpgrade.crd.yaml | 8 +- ...g-operator_01_authentications-OKD.crd.yaml | 143 +- ...hentications-TechPreviewNoUpgrade.crd.yaml | 8 +- ...dentialproviderconfigs-Hypershift.crd.yaml | 213 ++ ...ialproviderconfigs-SelfManagedHA.crd.yaml} | 197 -- ...erator_01_infrastructures-Default.crd.yaml | 32 +- ...ctures-Hypershift-CustomNoUpgrade.crd.yaml | 63 +- ...es-Hypershift-DevPreviewNoUpgrade.crd.yaml | 63 +- ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 2774 ----------------- ...g-operator_01_infrastructures-OKD.crd.yaml | 32 +- ...res-SelfManagedHA-CustomNoUpgrade.crd.yaml | 63 +- ...SelfManagedHA-DevPreviewNoUpgrade.crd.yaml | 63 +- ...astructures-TechPreviewNoUpgrade.crd.yaml} | 45 +- ...ator_01_ingresses-CustomNoUpgrade.crd.yaml | 9 +- ..._01_ingresses-DevPreviewNoUpgrade.crd.yaml | 9 +- ...01_ingresses-TechPreviewNoUpgrade.crd.yaml | 9 +- ..._generated.featuregated-crd-manifests.yaml | 2 + .../v1/zz_generated.swagger_doc_generated.go | 24 +- .../v1alpha1/types_cluster_monitoring.go | 82 + .../config/v1alpha1/zz_generated.deepcopy.go | 51 + .../v1alpha1/zz_generated.model_name.go | 15 + .../zz_generated.swagger_doc_generated.go | 55 +- .../openshift/api/envtest-releases.yaml | 13 + vendor/github.com/openshift/api/features.md | 27 +- .../openshift/api/features/features.go | 62 +- .../api/features/legacyfeaturegates.go | 2 - .../api/machine/v1beta1/types_gcpprovider.go | 20 + .../machine/v1beta1/zz_generated.deepcopy.go | 5 + .../zz_generated.swagger_doc_generated.go | 1 + .../openshift/api/operator/v1/types.go | 12 + .../api/operator/v1/types_kmsencryption.go | 103 +- .../api/operator/v1/zz_generated.deepcopy.go | 34 + .../operator/v1/zz_generated.model_name.go | 10 + .../v1/zz_generated.swagger_doc_generated.go | 31 +- .../api/operator/v1alpha1/register.go | 2 + .../api/operator/v1alpha1/types_ingress.go | 146 + .../v1alpha1/zz_generated.deepcopy.go | 117 + ..._generated.featuregated-crd-manifests.yaml | 23 + .../v1alpha1/zz_generated.model_name.go | 25 + .../zz_generated.swagger_doc_generated.go | 49 + .../openshift/api/route/v1/generated.proto | 3 +- .../openshift/api/route/v1/types.go | 3 +- ..._generated.featuregated-crd-manifests.yaml | 3 +- vendor/modules.txt | 3 +- 57 files changed, 2132 insertions(+), 3237 deletions(-) create mode 100644 vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-Hypershift.crd.yaml rename vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/{0000_10_config-operator_01_criocredentialproviderconfigs.crd.yaml => 0000_10_config-operator_01_criocredentialproviderconfigs-SelfManagedHA.crd.yaml} (50%) delete mode 100644 vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-TechPreviewNoUpgrade.crd.yaml rename vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/{0000_10_config-operator_01_infrastructures-SelfManagedHA-TechPreviewNoUpgrade.crd.yaml => 0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml} (98%) create mode 100644 vendor/github.com/openshift/api/operator/v1alpha1/types_ingress.go diff --git a/go.mod b/go.mod index b06acbc06d..821e2962d8 100644 --- a/go.mod +++ b/go.mod @@ -6,6 +6,7 @@ go 1.26.0 // an API yet we can leverage so that I do not have to copy what openshift/kubernetes/openshift-hack/cmd/k8s-tests-ext did to initialize. replace ( github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20260424201627-4d4cc33d669d + github.com/openshift/api => github.com/redhat-chai-bot/api v0.0.0-20260912110502-b75db3fbbc59 k8s.io/apiserver => github.com/openshift/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20260716191900-78acd4d422b2 // openshift kubernetes has very old copy of k8s.io/kubernetes/pkg/kubelet/server/server.go k8s.io/cri-streaming => github.com/openshift/kubernetes/staging/src/k8s.io/cri-streaming v0.0.0-20260716191900-78acd4d422b2 diff --git a/go.sum b/go.sum index b17cf80fbb..98f84cb5f0 100644 --- a/go.sum +++ b/go.sum @@ -498,8 +498,6 @@ github.com/opencontainers/selinux v1.13.1 h1:A8nNeceYngH9Ow++M+VVEwJVpdFmrlxsN22 github.com/opencontainers/selinux v1.13.1/go.mod h1:S10WXZ/osk2kWOYKy1x2f/eXF5ZHJoUs8UU/2caNRbg= github.com/openshift-eng/openshift-tests-extension v0.0.0-20260707142426-572a3e9deb7a h1:ulT0JZ/x6S4hYhyjUJ9T49YAxDLl1i5idFOMm9RHBkY= github.com/openshift-eng/openshift-tests-extension v0.0.0-20260707142426-572a3e9deb7a/go.mod h1:pHOS9c6BjZv91OkkHyIHAOWnYhxwcxWQkyYGEvPyUCE= -github.com/openshift/api v0.0.0-20260715165912-72066cc9718b h1:gN3SihCYEwoIksD+f24wHhwiEgvaV0RxNjgmkDvBBeg= -github.com/openshift/api v0.0.0-20260715165912-72066cc9718b/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M= github.com/openshift/apiserver-library-go v0.0.0-20260715200723-42e5e402ca43 h1:V9hWaBi9cnohNk1F0Ph6wpI0otMWqMHleJ3oj5603Bc= github.com/openshift/apiserver-library-go v0.0.0-20260715200723-42e5e402ca43/go.mod h1:ZuzfEq1ccZpHNx05xEUKlm2TcMHt2iXVutb79kAuTfM= github.com/openshift/client-go v0.0.0-20260715172546-dac61734e0ec h1:UDjX+mot5IVLpcChyBqLXG1oSB29s4UkqFmgNb0Xsqc= @@ -576,6 +574,8 @@ github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 h1:M8mH9eK4OUR4l github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567/go.mod h1:DWNGW8A4Y+GyBgPuaQJuWiy0XYftx4Xm/y5Jqk9I6VQ= github.com/raeperd/recvcheck v0.2.0 h1:GnU+NsbiCqdC2XX5+vMZzP+jAJC5fht7rcVTAhX74UI= github.com/raeperd/recvcheck v0.2.0/go.mod h1:n04eYkwIR0JbgD73wT8wL4JjPC3wm0nFtzBnWNocnYU= +github.com/redhat-chai-bot/api v0.0.0-20260912110502-b75db3fbbc59 h1:sPPzj+eG5hoZkHf2PgTDrC3VZObwiNoVUvjdyoEheR0= +github.com/redhat-chai-bot/api v0.0.0-20260912110502-b75db3fbbc59/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= diff --git a/pkg/webhooks/machine_webhook.go b/pkg/webhooks/machine_webhook.go index 0f055de99c..c45b7a9055 100644 --- a/pkg/webhooks/machine_webhook.go +++ b/pkg/webhooks/machine_webhook.go @@ -109,6 +109,8 @@ var ( defaultGCPTags = func(clusterID string) []string { return []string{fmt.Sprintf("%s-worker", clusterID)} } + // gcpDiskLicensePattern matches the full URI and short self-link forms accepted by GCP. + gcpDiskLicensePattern = regexp.MustCompile(`^(https://www\.googleapis\.com/compute/v1/)?projects/[a-z][a-z0-9-]{4,28}[a-z0-9]/global/licenses/[a-z]([-a-z0-9]{0,61}[a-z0-9])?$`) defaultGCPDiskImage = func() string { if arch == ARM64 { @@ -1612,6 +1614,12 @@ func validateGCPDisks(disks []*machinev1beta1.GCPDisk, parentPath *field.Path) f errs = append(errs, field.NotSupported(fldPath.Child("type"), disk.Type, diskTypes.List())) } } + + for j, license := range disk.Licenses { + if !gcpDiskLicensePattern.MatchString(license) { + errs = append(errs, field.Invalid(fldPath.Child("licenses").Index(j), license, "must be a valid GCP license URL")) + } + } } return errs diff --git a/pkg/webhooks/machine_webhook_test.go b/pkg/webhooks/machine_webhook_test.go index bfdec64c64..1084e2e512 100644 --- a/pkg/webhooks/machine_webhook_test.go +++ b/pkg/webhooks/machine_webhook_test.go @@ -4611,6 +4611,106 @@ func TestValidateGCPProviderSpec(t *testing.T) { }, expectedOk: true, }, + { + testCase: "with nil disk licenses", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = nil + }, + expectedOk: true, + }, + { + testCase: "with empty disk licenses", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{} + }, + expectedOk: true, + }, + { + testCase: "with a valid short disk license self-link", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{"projects/valid-project/global/licenses/valid-license"} + }, + expectedOk: true, + }, + { + testCase: "with a valid full disk license URI", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{"https://www.googleapis.com/compute/v1/projects/valid-project/global/licenses/valid-license"} + }, + expectedOk: true, + }, + { + testCase: "with a disk license invalid host", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{"https://compute.googleapis.com/compute/v1/projects/valid-project/global/licenses/valid-license"} + }, + expectedOk: false, + expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"https://compute.googleapis.com/compute/v1/projects/valid-project/global/licenses/valid-license\": must be a valid GCP license URL", + }, + { + testCase: "with a disk license invalid scheme", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{"http://www.googleapis.com/compute/v1/projects/valid-project/global/licenses/valid-license"} + }, + expectedOk: false, + expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"http://www.googleapis.com/compute/v1/projects/valid-project/global/licenses/valid-license\": must be a valid GCP license URL", + }, + { + testCase: "with a disk license extra path component", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{"projects/valid-project/global/licenses/valid-license/extra"} + }, + expectedOk: false, + expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/valid-project/global/licenses/valid-license/extra\": must be a valid GCP license URL", + }, + { + testCase: "with a malformed disk license self-link", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{"projects/valid-project/licenses/valid-license"} + }, + expectedOk: false, + expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/valid-project/licenses/valid-license\": must be a valid GCP license URL", + }, + { + testCase: "with a disk license too-short project ID", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{"projects/abc12/global/licenses/valid-license"} + }, + expectedOk: false, + expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/abc12/global/licenses/valid-license\": must be a valid GCP license URL", + }, + { + testCase: "with a disk license uppercase project ID", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{"projects/Valid-project/global/licenses/valid-license"} + }, + expectedOk: false, + expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/Valid-project/global/licenses/valid-license\": must be a valid GCP license URL", + }, + { + testCase: "with a disk license uppercase name", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{"projects/valid-project/global/licenses/Valid-license"} + }, + expectedOk: false, + expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/valid-project/global/licenses/Valid-license\": must be a valid GCP license URL", + }, + { + testCase: "with a disk license hyphen-invalid name", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{"projects/valid-project/global/licenses/-valid-license"} + }, + expectedOk: false, + expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/valid-project/global/licenses/-valid-license\": must be a valid GCP license URL", + }, + { + testCase: "with an overlong disk license name", + modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { + p.Disks[0].Licenses = []string{"projects/valid-project/global/licenses/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"} + }, + expectedOk: false, + expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/valid-project/global/licenses/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\": must be a valid GCP license URL", + }, { testCase: "with no service accounts", modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) { diff --git a/vendor/github.com/openshift/api/config/v1/types_authentication.go b/vendor/github.com/openshift/api/config/v1/types_authentication.go index 348ee04010..ab591284d9 100644 --- a/vendor/github.com/openshift/api/config/v1/types_authentication.go +++ b/vendor/github.com/openshift/api/config/v1/types_authentication.go @@ -1087,7 +1087,7 @@ type SourceURL struct { // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=259 // +kubebuilder:validation:XValidation:rule="isURL('https://'+self)",message="hostname must be a valid hostname" - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self.split(':')[0]).hasValue()",message="hostname before port must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" + // +kubebuilder:validation:XValidation:rule="self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')",message="hostname before port must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" // +kubebuilder:validation:XValidation:rule="self.split(':').size() > 1 ? int(self.split(':')[1]) <= 65535 : true",message="port must not exceed 65535" Hostname string `json:"hostname,omitempty"` @@ -1194,7 +1194,7 @@ type ExternalSourceCertificateAuthorityConfigMapReference struct { // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" Name string `json:"name,omitempty"` } @@ -1211,6 +1211,6 @@ type ClientSecretSecretReference struct { // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" Name string `json:"name,omitempty"` } diff --git a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go index 5d9f10374e..a89377ef7d 100644 --- a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go +++ b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go @@ -210,6 +210,21 @@ const ( DNSRecordsTypeInternal DNSRecordsType = "Internal" ) +// VIPManagementType defines which mechanism manages the API and Ingress +// VIPs on an on-premise cluster. +// +kubebuilder:validation:Enum=Keepalived;BGP +// +enum +type VIPManagementType string + +const ( + // VIPManagementTypeKeepalived means the VIPs are managed by the default + // keepalived/VRRP mechanism. + VIPManagementTypeKeepalived VIPManagementType = "Keepalived" + // VIPManagementTypeBGP means the VIPs are advertised via BGP by kube-vip + // (Routing Table Mode) and frr-k8s running as static pods. + VIPManagementTypeBGP VIPManagementType = "BGP" +) + // PlatformType is a specific supported infrastructure provider. // +kubebuilder:validation:Enum="";AWS;Azure;BareMetal;GCP;Libvirt;OpenStack;None;VSphere;oVirt;IBMCloud;KubeVirt;EquinixMetal;PowerVS;AlibabaCloud;Nutanix;External type PlatformType string @@ -586,6 +601,15 @@ type AWSPlatformStatus struct { // IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary // protocol family. // + // Valid values are: + // * "IPv4" (default): Cloud platform resources use IPv4 addressing only. + // * "DualStackIPv6Primary": Cloud platform resources use dual-stack networking with IPv6 as the primary protocol family. + // * "DualStackIPv4Primary": Cloud platform resources use dual-stack networking with IPv4 as the primary protocol family. + // + // When omitted, this field defaults to "IPv4". + // + // This field is immutable and cannot be changed once set. + // // +default="IPv4" // +kubebuilder:default="IPv4" // +kubebuilder:validation:XValidation:rule="oldSelf == '' || self == oldSelf",message="ipFamily is immutable once set" @@ -807,6 +831,25 @@ type GCPPlatformStatus struct { // +nullable CloudLoadBalancerConfig *CloudLoadBalancerConfig `json:"cloudLoadBalancerConfig,omitempty"` + // universeDomain is the GCP universe domain for the cluster, detected from + // the installer credentials. Components with their own GCP credentials should + // read the universe domain from those credentials, as they are the authoritative + // source. This field is provided for components that do not have GCP credentials + // and for general observability. + // + // When omitted, standard public GCP (googleapis.com) is assumed. + // + // universeDomain is an optional field that, when specified, must be non-empty and at most + // 253 characters. It must be a valid DNS subdomain: containing only lowercase alphanumeric + // characters, '-' or '.', and starting and ending with an alphanumeric character. + // + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="universeDomain must be a valid DNS subdomain: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +optional + // +openshift:enable:FeatureGate=GCPSovereignCloudInstall + UniverseDomain string `json:"universeDomain,omitempty"` + // This field was introduced and removed under tech preview. // serviceEndpoints specifies endpoints that override the default endpoints // used when creating clients to interact with GCP services. @@ -1074,6 +1117,21 @@ type BareMetalPlatformStatus struct { // +optional LoadBalancer *BareMetalPlatformLoadBalancer `json:"loadBalancer,omitempty"` + // vipManagement indicates which VIP management mechanism is active + // on this cluster. + // Allowed values are `Keepalived`, `BGP`, and omitted. + // Once set to a non-empty value, this field is immutable. + // When set to `BGP`, kube-vip (Routing Table Mode) and frr-k8s are + // deployed as static pods to advertise VIPs via BGP, replacing the + // default keepalived/VRRP mechanism. + // When set to `Keepalived`, the default keepalived-based VIP + // management is used. + // When omitted, the default keepalived-based VIP management is used. + // +kubebuilder:validation:XValidation:rule="oldSelf == '' || self == oldSelf",message="vipManagement is immutable once set" + // +openshift:enable:FeatureGate=BGPBasedVIPManagement + // +optional + VIPManagement VIPManagementType `json:"vipManagement,omitempty"` + // dnsRecordsType determines whether records for api, api-int, and ingress // are provided by the internal DNS service or externally. // Allowed values are `Internal`, `External`, and omitted. @@ -1423,6 +1481,9 @@ type VSpherePlatformFailureDomainSpec struct { ZoneAffinity *VSphereFailureDomainZoneAffinity `json:"zoneAffinity,omitempty"` // server is the fully-qualified domain name or the IP address of the vCenter server. + // This must match the server field of an entry in the vcenters list. + // The match is case-sensitive; the value must be specified exactly as it appears in the vcenters entry. + // The value must be between 1 and 255 characters long. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=255 @@ -1657,6 +1718,7 @@ type VSpherePlatformNodeNetworking struct { // use these fields for configuration. // +kubebuilder:validation:XValidation:rule="!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)",message="apiServerInternalIPs list is required once set" // +kubebuilder:validation:XValidation:rule="!has(oldSelf.ingressIPs) || has(self.ingressIPs)",message="ingressIPs list is required once set" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=VSphereMultiVCenterDay2,rule="!has(self.failureDomains) || size(self.failureDomains) == 0 || (has(self.vcenters) && self.failureDomains.all(fd, self.vcenters.exists(vc, vc.server == fd.server)))",message="all failure domains must have a corresponding vCenter entry" type VSpherePlatformSpec struct { // vcenters holds the connection details for services to communicate with vCenter. // Up to 3 vCenters are supported. @@ -1681,6 +1743,7 @@ type VSpherePlatformSpec struct { // failureDomains contains the definition of region, zone and the vCenter topology. // If this is omitted failure domains (regions and zones) will not be used. + // Each failure domain's server must match the server field of an entry in the vcenters list. // +listType=map // +listMapKey=name // +optional diff --git a/vendor/github.com/openshift/api/config/v1/types_ingress.go b/vendor/github.com/openshift/api/config/v1/types_ingress.go index bb461e2f3e..622bce0345 100644 --- a/vendor/github.com/openshift/api/config/v1/types_ingress.go +++ b/vendor/github.com/openshift/api/config/v1/types_ingress.go @@ -171,7 +171,8 @@ const ( // alphanumeric characters, '-', '_', or '.', starting and ending with // an alphanumeric character. // +kubebuilder:validation:MaxLength=63 -// +kubebuilder:validation:XValidation:rule="!format.labelValue().validate(self).hasValue()",message="label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric)" +// +kubebuilder:validation:MinLength=0 +// +kubebuilder:validation:XValidation:rule="self == \"\" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')",message="label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric)" type LabelValue string // ConsumingUser is an alias for string which we add validation to. Currently only service accounts are supported. @@ -278,7 +279,8 @@ type ComponentRouteSpec struct { // +mapType=granular // +kubebuilder:validation:MinProperties=1 // +kubebuilder:validation:MaxProperties=8 - // +kubebuilder:validation:XValidation:rule="self.all(key, !format.qualifiedName().validate(key).hasValue())",message="label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.all(key, key.size() <= 63 && key.size() > 0)",message="label keys must be between 1 and 63 characters in length" + // +kubebuilder:validation:XValidation:rule="self.all(key, key.matches('^([a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*\\\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') && key.size() <= 253)",message="label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character" // +kubebuilder:validation:XValidation:rule="self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') && !key.startsWith('openshift.io/'))",message="kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used" Labels map[string]LabelValue `json:"labels,omitempty"` } diff --git a/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go b/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go index 6b58d9da49..e2f94ae1f3 100644 --- a/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go +++ b/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go @@ -63,7 +63,7 @@ type VaultSecretReference struct { // // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" // +required Name string `json:"name,omitempty"` } @@ -76,7 +76,7 @@ type VaultConfigMapReference struct { // // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" // +required Name string `json:"name,omitempty"` } @@ -181,6 +181,23 @@ type VaultKMSPluginConfig struct { // +optional VaultNamespace string `json:"vaultNamespace,omitempty"` + // vaultAuthNamespace specifies the Vault namespace to use for authentication. + // This is only applicable for Vault Enterprise installations where authentication + // and Transit operations may be in different namespaces. + // When this field is not set, the value of vaultNamespace is used for both + // authentication and Transit key operations. + // + // The value must be between 1 and 4096 characters. + // The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. + // + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=4096 + // +kubebuilder:validation:XValidation:rule="!self.endsWith('/')",message="vaultAuthNamespace cannot end with a forward slash" + // +kubebuilder:validation:XValidation:rule="!self.contains(' ')",message="vaultAuthNamespace cannot contain spaces" + // +kubebuilder:validation:XValidation:rule="!(self in ['root', 'sys', 'audit', 'auth', 'cubbyhole', 'identity'])",message="vaultAuthNamespace cannot be a reserved string (root, sys, audit, auth, cubbyhole, identity)" + // +optional + VaultAuthNamespace string `json:"vaultAuthNamespace,omitempty"` + // tls contains the TLS configuration for connecting to the Vault server. // When this field is not set, system default TLS settings are used. // +optional @@ -191,7 +208,32 @@ type VaultKMSPluginConfig struct { // +required Authentication VaultAuthentication `json:"authentication,omitzero"` + // vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine, + // combining the Transit engine mount path and the key name separated by "/keys/". + // Format: /keys/ (e.g., transit/keys/my-key, myteam/transit/keys/production-key). + // + // The total path length must be between 8 and 1542 characters. + // The path cannot start or end with a forward slash, cannot contain consecutive forward slashes, + // must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) + // and forward slashes as path separators, and must not contain "." or ".." path segments. + // The key name must start and end with an alphanumeric character or underscore, and may contain + // alphanumeric characters, underscores, hyphens, and periods in the middle. + // + // +kubebuilder:validation:MinLength=8 + // +kubebuilder:validation:MaxLength=1542 + // +kubebuilder:validation:XValidation:rule="!self.startsWith('/')",message="vaultKeyPath cannot start with a forward slash" + // +kubebuilder:validation:XValidation:rule="!self.endsWith('/')",message="vaultKeyPath cannot end with a forward slash" + // +kubebuilder:validation:XValidation:rule="!self.contains('//')",message="vaultKeyPath cannot contain consecutive forward slashes" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._~/-]+$')",message="vaultKeyPath must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) and forward slashes" + // +kubebuilder:validation:XValidation:rule="self.split('/').filter(s, s == '.' || s == '..').size() == 0",message="vaultKeyPath must not contain '.' or '..' path segments" + // +kubebuilder:validation:XValidation:rule=`self.matches('^[a-zA-Z0-9._~-]+(/[a-zA-Z0-9._~-]+)*/keys/[a-zA-Z0-9_]([a-zA-Z0-9_.-]*[a-zA-Z0-9_])?$')`,message="vaultKeyPath must follow the format /keys/ where the key name starts and ends with an alphanumeric character or underscore and may contain alphanumeric characters, underscores, hyphens, and periods" + // +required + VaultKeyPath string `json:"vaultKeyPath,omitempty"` + + // --- TOMBSTONE --- // transitMount specifies the mount path of the Vault Transit engine. + // It has been replaced by vaultKeyPath which combines the mount and key into a single path. + // The field name is reserved to prevent reuse. // // The transit mount must be between 1 and 1024 characters, cannot start or // end with a forward slash, cannot contain consecutive forward slashes, and @@ -205,10 +247,13 @@ type VaultKMSPluginConfig struct { // +kubebuilder:validation:XValidation:rule="!self.contains('//')",message="transitMount cannot contain consecutive forward slashes" // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._~/-]+$')",message="transitMount must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) and forward slashes" // +required - TransitMount string `json:"transitMount,omitempty"` + // TransitMount string `json:"transitMount,omitempty"` + // --- TOMBSTONE --- // transitKey specifies the name of the encryption key in Vault's Transit engine. // This key is used to encrypt and decrypt data. + // It has been replaced by vaultKeyPath which combines the mount and key into a single path. + // The field name is reserved to prevent reuse. // // The transit key must be between 1 and 512 characters, cannot contain forward slashes, // and must only contain alphanumeric characters, hyphens, periods, and underscores. @@ -218,7 +263,7 @@ type VaultKMSPluginConfig struct { // +kubebuilder:validation:XValidation:rule="!self.contains('/')",message="transitKey cannot contain forward slashes" // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._-]+$')",message="transitKey must only contain alphanumeric characters, hyphens, periods, and underscores" // +required - TransitKey string `json:"transitKey,omitempty"` + // TransitKey string `json:"transitKey,omitempty"` } // VaultTLSConfig contains TLS configuration for connecting to Vault. @@ -255,7 +300,7 @@ type VaultTLSConfig struct { // // +kubebuilder:validation:MaxLength=253 // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" // +optional ServerName string `json:"serverName,omitempty"` } diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index b18ea74640..f3793fac61 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,47 +327,8 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object - transitKey: - description: |- - transitKey specifies the name of the encryption key in Vault's Transit engine. - This key is used to encrypt and decrypt data. - - The transit key must be between 1 and 512 characters, cannot contain forward slashes, - and must only contain alphanumeric characters, hyphens, periods, and underscores. - maxLength: 512 - minLength: 1 - type: string - x-kubernetes-validations: - - message: transitKey cannot contain forward slashes - rule: '!self.contains(''/'')' - - message: transitKey must only contain alphanumeric characters, - hyphens, periods, and underscores - rule: self.matches('^[a-zA-Z0-9._-]+$') - transitMount: - description: |- - transitMount specifies the mount path of the Vault Transit engine. - - The transit mount must be between 1 and 1024 characters, cannot start or - end with a forward slash, cannot contain consecutive forward slashes, and - must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, - period, underscore, tilde) and forward slashes as path separators. - maxLength: 1024 - minLength: 1 - type: string - x-kubernetes-validations: - - message: transitMount cannot start with a forward slash - rule: '!self.startsWith(''/'')' - - message: transitMount cannot end with a forward slash - rule: '!self.endsWith(''/'')' - - message: transitMount cannot contain consecutive forward - slashes - rule: '!self.contains(''//'')' - - message: transitMount must only contain RFC 3986 unreserved - characters (alphanumeric, hyphen, period, underscore, - tilde) and forward slashes - rule: self.matches('^[a-zA-Z0-9._~/-]+$') vaultAddress: description: |- vaultAddress specifies the address of the HashiCorp Vault instance. @@ -395,6 +356,65 @@ spec: rule: self.find('#(.+)$') == '' - message: must not have user info rule: self.find('@') == '' + vaultAuthNamespace: + description: |- + vaultAuthNamespace specifies the Vault namespace to use for authentication. + This is only applicable for Vault Enterprise installations where authentication + and Transit operations may be in different namespaces. + When this field is not set, the value of vaultNamespace is used for both + authentication and Transit key operations. + + The value must be between 1 and 4096 characters. + The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. + maxLength: 4096 + minLength: 1 + type: string + x-kubernetes-validations: + - message: vaultAuthNamespace cannot end with a forward + slash + rule: '!self.endsWith(''/'')' + - message: vaultAuthNamespace cannot contain spaces + rule: '!self.contains('' '')' + - message: vaultAuthNamespace cannot be a reserved string + (root, sys, audit, auth, cubbyhole, identity) + rule: '!(self in [''root'', ''sys'', ''audit'', ''auth'', + ''cubbyhole'', ''identity''])' + vaultKeyPath: + description: |- + vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine, + combining the Transit engine mount path and the key name separated by "/keys/". + Format: /keys/ (e.g., transit/keys/my-key, myteam/transit/keys/production-key). + + The total path length must be between 8 and 1542 characters. + The path cannot start or end with a forward slash, cannot contain consecutive forward slashes, + must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) + and forward slashes as path separators, and must not contain "." or ".." path segments. + The key name must start and end with an alphanumeric character or underscore, and may contain + alphanumeric characters, underscores, hyphens, and periods in the middle. + maxLength: 1542 + minLength: 8 + type: string + x-kubernetes-validations: + - message: vaultKeyPath cannot start with a forward slash + rule: '!self.startsWith(''/'')' + - message: vaultKeyPath cannot end with a forward slash + rule: '!self.endsWith(''/'')' + - message: vaultKeyPath cannot contain consecutive forward + slashes + rule: '!self.contains(''//'')' + - message: vaultKeyPath must only contain RFC 3986 unreserved + characters (alphanumeric, hyphen, period, underscore, + tilde) and forward slashes + rule: self.matches('^[a-zA-Z0-9._~/-]+$') + - message: vaultKeyPath must not contain '.' or '..' path + segments + rule: self.split('/').filter(s, s == '.' || s == '..').size() + == 0 + - message: vaultKeyPath must follow the format /keys/ + where the key name starts and ends with an alphanumeric + character or underscore and may contain alphanumeric + characters, underscores, hyphens, and periods + rule: self.matches('^[a-zA-Z0-9._~-]+(/[a-zA-Z0-9._~-]+)*/keys/[a-zA-Z0-9_]([a-zA-Z0-9_.-]*[a-zA-Z0-9_])?$') vaultNamespace: description: |- vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. @@ -418,9 +438,8 @@ spec: required: - authentication - kmsPluginImage - - transitKey - - transitMount - vaultAddress + - vaultKeyPath type: object required: - type diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index b8700ff3f1..d06cd26ca7 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,47 +327,8 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object - transitKey: - description: |- - transitKey specifies the name of the encryption key in Vault's Transit engine. - This key is used to encrypt and decrypt data. - - The transit key must be between 1 and 512 characters, cannot contain forward slashes, - and must only contain alphanumeric characters, hyphens, periods, and underscores. - maxLength: 512 - minLength: 1 - type: string - x-kubernetes-validations: - - message: transitKey cannot contain forward slashes - rule: '!self.contains(''/'')' - - message: transitKey must only contain alphanumeric characters, - hyphens, periods, and underscores - rule: self.matches('^[a-zA-Z0-9._-]+$') - transitMount: - description: |- - transitMount specifies the mount path of the Vault Transit engine. - - The transit mount must be between 1 and 1024 characters, cannot start or - end with a forward slash, cannot contain consecutive forward slashes, and - must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, - period, underscore, tilde) and forward slashes as path separators. - maxLength: 1024 - minLength: 1 - type: string - x-kubernetes-validations: - - message: transitMount cannot start with a forward slash - rule: '!self.startsWith(''/'')' - - message: transitMount cannot end with a forward slash - rule: '!self.endsWith(''/'')' - - message: transitMount cannot contain consecutive forward - slashes - rule: '!self.contains(''//'')' - - message: transitMount must only contain RFC 3986 unreserved - characters (alphanumeric, hyphen, period, underscore, - tilde) and forward slashes - rule: self.matches('^[a-zA-Z0-9._~/-]+$') vaultAddress: description: |- vaultAddress specifies the address of the HashiCorp Vault instance. @@ -395,6 +356,65 @@ spec: rule: self.find('#(.+)$') == '' - message: must not have user info rule: self.find('@') == '' + vaultAuthNamespace: + description: |- + vaultAuthNamespace specifies the Vault namespace to use for authentication. + This is only applicable for Vault Enterprise installations where authentication + and Transit operations may be in different namespaces. + When this field is not set, the value of vaultNamespace is used for both + authentication and Transit key operations. + + The value must be between 1 and 4096 characters. + The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. + maxLength: 4096 + minLength: 1 + type: string + x-kubernetes-validations: + - message: vaultAuthNamespace cannot end with a forward + slash + rule: '!self.endsWith(''/'')' + - message: vaultAuthNamespace cannot contain spaces + rule: '!self.contains('' '')' + - message: vaultAuthNamespace cannot be a reserved string + (root, sys, audit, auth, cubbyhole, identity) + rule: '!(self in [''root'', ''sys'', ''audit'', ''auth'', + ''cubbyhole'', ''identity''])' + vaultKeyPath: + description: |- + vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine, + combining the Transit engine mount path and the key name separated by "/keys/". + Format: /keys/ (e.g., transit/keys/my-key, myteam/transit/keys/production-key). + + The total path length must be between 8 and 1542 characters. + The path cannot start or end with a forward slash, cannot contain consecutive forward slashes, + must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) + and forward slashes as path separators, and must not contain "." or ".." path segments. + The key name must start and end with an alphanumeric character or underscore, and may contain + alphanumeric characters, underscores, hyphens, and periods in the middle. + maxLength: 1542 + minLength: 8 + type: string + x-kubernetes-validations: + - message: vaultKeyPath cannot start with a forward slash + rule: '!self.startsWith(''/'')' + - message: vaultKeyPath cannot end with a forward slash + rule: '!self.endsWith(''/'')' + - message: vaultKeyPath cannot contain consecutive forward + slashes + rule: '!self.contains(''//'')' + - message: vaultKeyPath must only contain RFC 3986 unreserved + characters (alphanumeric, hyphen, period, underscore, + tilde) and forward slashes + rule: self.matches('^[a-zA-Z0-9._~/-]+$') + - message: vaultKeyPath must not contain '.' or '..' path + segments + rule: self.split('/').filter(s, s == '.' || s == '..').size() + == 0 + - message: vaultKeyPath must follow the format /keys/ + where the key name starts and ends with an alphanumeric + character or underscore and may contain alphanumeric + characters, underscores, hyphens, and periods + rule: self.matches('^[a-zA-Z0-9._~-]+(/[a-zA-Z0-9._~-]+)*/keys/[a-zA-Z0-9_]([a-zA-Z0-9_.-]*[a-zA-Z0-9_])?$') vaultNamespace: description: |- vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. @@ -418,9 +438,8 @@ spec: required: - authentication - kmsPluginImage - - transitKey - - transitMount - vaultAddress + - vaultKeyPath type: object required: - type diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index 6728a62ef5..cce3359454 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,47 +327,8 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object - transitKey: - description: |- - transitKey specifies the name of the encryption key in Vault's Transit engine. - This key is used to encrypt and decrypt data. - - The transit key must be between 1 and 512 characters, cannot contain forward slashes, - and must only contain alphanumeric characters, hyphens, periods, and underscores. - maxLength: 512 - minLength: 1 - type: string - x-kubernetes-validations: - - message: transitKey cannot contain forward slashes - rule: '!self.contains(''/'')' - - message: transitKey must only contain alphanumeric characters, - hyphens, periods, and underscores - rule: self.matches('^[a-zA-Z0-9._-]+$') - transitMount: - description: |- - transitMount specifies the mount path of the Vault Transit engine. - - The transit mount must be between 1 and 1024 characters, cannot start or - end with a forward slash, cannot contain consecutive forward slashes, and - must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, - period, underscore, tilde) and forward slashes as path separators. - maxLength: 1024 - minLength: 1 - type: string - x-kubernetes-validations: - - message: transitMount cannot start with a forward slash - rule: '!self.startsWith(''/'')' - - message: transitMount cannot end with a forward slash - rule: '!self.endsWith(''/'')' - - message: transitMount cannot contain consecutive forward - slashes - rule: '!self.contains(''//'')' - - message: transitMount must only contain RFC 3986 unreserved - characters (alphanumeric, hyphen, period, underscore, - tilde) and forward slashes - rule: self.matches('^[a-zA-Z0-9._~/-]+$') vaultAddress: description: |- vaultAddress specifies the address of the HashiCorp Vault instance. @@ -395,6 +356,65 @@ spec: rule: self.find('#(.+)$') == '' - message: must not have user info rule: self.find('@') == '' + vaultAuthNamespace: + description: |- + vaultAuthNamespace specifies the Vault namespace to use for authentication. + This is only applicable for Vault Enterprise installations where authentication + and Transit operations may be in different namespaces. + When this field is not set, the value of vaultNamespace is used for both + authentication and Transit key operations. + + The value must be between 1 and 4096 characters. + The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. + maxLength: 4096 + minLength: 1 + type: string + x-kubernetes-validations: + - message: vaultAuthNamespace cannot end with a forward + slash + rule: '!self.endsWith(''/'')' + - message: vaultAuthNamespace cannot contain spaces + rule: '!self.contains('' '')' + - message: vaultAuthNamespace cannot be a reserved string + (root, sys, audit, auth, cubbyhole, identity) + rule: '!(self in [''root'', ''sys'', ''audit'', ''auth'', + ''cubbyhole'', ''identity''])' + vaultKeyPath: + description: |- + vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine, + combining the Transit engine mount path and the key name separated by "/keys/". + Format: /keys/ (e.g., transit/keys/my-key, myteam/transit/keys/production-key). + + The total path length must be between 8 and 1542 characters. + The path cannot start or end with a forward slash, cannot contain consecutive forward slashes, + must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) + and forward slashes as path separators, and must not contain "." or ".." path segments. + The key name must start and end with an alphanumeric character or underscore, and may contain + alphanumeric characters, underscores, hyphens, and periods in the middle. + maxLength: 1542 + minLength: 8 + type: string + x-kubernetes-validations: + - message: vaultKeyPath cannot start with a forward slash + rule: '!self.startsWith(''/'')' + - message: vaultKeyPath cannot end with a forward slash + rule: '!self.endsWith(''/'')' + - message: vaultKeyPath cannot contain consecutive forward + slashes + rule: '!self.contains(''//'')' + - message: vaultKeyPath must only contain RFC 3986 unreserved + characters (alphanumeric, hyphen, period, underscore, + tilde) and forward slashes + rule: self.matches('^[a-zA-Z0-9._~/-]+$') + - message: vaultKeyPath must not contain '.' or '..' path + segments + rule: self.split('/').filter(s, s == '.' || s == '..').size() + == 0 + - message: vaultKeyPath must follow the format /keys/ + where the key name starts and ends with an alphanumeric + character or underscore and may contain alphanumeric + characters, underscores, hyphens, and periods + rule: self.matches('^[a-zA-Z0-9._~-]+(/[a-zA-Z0-9._~-]+)*/keys/[a-zA-Z0-9_]([a-zA-Z0-9_.-]*[a-zA-Z0-9_])?$') vaultNamespace: description: |- vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. @@ -418,9 +438,8 @@ spec: required: - authentication - kmsPluginImage - - transitKey - - transitMount - vaultAddress + - vaultKeyPath type: object required: - type diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml index 8c2695a581..ebf8cefe08 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml @@ -518,7 +518,7 @@ spec: lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -583,7 +583,7 @@ spec: a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -791,7 +791,7 @@ spec: alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -827,7 +827,7 @@ spec: with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()' + rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') - message: port must not exceed 65535 rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1]) <= 65535 : true' diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml index 5e6be8db9f..3bdc57e083 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml @@ -195,6 +195,19 @@ spec: claim is required when the ExternalOIDCWithUpstreamParity feature gate is not enabled. maxLength: 256 type: string + expression: + description: |- + expression is an optional CEL expression used to derive + group values from JWT claims. + + CEL expressions have access to the token claims through a CEL variable, 'claims'. + + expression must be at least 1 character and must not exceed 1024 characters in length . + + When specified, claim must not be set or be explicitly set to the empty string (`""`). + maxLength: 1024 + minLength: 1 + type: string prefix: description: |- prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes. @@ -206,8 +219,15 @@ spec: type: string type: object x-kubernetes-validations: - - message: claim is required - rule: has(self.claim) + - message: prefix must not be set to a non-empty value when + expression is set + rule: 'has(self.expression) && size(self.expression) > + 0 ? (!has(self.prefix) || size(self.prefix) == 0) : + true' + - message: expression must not be set if claim is specified + and is not an empty string + rule: '(size(self.?claim.orValue("")) > 0) ? !has(self.expression) + : true' uid: description: |- uid is an optional field for configuring the claim mapping used to construct the uid for the cluster identity. @@ -266,6 +286,19 @@ spec: maxLength: 256 minLength: 1 type: string + expression: + description: |- + expression is an optional CEL expression used to derive + the username from JWT claims. + + CEL expressions have access to the token claims + through a CEL variable, 'claims'. + + expression must be at least 1 character and must not exceed 1024 characters in length. + expression must not be set when claim is set. + maxLength: 1024 + minLength: 1 + type: string prefix: description: |- prefix configures the prefix that should be prepended to the value of the JWT claim. @@ -309,8 +342,14 @@ spec: type: string type: object x-kubernetes-validations: - - message: claim is required - rule: has(self.claim) + - message: precisely one of claim or expression must be + set + rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)' + - message: prefixPolicy must not be set to 'Prefix' when + expression is set + rule: 'has(self.expression) && size(self.expression) > + 0 ? !has(self.prefixPolicy) || self.prefixPolicy != + ''Prefix'' : true' - message: prefix must be set if prefixPolicy is 'Prefix', but must remain unset otherwise rule: 'has(self.prefixPolicy) && self.prefixPolicy == @@ -330,6 +369,30 @@ spec: If type is RequiredClaim, requiredClaim must be set. If Type is CEL, CEL must be set and RequiredClaim must be omitted. properties: + cel: + description: |- + cel holds the CEL expression and message for validation. + Must be set when Type is "CEL", and forbidden otherwise. + properties: + expression: + description: |- + expression is a CEL expression evaluated against token claims. + expression is required, must be at least 1 character in length and must not exceed 1024 characters. + The expression must return a boolean value where 'true' signals a valid token and 'false' an invalid one. + maxLength: 1024 + minLength: 1 + type: string + message: + description: |- + message is a required human-readable message to be logged by the Kubernetes API server if the CEL expression defined in 'expression' fails. + message must be at least 1 character in length and must not exceed 256 characters. + maxLength: 256 + minLength: 1 + type: string + required: + - expression + - message + type: object requiredClaim: description: |- requiredClaim allows configuring a required claim name and its expected value. @@ -367,11 +430,16 @@ spec: When set to 'CEL', the Kubernetes API server will be configured to validate the incoming JWT against the configured CEL expression. enum: - RequiredClaim + - CEL type: string required: - type type: object x-kubernetes-validations: + - message: cel must be set when type is 'CEL', and forbidden + otherwise + rule: 'has(self.type) && self.type == ''CEL'' ? has(self.cel) + : !has(self.cel)' - message: requiredClaim must be set when type is 'RequiredClaim', and forbidden otherwise rule: 'has(self.type) && self.type == ''RequiredClaim'' @@ -397,6 +465,29 @@ spec: minItems: 1 type: array x-kubernetes-list-type: set + discoveryURL: + description: |- + discoveryURL is an optional field that, if specified, overrides the default discovery endpoint used to retrieve OIDC configuration metadata. + By default, the discovery URL is derived from `issuerURL` as "{issuerURL}/.well-known/openid-configuration". + + The discoveryURL must be a valid absolute HTTPS URL. + It must not contain query parameters, user information, or fragments. + Additionally, it must differ from the value of `issuerURL` (ignoring trailing slashes). + The discoveryURL value must be at least 1 character long and no longer than 2048 characters. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: discoveryURL must be a valid URL + rule: isURL(self) + - message: discoveryURL must be a valid https URL + rule: url(self).getScheme() == 'https' + - message: discoveryURL must not contain query parameters + rule: url(self).getQuery().size() == 0 + - message: discoveryURL must not contain fragments + rule: self.matches('^[^#]*$') + - message: discoveryURL must not contain user info + rule: '!self.matches(''^https://.+:.+@.+/.*$'')' issuerCertificateAuthority: description: |- issuerCertificateAuthority is an optional field that configures the certificate authority, used by the Kubernetes API server, to validate the connection to the identity provider when fetching discovery information. @@ -437,6 +528,11 @@ spec: - audiences - issuerURL type: object + x-kubernetes-validations: + - message: discoveryURL must be different from issuerURL + rule: 'self.?discoveryURL.orValue("").size() > 0 ? (self.issuerURL.size() + == 0 || self.discoveryURL.find(''^.+[^/]'') != self.issuerURL.find(''^.+[^/]'')) + : true' name: description: |- name is a required field that configures the unique human-readable identifier associated with the identity provider. @@ -521,6 +617,45 @@ spec: - componentNamespace - componentName x-kubernetes-list-type: map + userValidationRules: + description: |- + userValidationRules is an optional field that configures the set of rules used to validate the cluster user identity that was constructed via mapping token claims to user identity attributes. + Rules are CEL expressions that must evaluate to 'true' for authentication to succeed. + If any rule in the chain of rules evaluates to 'false', authentication will fail. + When specified, at least one rule must be specified and no more than 64 rules may be specified. + items: + description: |- + TokenUserValidationRule provides a CEL-based rule used to validate a token subject. + Each rule contains a CEL expression that is evaluated against the token’s claims. + properties: + expression: + description: |- + expression is a required CEL expression that performs a validation on cluster user identity attributes like username, groups, etc. + + The expression must evaluate to a boolean value. + When the expression evaluates to 'true', the cluster user identity is considered valid. + When the expression evaluates to 'false', the cluster user identity is not considered valid. + expression must be at least 1 character in length and must not exceed 1024 characters. + maxLength: 1024 + minLength: 1 + type: string + message: + description: |- + message is a required human-readable message to be logged by the Kubernetes API server if the CEL expression defined in 'expression' fails. + message must be at least 1 character in length and must not exceed 256 characters. + maxLength: 256 + minLength: 1 + type: string + required: + - expression + - message + type: object + maxItems: 64 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - expression + x-kubernetes-list-type: map required: - claimMappings - issuer diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml index 09111b08ce..e5f0c9bb9b 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml @@ -518,7 +518,7 @@ spec: lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -583,7 +583,7 @@ spec: a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -791,7 +791,7 @@ spec: alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -827,7 +827,7 @@ spec: with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()' + rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') - message: port must not exceed 65535 rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1]) <= 65535 : true' diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml index dcfe61e693..ea16c6b5c9 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-OKD.crd.yaml @@ -195,6 +195,19 @@ spec: claim is required when the ExternalOIDCWithUpstreamParity feature gate is not enabled. maxLength: 256 type: string + expression: + description: |- + expression is an optional CEL expression used to derive + group values from JWT claims. + + CEL expressions have access to the token claims through a CEL variable, 'claims'. + + expression must be at least 1 character and must not exceed 1024 characters in length . + + When specified, claim must not be set or be explicitly set to the empty string (`""`). + maxLength: 1024 + minLength: 1 + type: string prefix: description: |- prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes. @@ -206,8 +219,15 @@ spec: type: string type: object x-kubernetes-validations: - - message: claim is required - rule: has(self.claim) + - message: prefix must not be set to a non-empty value when + expression is set + rule: 'has(self.expression) && size(self.expression) > + 0 ? (!has(self.prefix) || size(self.prefix) == 0) : + true' + - message: expression must not be set if claim is specified + and is not an empty string + rule: '(size(self.?claim.orValue("")) > 0) ? !has(self.expression) + : true' uid: description: |- uid is an optional field for configuring the claim mapping used to construct the uid for the cluster identity. @@ -266,6 +286,19 @@ spec: maxLength: 256 minLength: 1 type: string + expression: + description: |- + expression is an optional CEL expression used to derive + the username from JWT claims. + + CEL expressions have access to the token claims + through a CEL variable, 'claims'. + + expression must be at least 1 character and must not exceed 1024 characters in length. + expression must not be set when claim is set. + maxLength: 1024 + minLength: 1 + type: string prefix: description: |- prefix configures the prefix that should be prepended to the value of the JWT claim. @@ -309,8 +342,14 @@ spec: type: string type: object x-kubernetes-validations: - - message: claim is required - rule: has(self.claim) + - message: precisely one of claim or expression must be + set + rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)' + - message: prefixPolicy must not be set to 'Prefix' when + expression is set + rule: 'has(self.expression) && size(self.expression) > + 0 ? !has(self.prefixPolicy) || self.prefixPolicy != + ''Prefix'' : true' - message: prefix must be set if prefixPolicy is 'Prefix', but must remain unset otherwise rule: 'has(self.prefixPolicy) && self.prefixPolicy == @@ -330,6 +369,30 @@ spec: If type is RequiredClaim, requiredClaim must be set. If Type is CEL, CEL must be set and RequiredClaim must be omitted. properties: + cel: + description: |- + cel holds the CEL expression and message for validation. + Must be set when Type is "CEL", and forbidden otherwise. + properties: + expression: + description: |- + expression is a CEL expression evaluated against token claims. + expression is required, must be at least 1 character in length and must not exceed 1024 characters. + The expression must return a boolean value where 'true' signals a valid token and 'false' an invalid one. + maxLength: 1024 + minLength: 1 + type: string + message: + description: |- + message is a required human-readable message to be logged by the Kubernetes API server if the CEL expression defined in 'expression' fails. + message must be at least 1 character in length and must not exceed 256 characters. + maxLength: 256 + minLength: 1 + type: string + required: + - expression + - message + type: object requiredClaim: description: |- requiredClaim allows configuring a required claim name and its expected value. @@ -367,11 +430,16 @@ spec: When set to 'CEL', the Kubernetes API server will be configured to validate the incoming JWT against the configured CEL expression. enum: - RequiredClaim + - CEL type: string required: - type type: object x-kubernetes-validations: + - message: cel must be set when type is 'CEL', and forbidden + otherwise + rule: 'has(self.type) && self.type == ''CEL'' ? has(self.cel) + : !has(self.cel)' - message: requiredClaim must be set when type is 'RequiredClaim', and forbidden otherwise rule: 'has(self.type) && self.type == ''RequiredClaim'' @@ -397,6 +465,29 @@ spec: minItems: 1 type: array x-kubernetes-list-type: set + discoveryURL: + description: |- + discoveryURL is an optional field that, if specified, overrides the default discovery endpoint used to retrieve OIDC configuration metadata. + By default, the discovery URL is derived from `issuerURL` as "{issuerURL}/.well-known/openid-configuration". + + The discoveryURL must be a valid absolute HTTPS URL. + It must not contain query parameters, user information, or fragments. + Additionally, it must differ from the value of `issuerURL` (ignoring trailing slashes). + The discoveryURL value must be at least 1 character long and no longer than 2048 characters. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: discoveryURL must be a valid URL + rule: isURL(self) + - message: discoveryURL must be a valid https URL + rule: url(self).getScheme() == 'https' + - message: discoveryURL must not contain query parameters + rule: url(self).getQuery().size() == 0 + - message: discoveryURL must not contain fragments + rule: self.matches('^[^#]*$') + - message: discoveryURL must not contain user info + rule: '!self.matches(''^https://.+:.+@.+/.*$'')' issuerCertificateAuthority: description: |- issuerCertificateAuthority is an optional field that configures the certificate authority, used by the Kubernetes API server, to validate the connection to the identity provider when fetching discovery information. @@ -437,6 +528,11 @@ spec: - audiences - issuerURL type: object + x-kubernetes-validations: + - message: discoveryURL must be different from issuerURL + rule: 'self.?discoveryURL.orValue("").size() > 0 ? (self.issuerURL.size() + == 0 || self.discoveryURL.find(''^.+[^/]'') != self.issuerURL.find(''^.+[^/]'')) + : true' name: description: |- name is a required field that configures the unique human-readable identifier associated with the identity provider. @@ -521,6 +617,45 @@ spec: - componentNamespace - componentName x-kubernetes-list-type: map + userValidationRules: + description: |- + userValidationRules is an optional field that configures the set of rules used to validate the cluster user identity that was constructed via mapping token claims to user identity attributes. + Rules are CEL expressions that must evaluate to 'true' for authentication to succeed. + If any rule in the chain of rules evaluates to 'false', authentication will fail. + When specified, at least one rule must be specified and no more than 64 rules may be specified. + items: + description: |- + TokenUserValidationRule provides a CEL-based rule used to validate a token subject. + Each rule contains a CEL expression that is evaluated against the token’s claims. + properties: + expression: + description: |- + expression is a required CEL expression that performs a validation on cluster user identity attributes like username, groups, etc. + + The expression must evaluate to a boolean value. + When the expression evaluates to 'true', the cluster user identity is considered valid. + When the expression evaluates to 'false', the cluster user identity is not considered valid. + expression must be at least 1 character in length and must not exceed 1024 characters. + maxLength: 1024 + minLength: 1 + type: string + message: + description: |- + message is a required human-readable message to be logged by the Kubernetes API server if the CEL expression defined in 'expression' fails. + message must be at least 1 character in length and must not exceed 256 characters. + maxLength: 256 + minLength: 1 + type: string + required: + - expression + - message + type: object + maxItems: 64 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - expression + x-kubernetes-list-type: map required: - claimMappings - issuer diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml index d883307d84..47e5625bb9 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml @@ -518,7 +518,7 @@ spec: lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -583,7 +583,7 @@ spec: a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -791,7 +791,7 @@ spec: alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -827,7 +827,7 @@ spec: with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()' + rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') - message: port must not exceed 65535 rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1]) <= 65535 : true' diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-Hypershift.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-Hypershift.crd.yaml new file mode 100644 index 0000000000..4043255601 --- /dev/null +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-Hypershift.crd.yaml @@ -0,0 +1,213 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/2725 + api.openshift.io/merged-by-featuregates: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + release.openshift.io/feature-set: CustomNoUpgrade + name: criocredentialproviderconfigs.config.openshift.io +spec: + group: config.openshift.io + names: + kind: CRIOCredentialProviderConfig + listKind: CRIOCredentialProviderConfigList + plural: criocredentialproviderconfigs + singular: criocredentialproviderconfig + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: |- + CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is "cluster". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources. + For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in. + CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation. + Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout. + + The resource is a singleton named "cluster". + + Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + spec defines the desired configuration of the CRI-O Credential Provider. + This field is required and must be provided when creating the resource. + minProperties: 0 + properties: + matchImages: + description: |- + matchImages is a list of string patterns used to determine whether + the CRI-O credential provider should be invoked for a given image. This list is + passed to the kubelet CredentialProviderConfig, and if any pattern matches + the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling + that image or its mirrors. + Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider. + Conflicts between the existing platform specific provider image match configuration and this list will be handled by + the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those + from the CRIOCredentialProviderConfig when both match the same image. + To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with + existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml). + You can check the resource's Status conditions + to see if any entries were ignored due to exact matches with known built-in provider patterns. + + This field is optional, the items of the list must contain between 1 and 50 entries. + The list is treated as a set, so duplicate entries are not allowed. + + For more details, see: + https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/ + https://github.com/cri-o/crio-credential-provider#architecture + + Each entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters. + Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io', + and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net'). + A global wildcard '*' (matching any domain) is not allowed. + Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path. + For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not. + Each wildcard matches only a single domain label, + so '*.io' does **not** match '*.k8s.io'. + + A match exists between an image and a matchImage when all of the below are true: + Both contain the same number of domain parts and each part matches. + The URL path of an matchImages must be a prefix of the target image URL path. + If the matchImages contains a port, then the port must match in the image as well. + + Example values of matchImages: + - 123456789.dkr.ecr.us-east-1.amazonaws.com + - *.azurecr.io + - gcr.io + - *.*.registry.io + - registry.io:8080/path + items: + description: |- + MatchImage is a string pattern used to match container image registry addresses. + It must be a valid fully qualified domain name with optional wildcard, port, and path. + The maximum length is 512 characters. + + Wildcards ('*') are supported for full subdomain labels and top-level domains. + Each entry can optionally contain a port (e.g., :8080) and a path (e.g., /path). + Wildcards are not allowed in the port or path portions. + + Examples: + - "registry.io" - matches exactly registry.io + - "*.azurecr.io" - matches any single subdomain of azurecr.io + - "registry.io:8080/path" - matches with specific port and path prefix + maxLength: 512 + minLength: 1 + type: string + x-kubernetes-validations: + - message: global wildcard '*' is not allowed + rule: self != '*' + - message: invalid matchImages value, must be a valid fully qualified + domain name in lowercase with optional wildcard, port, and path + rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$') + maxItems: 50 + minItems: 1 + type: array + x-kubernetes-list-type: set + type: object + status: + description: |- + status represents the current state of the CRIOCredentialProviderConfig. + When omitted or nil, it indicates that the status has not yet been set by the controller. + The controller will populate this field with validation conditions and operational state. + minProperties: 1 + properties: + conditions: + description: |- + conditions represent the latest available observations of the configuration state. + When omitted, it indicates that no conditions have been reported yet. + The maximum number of conditions is 16. + Conditions are stored as a map keyed by condition type, ensuring uniqueness. + + Expected condition types include: + "Validated": indicates whether the matchImages configuration is valid + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 16 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + x-kubernetes-validations: + - message: criocredentialproviderconfig is a singleton, .metadata.name must + be 'cluster' + rule: self.metadata.name == 'cluster' + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-SelfManagedHA.crd.yaml similarity index 50% rename from vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs.crd.yaml rename to vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-SelfManagedHA.crd.yaml index 7a720440ac..baf6bfec28 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_criocredentialproviderconfigs-SelfManagedHA.crd.yaml @@ -4,9 +4,7 @@ metadata: annotations: api-approved.openshift.io: https://github.com/openshift/api/pull/2725 api.openshift.io/merged-by-featuregates: "true" - include.release.openshift.io/ibm-cloud-managed: "true" include.release.openshift.io/self-managed-high-availability: "true" - release.openshift.io/feature-set: CustomNoUpgrade,DevPreviewNoUpgrade,TechPreviewNoUpgrade name: criocredentialproviderconfigs.config.openshift.io spec: group: config.openshift.io @@ -209,201 +207,6 @@ spec: be 'cluster' rule: self.metadata.name == 'cluster' served: true - storage: false - subresources: - status: {} - - name: v1alpha1 - schema: - openAPIV3Schema: - description: |- - CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is "cluster". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources. - For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in. - CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation. - Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout. - - The resource is a singleton named "cluster". - - Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - spec defines the desired configuration of the CRI-O Credential Provider. - This field is required and must be provided when creating the resource. - minProperties: 0 - properties: - matchImages: - description: |- - matchImages is a list of string patterns used to determine whether - the CRI-O credential provider should be invoked for a given image. This list is - passed to the kubelet CredentialProviderConfig, and if any pattern matches - the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling - that image or its mirrors. - Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider. - Conflicts between the existing platform specific provider image match configuration and this list will be handled by - the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those - from the CRIOCredentialProviderConfig when both match the same image. - To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with - existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml). - You can check the resource's Status conditions - to see if any entries were ignored due to exact matches with known built-in provider patterns. - - This field is optional, the items of the list must contain between 1 and 50 entries. - The list is treated as a set, so duplicate entries are not allowed. - - For more details, see: - https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/ - https://github.com/cri-o/crio-credential-provider#architecture - - Each entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters. - Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io', - and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net'). - A global wildcard '*' (matching any domain) is not allowed. - Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path. - For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not. - Each wildcard matches only a single domain label, - so '*.io' does **not** match '*.k8s.io'. - - A match exists between an image and a matchImage when all of the below are true: - Both contain the same number of domain parts and each part matches. - The URL path of an matchImages must be a prefix of the target image URL path. - If the matchImages contains a port, then the port must match in the image as well. - - Example values of matchImages: - - 123456789.dkr.ecr.us-east-1.amazonaws.com - - *.azurecr.io - - gcr.io - - *.*.registry.io - - registry.io:8080/path - items: - description: |- - MatchImage is a string pattern used to match container image registry addresses. - It must be a valid fully qualified domain name with optional wildcard, port, and path. - The maximum length is 512 characters. - - Wildcards ('*') are supported for full subdomain labels and top-level domains. - Each entry can optionally contain a port (e.g., :8080) and a path (e.g., /path). - Wildcards are not allowed in the port or path portions. - - Examples: - - "registry.io" - matches exactly registry.io - - "*.azurecr.io" - matches any single subdomain of azurecr.io - - "registry.io:8080/path" - matches with specific port and path prefix - maxLength: 512 - minLength: 1 - type: string - x-kubernetes-validations: - - message: global wildcard '*' is not allowed - rule: self != '*' - - message: invalid matchImages value, must be a valid fully qualified - domain name in lowercase with optional wildcard, port, and path - rule: self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$') - maxItems: 50 - minItems: 1 - type: array - x-kubernetes-list-type: set - type: object - status: - description: |- - status represents the current state of the CRIOCredentialProviderConfig. - When omitted or nil, it indicates that the status has not yet been set by the controller. - The controller will populate this field with validation conditions and operational state. - minProperties: 1 - properties: - conditions: - description: |- - conditions represent the latest available observations of the configuration state. - When omitted, it indicates that no conditions have been reported yet. - The maximum number of conditions is 16. - Conditions are stored as a map keyed by condition type, ensuring uniqueness. - - Expected condition types include: - "Validated": indicates whether the matchImages configuration is valid - items: - description: Condition contains details for one aspect of the current - state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 16 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - required: - - spec - type: object - x-kubernetes-validations: - - message: criocredentialproviderconfig is a singleton, .metadata.name must - be 'cluster' - rule: self.metadata.name == 'cluster' - served: true storage: true subresources: status: {} diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml index 0305366dfd..1a6c305769 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml @@ -621,6 +621,7 @@ spec: description: |- failureDomains contains the definition of region, zone and the vCenter topology. If this is omitted failure domains (regions and zones) will not be used. + Each failure domain's server must match the server field of an entry in the vcenters list. items: description: VSpherePlatformFailureDomainSpec holds the region and zone failure domain and the vCenter topology @@ -665,8 +666,11 @@ spec: - format: ipv4 - format: ipv6 - format: hostname - description: server is the fully-qualified domain name - or the IP address of the vCenter server. + description: |- + server is the fully-qualified domain name or the IP address of the vCenter server. + This must match the server field of an entry in the vcenters list. + The match is case-sensitive; the value must be specified exactly as it appears in the vcenters entry. + The value must be between 1 and 255 characters long. maxLength: 255 minLength: 1 type: string @@ -1287,6 +1291,30 @@ spec: ClusterHosted rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted'' ? !has(self.clusterHosted) : true' + ipFamily: + default: IPv4 + description: |- + ipFamily specifies the IP protocol family that should be used for AWS + network resources. This controls whether AWS resources are created with + IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary + protocol family. + + Valid values are: + * "IPv4" (default): Cloud platform resources use IPv4 addressing only. + * "DualStackIPv6Primary": Cloud platform resources use dual-stack networking with IPv6 as the primary protocol family. + * "DualStackIPv4Primary": Cloud platform resources use dual-stack networking with IPv4 as the primary protocol family. + + When omitted, this field defaults to "IPv4". + + This field is immutable and cannot be changed once set. + enum: + - IPv4 + - DualStackIPv6Primary + - DualStackIPv4Primary + type: string + x-kubernetes-validations: + - message: ipFamily is immutable once set + rule: oldSelf == '' || self == oldSelf region: description: region holds the default AWS region for new AWS resources created by the cluster. diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-CustomNoUpgrade.crd.yaml index 2829b41dce..5c5eec68ae 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-CustomNoUpgrade.crd.yaml @@ -701,6 +701,7 @@ spec: description: |- failureDomains contains the definition of region, zone and the vCenter topology. If this is omitted failure domains (regions and zones) will not be used. + Each failure domain's server must match the server field of an entry in the vcenters list. items: description: VSpherePlatformFailureDomainSpec holds the region and zone failure domain and the vCenter topology @@ -745,8 +746,11 @@ spec: - format: ipv4 - format: ipv6 - format: hostname - description: server is the fully-qualified domain name - or the IP address of the vCenter server. + description: |- + server is the fully-qualified domain name or the IP address of the vCenter server. + This must match the server field of an entry in the vcenters list. + The match is case-sensitive; the value must be specified exactly as it appears in the vcenters entry. + The value must be between 1 and 255 characters long. maxLength: 255 minLength: 1 type: string @@ -1108,6 +1112,11 @@ spec: rule: self.all(x, self.exists_one(y, y.server == x.server)) type: object x-kubernetes-validations: + - message: all failure domains must have a corresponding vCenter + entry + rule: '!has(self.failureDomains) || size(self.failureDomains) + == 0 || (has(self.vcenters) && self.failureDomains.all(fd, + self.vcenters.exists(vc, vc.server == fd.server)))' - message: apiServerInternalIPs list is required once set rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)' - message: ingressIPs list is required once set @@ -1380,6 +1389,15 @@ spec: network resources. This controls whether AWS resources are created with IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary protocol family. + + Valid values are: + * "IPv4" (default): Cloud platform resources use IPv4 addressing only. + * "DualStackIPv6Primary": Cloud platform resources use dual-stack networking with IPv6 as the primary protocol family. + * "DualStackIPv4Primary": Cloud platform resources use dual-stack networking with IPv4 as the primary protocol family. + + When omitted, this field defaults to "IPv4". + + This field is immutable and cannot be changed once set. enum: - IPv4 - DualStackIPv6Primary @@ -1785,6 +1803,25 @@ spec: datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames to the nodes in the cluster. type: string + vipManagement: + description: |- + vipManagement indicates which VIP management mechanism is active + on this cluster. + Allowed values are `Keepalived`, `BGP`, and omitted. + Once set to a non-empty value, this field is immutable. + When set to `BGP`, kube-vip (Routing Table Mode) and frr-k8s are + deployed as static pods to advertise VIPs via BGP, replacing the + default keepalived/VRRP mechanism. + When set to `Keepalived`, the default keepalived-based VIP + management is used. + When omitted, the default keepalived-based VIP management is used. + enum: + - Keepalived + - BGP + type: string + x-kubernetes-validations: + - message: vipManagement is immutable once set + rule: oldSelf == '' || self == oldSelf type: object x-kubernetes-validations: - message: dnsRecordsType may only be set to External when loadBalancer.type @@ -2062,6 +2099,28 @@ spec: - message: resourceTags are immutable and may only be configured during installation rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self) + universeDomain: + description: |- + universeDomain is the GCP universe domain for the cluster, detected from + the installer credentials. Components with their own GCP credentials should + read the universe domain from those credentials, as they are the authoritative + source. This field is provided for components that do not have GCP credentials + and for general observability. + + When omitted, standard public GCP (googleapis.com) is assumed. + + universeDomain is an optional field that, when specified, must be non-empty and at most + 253 characters. It must be a valid DNS subdomain: containing only lowercase alphanumeric + characters, '-' or '.', and starting and ending with an alphanumeric character. + maxLength: 253 + minLength: 1 + type: string + x-kubernetes-validations: + - message: 'universeDomain must be a valid DNS subdomain: + contain no more than 253 characters, contain only lowercase + alphanumeric characters, ''-'' or ''.'', and start and + end with an alphanumeric character' + rule: '!format.dns1123Subdomain().validate(self).hasValue()' type: object x-kubernetes-validations: - message: resourceLabels may only be configured during installation diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-DevPreviewNoUpgrade.crd.yaml index a3064161f2..3795104070 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-DevPreviewNoUpgrade.crd.yaml @@ -686,6 +686,7 @@ spec: description: |- failureDomains contains the definition of region, zone and the vCenter topology. If this is omitted failure domains (regions and zones) will not be used. + Each failure domain's server must match the server field of an entry in the vcenters list. items: description: VSpherePlatformFailureDomainSpec holds the region and zone failure domain and the vCenter topology @@ -730,8 +731,11 @@ spec: - format: ipv4 - format: ipv6 - format: hostname - description: server is the fully-qualified domain name - or the IP address of the vCenter server. + description: |- + server is the fully-qualified domain name or the IP address of the vCenter server. + This must match the server field of an entry in the vcenters list. + The match is case-sensitive; the value must be specified exactly as it appears in the vcenters entry. + The value must be between 1 and 255 characters long. maxLength: 255 minLength: 1 type: string @@ -1093,6 +1097,11 @@ spec: rule: self.all(x, self.exists_one(y, y.server == x.server)) type: object x-kubernetes-validations: + - message: all failure domains must have a corresponding vCenter + entry + rule: '!has(self.failureDomains) || size(self.failureDomains) + == 0 || (has(self.vcenters) && self.failureDomains.all(fd, + self.vcenters.exists(vc, vc.server == fd.server)))' - message: apiServerInternalIPs list is required once set rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)' - message: ingressIPs list is required once set @@ -1365,6 +1374,15 @@ spec: network resources. This controls whether AWS resources are created with IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary protocol family. + + Valid values are: + * "IPv4" (default): Cloud platform resources use IPv4 addressing only. + * "DualStackIPv6Primary": Cloud platform resources use dual-stack networking with IPv6 as the primary protocol family. + * "DualStackIPv4Primary": Cloud platform resources use dual-stack networking with IPv4 as the primary protocol family. + + When omitted, this field defaults to "IPv4". + + This field is immutable and cannot be changed once set. enum: - IPv4 - DualStackIPv6Primary @@ -1770,6 +1788,25 @@ spec: datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames to the nodes in the cluster. type: string + vipManagement: + description: |- + vipManagement indicates which VIP management mechanism is active + on this cluster. + Allowed values are `Keepalived`, `BGP`, and omitted. + Once set to a non-empty value, this field is immutable. + When set to `BGP`, kube-vip (Routing Table Mode) and frr-k8s are + deployed as static pods to advertise VIPs via BGP, replacing the + default keepalived/VRRP mechanism. + When set to `Keepalived`, the default keepalived-based VIP + management is used. + When omitted, the default keepalived-based VIP management is used. + enum: + - Keepalived + - BGP + type: string + x-kubernetes-validations: + - message: vipManagement is immutable once set + rule: oldSelf == '' || self == oldSelf type: object x-kubernetes-validations: - message: dnsRecordsType may only be set to External when loadBalancer.type @@ -2047,6 +2084,28 @@ spec: - message: resourceTags are immutable and may only be configured during installation rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self) + universeDomain: + description: |- + universeDomain is the GCP universe domain for the cluster, detected from + the installer credentials. Components with their own GCP credentials should + read the universe domain from those credentials, as they are the authoritative + source. This field is provided for components that do not have GCP credentials + and for general observability. + + When omitted, standard public GCP (googleapis.com) is assumed. + + universeDomain is an optional field that, when specified, must be non-empty and at most + 253 characters. It must be a valid DNS subdomain: containing only lowercase alphanumeric + characters, '-' or '.', and starting and ending with an alphanumeric character. + maxLength: 253 + minLength: 1 + type: string + x-kubernetes-validations: + - message: 'universeDomain must be a valid DNS subdomain: + contain no more than 253 characters, contain only lowercase + alphanumeric characters, ''-'' or ''.'', and start and + end with an alphanumeric character' + rule: '!format.dns1123Subdomain().validate(self).hasValue()' type: object x-kubernetes-validations: - message: resourceLabels may only be configured during installation diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-TechPreviewNoUpgrade.crd.yaml deleted file mode 100644 index cafc698a8a..0000000000 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ /dev/null @@ -1,2774 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.openshift.io: https://github.com/openshift/api/pull/470 - api.openshift.io/merged-by-featuregates: "true" - include.release.openshift.io/ibm-cloud-managed: "true" - release.openshift.io/bootstrap-required: "true" - release.openshift.io/feature-set: TechPreviewNoUpgrade - name: infrastructures.config.openshift.io -spec: - group: config.openshift.io - names: - kind: Infrastructure - listKind: InfrastructureList - plural: infrastructures - singular: infrastructure - scope: Cluster - versions: - - name: v1 - schema: - openAPIV3Schema: - description: |- - Infrastructure holds cluster-wide information about Infrastructure. The canonical name is `cluster` - - Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: spec holds user settable values for configuration - properties: - cloudConfig: - description: |- - cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file. - This configuration file is used to configure the Kubernetes cloud provider integration - when using the built-in cloud provider integration or the external cloud controller manager. - The namespace for this config map is openshift-config. - - cloudConfig should only be consumed by the kube_cloud_config controller. - The controller is responsible for using the user configuration in the spec - for various platforms and combining that with the user provided ConfigMap in this field - to create a stitched kube cloud config. - The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace - with the kube cloud config is stored in `cloud.conf` key. - All the clients are expected to use the generated ConfigMap only. - properties: - key: - description: key allows pointing to a specific key/value inside - of the configmap. This is useful for logical file references. - type: string - name: - type: string - type: object - platformSpec: - description: |- - platformSpec holds desired information specific to the underlying - infrastructure provider. - properties: - alibabaCloud: - description: alibabaCloud contains settings specific to the Alibaba - Cloud infrastructure provider. - type: object - aws: - description: aws contains settings specific to the Amazon Web - Services infrastructure provider. - properties: - serviceEndpoints: - description: |- - serviceEndpoints list contains custom endpoints which will override default - service endpoint of AWS Services. - There must be only one ServiceEndpoint for a service. - items: - description: |- - AWSServiceEndpoint store the configuration of a custom url to - override existing defaults of AWS Services. - properties: - name: - description: |- - name is the name of the AWS service. - The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html - This must be provided and cannot be empty. - pattern: ^[a-z0-9-]+$ - type: string - url: - description: |- - url is fully qualified URI with scheme https, that overrides the default generated - endpoint for a client. - This must be provided and cannot be empty. - pattern: ^https:// - type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - azure: - description: azure contains settings specific to the Azure infrastructure - provider. - type: object - baremetal: - description: baremetal contains settings specific to the BareMetal - platform. - properties: - apiServerInternalIPs: - description: |- - apiServerInternalIPs are the IP addresses to contact the Kubernetes API - server that can be used by components inside the cluster, like kubelets - using the infrastructure rather than Kubernetes networking. These are the - IPs for a self-hosted load balancer in front of the API servers. - In dual stack clusters this list contains two IP addresses, one from IPv4 - family and one from IPv6. - In single stack clusters a single IP address is expected. - When omitted, values from the status.apiServerInternalIPs will be used. - Once set, the list cannot be completely removed (but its second entry can). - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: apiServerInternalIPs must contain at most one IPv4 - address and at most one IPv6 address - rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1]) - ? ip(self[0]).family() != ip(self[1]).family() : true' - ingressIPs: - description: |- - ingressIPs are the external IPs which route to the default ingress - controller. The IPs are suitable targets of a wildcard DNS record used to - resolve default route host names. - In dual stack clusters this list contains two IP addresses, one from IPv4 - family and one from IPv6. - In single stack clusters a single IP address is expected. - When omitted, values from the status.ingressIPs will be used. - Once set, the list cannot be completely removed (but its second entry can). - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: ingressIPs must contain at most one IPv4 address - and at most one IPv6 address - rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1]) - ? ip(self[0]).family() != ip(self[1]).family() : true' - machineNetworks: - description: |- - machineNetworks are IP networks used to connect all the OpenShift cluster - nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6, - for example "10.0.0.0/8" or "fd00::/8". - items: - description: CIDR is an IP address range in CIDR notation - (for example, "10.0.0.0/8" or "fd00::/8"). - maxLength: 43 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid CIDR network address - rule: isCIDR(self) - maxItems: 32 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - rule: self.all(x, self.exists_one(y, x == y)) - type: object - x-kubernetes-validations: - - message: apiServerInternalIPs list is required once set - rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)' - - message: ingressIPs list is required once set - rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)' - equinixMetal: - description: equinixMetal contains settings specific to the Equinix - Metal infrastructure provider. - type: object - external: - description: |- - ExternalPlatformType represents generic infrastructure provider. - Platform-specific components should be supplemented separately. - properties: - platformName: - default: Unknown - description: |- - platformName holds the arbitrary string representing the infrastructure provider name, expected to be set at the installation time. - This field is solely for informational and reporting purposes and is not expected to be used for decision-making. - type: string - x-kubernetes-validations: - - message: platform name cannot be changed once set - rule: oldSelf == 'Unknown' || self == oldSelf - type: object - gcp: - description: gcp contains settings specific to the Google Cloud - Platform infrastructure provider. - type: object - ibmcloud: - description: ibmcloud contains settings specific to the IBMCloud - infrastructure provider. - properties: - serviceEndpoints: - description: |- - serviceEndpoints is a list of custom endpoints which will override the default - service endpoints of an IBM service. These endpoints are used by components - within the cluster when trying to reach the IBM Cloud Services that have been - overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each - endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus - are updated to reflect the same custom endpoints. - A maximum of 13 service endpoints overrides are supported. - items: - description: |- - IBMCloudServiceEndpoint stores the configuration of a custom url to - override existing defaults of IBM Cloud Services. - properties: - name: - description: |- - name is the name of the IBM Cloud service. - Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC. - For example, the IBM Cloud Private IAM service could be configured with the - service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com` - Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured - with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com` - enum: - - CIS - - COS - - COSConfig - - DNSServices - - GlobalCatalog - - GlobalSearch - - GlobalTagging - - HyperProtect - - IAM - - KeyProtect - - ResourceController - - ResourceManager - - VPC - type: string - url: - description: |- - url is fully qualified URI with scheme https, that overrides the default generated - endpoint for a client. - This must be provided and cannot be empty. The path must follow the pattern - /v[0,9]+ or /api/v[0,9]+ - maxLength: 300 - type: string - x-kubernetes-validations: - - message: url must use https scheme - rule: url(self).getScheme() == "https" - - message: url path must match /v[0,9]+ or /api/v[0,9]+ - rule: matches((url(self).getEscapedPath()), '^/(api/)?v[0-9]+/{0,1}$') - - message: url must be a valid absolute URL - rule: isURL(self) - required: - - name - - url - type: object - maxItems: 13 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - kubevirt: - description: kubevirt contains settings specific to the kubevirt - infrastructure provider. - type: object - nutanix: - description: nutanix contains settings specific to the Nutanix - infrastructure provider. - properties: - failureDomains: - description: |- - failureDomains configures failure domains information for the Nutanix platform. - When set, the failure domains defined here may be used to spread Machines across - prism element clusters to improve fault tolerance of the cluster. - items: - description: NutanixFailureDomain configures failure domain - information for the Nutanix platform. - properties: - cluster: - description: |- - cluster is to identify the cluster (the Prism Element under management of the Prism Central), - in which the Machine's VM will be created. The cluster identifier (uuid or name) can be obtained - from the Prism Central console or using the prism_central API. - properties: - name: - description: name is the resource name in the PC. - It cannot be empty if the type is Name. - type: string - type: - description: type is the identifier type to use - for this resource. - enum: - - UUID - - Name - type: string - uuid: - description: uuid is the UUID of the resource in - the PC. It cannot be empty if the type is UUID. - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: uuid configuration is required when type - is UUID, and forbidden otherwise - rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid) - : !has(self.uuid)' - - message: name configuration is required when type - is Name, and forbidden otherwise - rule: 'has(self.type) && self.type == ''Name'' ? has(self.name) - : !has(self.name)' - name: - description: |- - name defines the unique name of a failure domain. - Name is required and must be at most 64 characters in length. - It must consist of only lower case alphanumeric characters and hyphens (-). - It must start and end with an alphanumeric character. - This value is arbitrary and is used to identify the failure domain within the platform. - maxLength: 64 - minLength: 1 - pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?' - type: string - subnets: - description: |- - subnets holds a list of identifiers (one or more) of the cluster's network subnets - If the feature gate NutanixMultiSubnets is enabled, up to 32 subnets may be configured. - for the Machine's VM to connect to. The subnet identifiers (uuid or name) can be - obtained from the Prism Central console or using the prism_central API. - items: - description: NutanixResourceIdentifier holds the identity - of a Nutanix PC resource (cluster, image, subnet, - etc.) - properties: - name: - description: name is the resource name in the - PC. It cannot be empty if the type is Name. - type: string - type: - description: type is the identifier type to use - for this resource. - enum: - - UUID - - Name - type: string - uuid: - description: uuid is the UUID of the resource - in the PC. It cannot be empty if the type is - UUID. - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: uuid configuration is required when type - is UUID, and forbidden otherwise - rule: 'has(self.type) && self.type == ''UUID'' ? has(self.uuid) - : !has(self.uuid)' - - message: name configuration is required when type - is Name, and forbidden otherwise - rule: 'has(self.type) && self.type == ''Name'' ? has(self.name) - : !has(self.name)' - maxItems: 32 - minItems: 1 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: each subnet must be unique - rule: self.all(x, self.exists_one(y, x == y)) - required: - - cluster - - name - - subnets - type: object - maxItems: 32 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - prismCentral: - description: |- - prismCentral holds the endpoint address and port to access the Nutanix Prism Central. - When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy. - Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the - proxy spec.noProxy list. - properties: - address: - description: address is the endpoint address (DNS name - or IP address) of the Nutanix Prism Central or Element - (cluster) - maxLength: 256 - type: string - port: - description: port is the port number to access the Nutanix - Prism Central or Element (cluster) - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - address - - port - type: object - prismElements: - description: |- - prismElements holds one or more endpoint address and port data to access the Nutanix - Prism Elements (clusters) of the Nutanix Prism Central. Currently we only support one - Prism Element (cluster) for an OpenShift cluster, where all the Nutanix resources (VMs, subnets, volumes, etc.) - used in the OpenShift cluster are located. In the future, we may support Nutanix resources (VMs, etc.) - spread over multiple Prism Elements (clusters) of the Prism Central. - items: - description: NutanixPrismElementEndpoint holds the name - and endpoint data for a Prism Element (cluster) - properties: - endpoint: - description: |- - endpoint holds the endpoint address and port data of the Prism Element (cluster). - When a cluster-wide proxy is installed, by default, this endpoint will be accessed via the proxy. - Should you wish for communication with this endpoint not to be proxied, please add the endpoint to the - proxy spec.noProxy list. - properties: - address: - description: address is the endpoint address (DNS - name or IP address) of the Nutanix Prism Central - or Element (cluster) - maxLength: 256 - type: string - port: - description: port is the port number to access the - Nutanix Prism Central or Element (cluster) - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - address - - port - type: object - name: - description: |- - name is the name of the Prism Element (cluster). This value will correspond with - the cluster field configured on other resources (eg Machines, PVCs, etc). - maxLength: 256 - type: string - required: - - endpoint - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - required: - - prismCentral - - prismElements - type: object - openstack: - description: openstack contains settings specific to the OpenStack - infrastructure provider. - properties: - apiServerInternalIPs: - description: |- - apiServerInternalIPs are the IP addresses to contact the Kubernetes API - server that can be used by components inside the cluster, like kubelets - using the infrastructure rather than Kubernetes networking. These are the - IPs for a self-hosted load balancer in front of the API servers. - In dual stack clusters this list contains two IP addresses, one from IPv4 - family and one from IPv6. - In single stack clusters a single IP address is expected. - When omitted, values from the status.apiServerInternalIPs will be used. - Once set, the list cannot be completely removed (but its second entry can). - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: apiServerInternalIPs must contain at most one IPv4 - address and at most one IPv6 address - rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1]) - ? ip(self[0]).family() != ip(self[1]).family() : true' - ingressIPs: - description: |- - ingressIPs are the external IPs which route to the default ingress - controller. The IPs are suitable targets of a wildcard DNS record used to - resolve default route host names. - In dual stack clusters this list contains two IP addresses, one from IPv4 - family and one from IPv6. - In single stack clusters a single IP address is expected. - When omitted, values from the status.ingressIPs will be used. - Once set, the list cannot be completely removed (but its second entry can). - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: ingressIPs must contain at most one IPv4 address - and at most one IPv6 address - rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1]) - ? ip(self[0]).family() != ip(self[1]).family() : true' - machineNetworks: - description: |- - machineNetworks are IP networks used to connect all the OpenShift cluster - nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6, - for example "10.0.0.0/8" or "fd00::/8". - items: - description: CIDR is an IP address range in CIDR notation - (for example, "10.0.0.0/8" or "fd00::/8"). - maxLength: 43 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid CIDR network address - rule: isCIDR(self) - maxItems: 32 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - rule: self.all(x, self.exists_one(y, x == y)) - type: object - x-kubernetes-validations: - - message: apiServerInternalIPs list is required once set - rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)' - - message: ingressIPs list is required once set - rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)' - ovirt: - description: ovirt contains settings specific to the oVirt infrastructure - provider. - type: object - powervs: - description: powervs contains settings specific to the IBM Power - Systems Virtual Servers infrastructure provider. - properties: - serviceEndpoints: - description: |- - serviceEndpoints is a list of custom endpoints which will override the default - service endpoints of a Power VS service. - items: - description: |- - PowervsServiceEndpoint stores the configuration of a custom url to - override existing defaults of PowerVS Services. - properties: - name: - description: |- - name is the name of the Power VS service. - Few of the services are - IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api - ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller - Power Cloud - https://cloud.ibm.com/apidocs/power-cloud - enum: - - CIS - - COS - - COSConfig - - DNSServices - - GlobalCatalog - - GlobalSearch - - GlobalTagging - - HyperProtect - - IAM - - KeyProtect - - Power - - ResourceController - - ResourceManager - - VPC - type: string - url: - description: |- - url is fully qualified URI with scheme https, that overrides the default generated - endpoint for a client. - This must be provided and cannot be empty. - format: uri - pattern: ^https:// - type: string - required: - - name - - url - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |- - type is the underlying infrastructure provider for the cluster. This - value controls whether infrastructure automation such as service load - balancers, dynamic volume provisioning, machine creation and deletion, and - other integrations are enabled. If None, no infrastructure automation is - enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt", - "OpenStack", "VSphere", "oVirt", "IBMCloud", "KubeVirt", "EquinixMetal", - "PowerVS", "AlibabaCloud", "Nutanix", "External", and "None". Individual - components may not support all platforms, and must handle unrecognized - platforms as None if they do not support that platform. - enum: - - "" - - AWS - - Azure - - BareMetal - - GCP - - Libvirt - - OpenStack - - None - - VSphere - - oVirt - - IBMCloud - - KubeVirt - - EquinixMetal - - PowerVS - - AlibabaCloud - - Nutanix - - External - type: string - vsphere: - description: vsphere contains settings specific to the VSphere - infrastructure provider. - properties: - apiServerInternalIPs: - description: |- - apiServerInternalIPs are the IP addresses to contact the Kubernetes API - server that can be used by components inside the cluster, like kubelets - using the infrastructure rather than Kubernetes networking. These are the - IPs for a self-hosted load balancer in front of the API servers. - In dual stack clusters this list contains two IP addresses, one from IPv4 - family and one from IPv6. - In single stack clusters a single IP address is expected. - When omitted, values from the status.apiServerInternalIPs will be used. - Once set, the list cannot be completely removed (but its second entry can). - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: apiServerInternalIPs must contain at most one IPv4 - address and at most one IPv6 address - rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1]) - ? ip(self[0]).family() != ip(self[1]).family() : true' - failureDomains: - description: |- - failureDomains contains the definition of region, zone and the vCenter topology. - If this is omitted failure domains (regions and zones) will not be used. - items: - description: VSpherePlatformFailureDomainSpec holds the - region and zone failure domain and the vCenter topology - of that failure domain. - properties: - name: - description: |- - name defines the arbitrary but unique name - of a failure domain. - maxLength: 256 - minLength: 1 - type: string - region: - description: |- - region defines the name of a region tag that will - be attached to a vCenter datacenter. The tag - category in vCenter must be named openshift-region. - maxLength: 80 - minLength: 1 - type: string - regionAffinity: - description: |- - regionAffinity holds the type of region, Datacenter or ComputeCluster. - When set to Datacenter, this means the region is a vCenter Datacenter as defined in topology. - When set to ComputeCluster, this means the region is a vCenter Cluster as defined in topology. - properties: - type: - description: |- - type determines the vSphere object type for a region within this failure domain. - Available types are Datacenter and ComputeCluster. - When set to Datacenter, this means the vCenter Datacenter defined is the region. - When set to ComputeCluster, this means the vCenter cluster defined is the region. - enum: - - ComputeCluster - - Datacenter - type: string - required: - - type - type: object - server: - anyOf: - - format: ipv4 - - format: ipv6 - - format: hostname - description: server is the fully-qualified domain name - or the IP address of the vCenter server. - maxLength: 255 - minLength: 1 - type: string - topology: - description: topology describes a given failure domain - using vSphere constructs - properties: - computeCluster: - description: |- - computeCluster the absolute path of the vCenter cluster - in which virtual machine will be located. - The absolute path is of the form //host/. - The maximum length of the path is 2048 characters. - maxLength: 2048 - pattern: ^/.*?/host/.*? - type: string - datacenter: - description: |- - datacenter is the name of vCenter datacenter in which virtual machines will be located. - The maximum length of the datacenter name is 80 characters. - maxLength: 80 - type: string - datastore: - description: |- - datastore is the absolute path of the datastore in which the - virtual machine is located. - The absolute path is of the form //datastore/ - The maximum length of the path is 2048 characters. - maxLength: 2048 - pattern: ^/.*?/datastore/.*? - type: string - folder: - description: |- - folder is the absolute path of the folder where - virtual machines are located. The absolute path - is of the form //vm/. - The maximum length of the path is 2048 characters. - maxLength: 2048 - pattern: ^/.*?/vm/.*? - type: string - networks: - description: |- - networks is the list of port group network names within this failure domain. - If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined. - 10 is the maximum number of virtual network devices which may be attached to a VM as defined by: - https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0 - The available networks (port groups) can be listed using - `govc ls 'network/*'` - Networks should be in the form of an absolute path: - //network/. - items: - type: string - maxItems: 10 - minItems: 1 - type: array - x-kubernetes-list-type: atomic - resourcePool: - description: |- - resourcePool is the absolute path of the resource pool where virtual machines will be - created. The absolute path is of the form //host//Resources/. - The maximum length of the path is 2048 characters. - maxLength: 2048 - pattern: ^/.*?/host/.*?/Resources.* - type: string - template: - description: |- - template is the full inventory path of the virtual machine or template - that will be cloned when creating new machines in this failure domain. - The maximum length of the path is 2048 characters. - - When omitted, the template will be calculated by the control plane - machineset operator based on the region and zone defined in - VSpherePlatformFailureDomainSpec. - For example, for zone=zonea, region=region1, and infrastructure name=test, - the template path would be calculated as //vm/test-rhcos-region1-zonea. - maxLength: 2048 - minLength: 1 - pattern: ^/.*?/vm/.*? - type: string - required: - - computeCluster - - datacenter - - datastore - - networks - type: object - zone: - description: |- - zone defines the name of a zone tag that will - be attached to a vCenter cluster. The tag - category in vCenter must be named openshift-zone. - maxLength: 80 - minLength: 1 - type: string - zoneAffinity: - description: |- - zoneAffinity holds the type of the zone and the hostGroup which - vmGroup and the hostGroup names in vCenter corresponds to - a vm-host group of type Virtual Machine and Host respectively. Is also - contains the vmHostRule which is an affinity vm-host rule in vCenter. - properties: - hostGroup: - description: |- - hostGroup holds the vmGroup and the hostGroup names in vCenter - corresponds to a vm-host group of type Virtual Machine and Host respectively. Is also - contains the vmHostRule which is an affinity vm-host rule in vCenter. - properties: - hostGroup: - description: |- - hostGroup is the name of the vm-host group of type host within vCenter for this failure domain. - hostGroup is limited to 80 characters. - This field is required when the VSphereFailureDomain ZoneType is HostGroup - maxLength: 80 - minLength: 1 - type: string - vmGroup: - description: |- - vmGroup is the name of the vm-host group of type virtual machine within vCenter for this failure domain. - vmGroup is limited to 80 characters. - This field is required when the VSphereFailureDomain ZoneType is HostGroup - maxLength: 80 - minLength: 1 - type: string - vmHostRule: - description: |- - vmHostRule is the name of the affinity vm-host rule within vCenter for this failure domain. - vmHostRule is limited to 80 characters. - This field is required when the VSphereFailureDomain ZoneType is HostGroup - maxLength: 80 - minLength: 1 - type: string - required: - - hostGroup - - vmGroup - - vmHostRule - type: object - type: - description: |- - type determines the vSphere object type for a zone within this failure domain. - Available types are ComputeCluster and HostGroup. - When set to ComputeCluster, this means the vCenter cluster defined is the zone. - When set to HostGroup, hostGroup must be configured with hostGroup, vmGroup and vmHostRule and - this means the zone is defined by the grouping of those fields. - enum: - - HostGroup - - ComputeCluster - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: hostGroup is required when type is HostGroup, - and forbidden otherwise - rule: 'has(self.type) && self.type == ''HostGroup'' - ? has(self.hostGroup) : !has(self.hostGroup)' - required: - - name - - region - - server - - topology - - zone - type: object - x-kubernetes-validations: - - message: when zoneAffinity type is HostGroup, regionAffinity - type must be ComputeCluster - rule: 'has(self.zoneAffinity) && self.zoneAffinity.type - == ''HostGroup'' ? has(self.regionAffinity) && self.regionAffinity.type - == ''ComputeCluster'' : true' - - message: when zoneAffinity type is ComputeCluster, regionAffinity - type must be Datacenter - rule: 'has(self.zoneAffinity) && self.zoneAffinity.type - == ''ComputeCluster'' ? has(self.regionAffinity) && - self.regionAffinity.type == ''Datacenter'' : true' - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - ingressIPs: - description: |- - ingressIPs are the external IPs which route to the default ingress - controller. The IPs are suitable targets of a wildcard DNS record used to - resolve default route host names. - In dual stack clusters this list contains two IP addresses, one from IPv4 - family and one from IPv6. - In single stack clusters a single IP address is expected. - When omitted, values from the status.ingressIPs will be used. - Once set, the list cannot be completely removed (but its second entry can). - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: ingressIPs must contain at most one IPv4 address - and at most one IPv6 address - rule: 'size(self) == 2 && isIP(self[0]) && isIP(self[1]) - ? ip(self[0]).family() != ip(self[1]).family() : true' - machineNetworks: - description: |- - machineNetworks are IP networks used to connect all the OpenShift cluster - nodes. Each network is provided in the CIDR format and should be IPv4 or IPv6, - for example "10.0.0.0/8" or "fd00::/8". - items: - description: CIDR is an IP address range in CIDR notation - (for example, "10.0.0.0/8" or "fd00::/8"). - maxLength: 43 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid CIDR network address - rule: isCIDR(self) - maxItems: 32 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - rule: self.all(x, self.exists_one(y, x == y)) - nodeNetworking: - description: |- - nodeNetworking contains the definition of internal and external network constraints for - assigning the node's networking. - If this field is omitted, networking defaults to the legacy - address selection behavior which is to only support a single address and - return the first one found. - properties: - external: - description: external represents the network configuration - of the node that is externally routable. - properties: - excludeNetworkSubnetCidr: - description: |- - excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting - the IP address from the VirtualMachine's VM for use in the status.addresses fields. - items: - format: cidr - type: string - type: array - x-kubernetes-list-type: atomic - network: - description: |- - network VirtualMachine's VM Network names that will be used to when searching - for status.addresses fields. Note that if internal.networkSubnetCIDR and - external.networkSubnetCIDR are not set, then the vNIC associated to this network must - only have a single IP address assigned to it. - The available networks (port groups) can be listed using - `govc ls 'network/*'` - type: string - networkSubnetCidr: - description: |- - networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs - that will be used in respective status.addresses fields. - items: - format: cidr - type: string - type: array - x-kubernetes-list-type: set - type: object - internal: - description: internal represents the network configuration - of the node that is routable only within the cluster. - properties: - excludeNetworkSubnetCidr: - description: |- - excludeNetworkSubnetCidr IP addresses in subnet ranges will be excluded when selecting - the IP address from the VirtualMachine's VM for use in the status.addresses fields. - items: - format: cidr - type: string - type: array - x-kubernetes-list-type: atomic - network: - description: |- - network VirtualMachine's VM Network names that will be used to when searching - for status.addresses fields. Note that if internal.networkSubnetCIDR and - external.networkSubnetCIDR are not set, then the vNIC associated to this network must - only have a single IP address assigned to it. - The available networks (port groups) can be listed using - `govc ls 'network/*'` - type: string - networkSubnetCidr: - description: |- - networkSubnetCidr IP address on VirtualMachine's network interfaces included in the fields' CIDRs - that will be used in respective status.addresses fields. - items: - format: cidr - type: string - type: array - x-kubernetes-list-type: set - type: object - type: object - vcenters: - description: |- - vcenters holds the connection details for services to communicate with vCenter. - Up to 3 vCenters are supported. - Once the cluster has been installed, you are unable to change the current number of defined - vCenters except when 1.) the cluster has been upgraded from a version of OpenShift - where the vsphere platform spec was not present or 2.) in TechPreview you are able to add and - remove vCenters but may not remove all vCenters. You may make modifications to the existing - vCenters that are defined in the vcenters list in order to match with any added or modified - failure domains. - items: - description: |- - VSpherePlatformVCenterSpec stores the vCenter connection fields. - This is used by the vSphere CCM. - properties: - datacenters: - description: |- - The vCenter Datacenters in which the RHCOS - vm guests are located. This field will - be used by the Cloud Controller Manager. - Each datacenter listed here should be used within - a topology. - items: - type: string - minItems: 1 - type: array - x-kubernetes-list-type: set - port: - description: |- - port is the TCP port that will be used to communicate to - the vCenter endpoint. - When omitted, this means the user has no opinion and - it is up to the platform to choose a sensible default, - which is subject to change over time. - format: int32 - maximum: 32767 - minimum: 1 - type: integer - server: - anyOf: - - format: ipv4 - - format: ipv6 - - format: hostname - description: server is the fully-qualified domain name - or the IP address of the vCenter server. - maxLength: 255 - type: string - required: - - datacenters - - server - type: object - maxItems: 3 - minItems: 1 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: Cannot add and remove vCenters at the same time - rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x, self.exists(y, - y.server == x.server)) : true' - - message: Cannot add and remove vCenters at the same time - rule: 'size(self) < size(oldSelf) ? self.all(x, oldSelf.exists(y, - y.server == x.server)) : true' - - message: vcenters must have unique server values - rule: self.all(x, self.exists_one(y, y.server == x.server)) - type: object - x-kubernetes-validations: - - message: apiServerInternalIPs list is required once set - rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)' - - message: ingressIPs list is required once set - rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)' - type: object - x-kubernetes-validations: - - message: vcenters is required once set and cannot be removed - rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue() - : true' - type: object - status: - description: status holds observed values from the cluster. They may not - be overridden. - properties: - apiServerInternalURI: - description: |- - apiServerInternalURL is a valid URI with scheme 'https', - address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components - like kubelets, to contact the Kubernetes API server using the - infrastructure provider rather than Kubernetes networking. - type: string - apiServerURL: - description: |- - apiServerURL is a valid URI with scheme 'https', address and - optionally a port (defaulting to 443). apiServerURL can be used by components like the web console - to tell users where to find the Kubernetes API. - type: string - controlPlaneTopology: - default: HighlyAvailable - description: |- - controlPlaneTopology expresses the expectations for operands that normally run on control nodes. - The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster. - The 'SingleReplica' mode will be used in single-node deployments - and the operators should not configure the operand for highly-available operation - The 'External' mode indicates that the control plane is hosted externally to the cluster and that - its components are not visible within the cluster. - The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes - that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum. - enum: - - HighlyAvailable - - HighlyAvailableArbiter - - SingleReplica - - DualReplica - - External - type: string - cpuPartitioning: - default: None - description: |- - cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster. - CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets. - Valid values are "None" and "AllNodes". When omitted, the default value is "None". - The default value of "None" indicates that no nodes will be setup with CPU partitioning. - The "AllNodes" value indicates that all nodes have been setup with CPU partitioning, - and can then be further configured via the PerformanceProfile API. - enum: - - None - - AllNodes - type: string - etcdDiscoveryDomain: - description: |- - etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering - etcd servers and clients. - For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery - deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release. - type: string - infrastructureName: - description: |- - infrastructureName uniquely identifies a cluster with a human friendly name. - Once set it should not be changed. Must be of max length 27 and must have only - alphanumeric or hyphen characters. - type: string - infrastructureTopology: - default: HighlyAvailable - description: |- - infrastructureTopology expresses the expectations for infrastructure services that do not run on control - plane nodes, usually indicated by a node selector for a `role` value - other than `master`. - The default is 'HighlyAvailable', which represents the behavior operators have in a "normal" cluster. - The 'SingleReplica' mode will be used in single-node deployments - and the operators should not configure the operand for highly-available operation - NOTE: External topology mode is not applicable for this field. - enum: - - HighlyAvailable - - SingleReplica - type: string - platform: - description: |- - platform is the underlying infrastructure provider for the cluster. - - Deprecated: Use platformStatus.type instead. - enum: - - "" - - AWS - - Azure - - BareMetal - - GCP - - Libvirt - - OpenStack - - None - - VSphere - - oVirt - - IBMCloud - - KubeVirt - - EquinixMetal - - PowerVS - - AlibabaCloud - - Nutanix - - External - type: string - platformStatus: - description: |- - platformStatus holds status information specific to the underlying - infrastructure provider. - properties: - alibabaCloud: - description: alibabaCloud contains settings specific to the Alibaba - Cloud infrastructure provider. - properties: - region: - description: region specifies the region for Alibaba Cloud - resources created for the cluster. - pattern: ^[0-9A-Za-z-]+$ - type: string - resourceGroupID: - description: resourceGroupID is the ID of the resource group - for the cluster. - pattern: ^(rg-[0-9A-Za-z]+)?$ - type: string - resourceTags: - description: resourceTags is a list of additional tags to - apply to Alibaba Cloud resources created for the cluster. - items: - description: AlibabaCloudResourceTag is the set of tags - to add to apply to resources. - properties: - key: - description: key is the key of the tag. - maxLength: 128 - minLength: 1 - type: string - value: - description: value is the value of the tag. - maxLength: 128 - minLength: 1 - type: string - required: - - key - - value - type: object - maxItems: 20 - type: array - x-kubernetes-list-map-keys: - - key - x-kubernetes-list-type: map - required: - - region - type: object - aws: - description: aws contains settings specific to the Amazon Web - Services infrastructure provider. - properties: - cloudLoadBalancerConfig: - default: - dnsType: PlatformDefault - description: |- - cloudLoadBalancerConfig holds configuration related to DNS and cloud - load balancers. It allows configuration of in-cluster DNS as an alternative - to the platform default DNS implementation. - When using the ClusterHosted DNS type, Load Balancer IP addresses - must be provided for the API and internal API load balancers as well as the - ingress load balancer. - nullable: true - properties: - clusterHosted: - description: |- - clusterHosted holds the IP addresses of API, API-Int and Ingress Load - Balancers on Cloud Platforms. The DNS solution hosted within the cluster - use these IP addresses to provide resolution for API, API-Int and Ingress - services. - properties: - apiIntLoadBalancerIPs: - description: |- - apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service. - These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. - Entries in the apiIntLoadBalancerIPs must be unique. - A maximum of 16 IP addresses are permitted. - format: ip - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 16 - type: array - x-kubernetes-list-type: set - apiLoadBalancerIPs: - description: |- - apiLoadBalancerIPs holds Load Balancer IPs for the API service. - These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. - Could be empty for private clusters. - Entries in the apiLoadBalancerIPs must be unique. - A maximum of 16 IP addresses are permitted. - format: ip - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 16 - type: array - x-kubernetes-list-type: set - ingressLoadBalancerIPs: - description: |- - ingressLoadBalancerIPs holds IPs for Ingress Load Balancers. - These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. - Entries in the ingressLoadBalancerIPs must be unique. - A maximum of 16 IP addresses are permitted. - format: ip - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 16 - type: array - x-kubernetes-list-type: set - type: object - dnsType: - default: PlatformDefault - description: |- - dnsType indicates the type of DNS solution in use within the cluster. Its default value of - `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform. - It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode, - the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed. - The cluster's use of the cloud's Load Balancers is unaffected by this setting. - The value is immutable after it has been set at install time. - Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS. - Enabling this functionality allows the user to start their own DNS solution outside the cluster after - installation is complete. The customer would be responsible for configuring this custom DNS solution, - and it can be run in addition to the in-cluster DNS solution. - enum: - - ClusterHosted - - PlatformDefault - type: string - x-kubernetes-validations: - - message: dnsType is immutable - rule: oldSelf == '' || self == oldSelf - type: object - x-kubernetes-validations: - - message: clusterHosted is permitted only when dnsType is - ClusterHosted - rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted'' - ? !has(self.clusterHosted) : true' - ipFamily: - default: IPv4 - description: |- - ipFamily specifies the IP protocol family that should be used for AWS - network resources. This controls whether AWS resources are created with - IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary - protocol family. - enum: - - IPv4 - - DualStackIPv6Primary - - DualStackIPv4Primary - type: string - x-kubernetes-validations: - - message: ipFamily is immutable once set - rule: oldSelf == '' || self == oldSelf - region: - description: region holds the default AWS region for new AWS - resources created by the cluster. - type: string - resourceTags: - description: |- - resourceTags is a list of additional tags to apply to AWS resources created for the cluster. - See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources. - AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags - available for the user. - items: - description: AWSResourceTag is a tag to apply to AWS resources - created for the cluster. - properties: - key: - description: |- - key sets the key of the AWS resource tag key-value pair. Key is required when defining an AWS resource tag. - Key should consist of between 1 and 128 characters, and may - contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'. - maxLength: 128 - minLength: 1 - type: string - x-kubernetes-validations: - - message: invalid AWS resource tag key. The string - can contain only the set of alphanumeric characters, - space (' '), '_', '.', '/', '=', '+', '-', ':', - '@' - rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$') - value: - description: |- - value sets the value of the AWS resource tag key-value pair. Value is required when defining an AWS resource tag. - Value should consist of between 1 and 256 characters, and may - contain only the set of alphanumeric characters, space (' '), '_', '.', '/', '=', '+', '-', ':', and '@'. - Some AWS service do not support empty values. Since tags are added to resources in many services, the - length of the tag value must meet the requirements of all services. - maxLength: 256 - minLength: 1 - type: string - x-kubernetes-validations: - - message: invalid AWS resource tag value. The string - can contain only the set of alphanumeric characters, - space (' '), '_', '.', '/', '=', '+', '-', ':', - '@' - rule: self.matches('^[0-9A-Za-z_.:/=+-@ ]+$') - required: - - key - - value - type: object - maxItems: 25 - type: array - x-kubernetes-list-type: atomic - serviceEndpoints: - description: |- - serviceEndpoints list contains custom endpoints which will override default - service endpoint of AWS Services. - There must be only one ServiceEndpoint for a service. - items: - description: |- - AWSServiceEndpoint store the configuration of a custom url to - override existing defaults of AWS Services. - properties: - name: - description: |- - name is the name of the AWS service. - The list of all the service names can be found at https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html - This must be provided and cannot be empty. - pattern: ^[a-z0-9-]+$ - type: string - url: - description: |- - url is fully qualified URI with scheme https, that overrides the default generated - endpoint for a client. - This must be provided and cannot be empty. - pattern: ^https:// - type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - azure: - description: azure contains settings specific to the Azure infrastructure - provider. - properties: - armEndpoint: - description: armEndpoint specifies a URL to use for resource - management in non-soverign clouds such as Azure Stack. - type: string - cloudLoadBalancerConfig: - default: - dnsType: PlatformDefault - description: |- - cloudLoadBalancerConfig holds configuration related to DNS and cloud - load balancers. It allows configuration of in-cluster DNS as an alternative - to the platform default DNS implementation. - When using the ClusterHosted DNS type, Load Balancer IP addresses - must be provided for the API and internal API load balancers as well as the - ingress load balancer. - properties: - clusterHosted: - description: |- - clusterHosted holds the IP addresses of API, API-Int and Ingress Load - Balancers on Cloud Platforms. The DNS solution hosted within the cluster - use these IP addresses to provide resolution for API, API-Int and Ingress - services. - properties: - apiIntLoadBalancerIPs: - description: |- - apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service. - These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. - Entries in the apiIntLoadBalancerIPs must be unique. - A maximum of 16 IP addresses are permitted. - format: ip - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 16 - type: array - x-kubernetes-list-type: set - apiLoadBalancerIPs: - description: |- - apiLoadBalancerIPs holds Load Balancer IPs for the API service. - These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. - Could be empty for private clusters. - Entries in the apiLoadBalancerIPs must be unique. - A maximum of 16 IP addresses are permitted. - format: ip - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 16 - type: array - x-kubernetes-list-type: set - ingressLoadBalancerIPs: - description: |- - ingressLoadBalancerIPs holds IPs for Ingress Load Balancers. - These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. - Entries in the ingressLoadBalancerIPs must be unique. - A maximum of 16 IP addresses are permitted. - format: ip - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 16 - type: array - x-kubernetes-list-type: set - type: object - dnsType: - default: PlatformDefault - description: |- - dnsType indicates the type of DNS solution in use within the cluster. Its default value of - `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform. - It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode, - the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed. - The cluster's use of the cloud's Load Balancers is unaffected by this setting. - The value is immutable after it has been set at install time. - Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS. - Enabling this functionality allows the user to start their own DNS solution outside the cluster after - installation is complete. The customer would be responsible for configuring this custom DNS solution, - and it can be run in addition to the in-cluster DNS solution. - enum: - - ClusterHosted - - PlatformDefault - type: string - x-kubernetes-validations: - - message: dnsType is immutable - rule: oldSelf == '' || self == oldSelf - type: object - x-kubernetes-validations: - - message: clusterHosted is permitted only when dnsType is - ClusterHosted - rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted'' - ? !has(self.clusterHosted) : true' - cloudName: - description: |- - cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK - with the appropriate Azure API endpoints. - If empty, the value is equal to `AzurePublicCloud`. - enum: - - "" - - AzurePublicCloud - - AzureUSGovernmentCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureStackCloud - type: string - ipFamily: - default: IPv4 - description: |- - ipFamily specifies the IP protocol family that should be used for Azure - network resources. This controls whether Azure resources are created with - IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary - protocol family. - enum: - - IPv4 - - DualStackIPv6Primary - - DualStackIPv4Primary - type: string - x-kubernetes-validations: - - message: ipFamily is immutable once set - rule: oldSelf == '' || self == oldSelf - networkResourceGroupName: - description: |- - networkResourceGroupName is the Resource Group for network resources like the Virtual Network and Subnets used by the cluster. - If empty, the value is same as ResourceGroupName. - type: string - resourceGroupName: - description: resourceGroupName is the Resource Group for new - Azure resources created for the cluster. - type: string - resourceTags: - description: |- - resourceTags is a list of additional tags to apply to Azure resources created for the cluster. - See https://docs.microsoft.com/en-us/rest/api/resources/tags for information on tagging Azure resources. - Due to limitations on Automation, Content Delivery Network, DNS Azure resources, a maximum of 15 tags - may be applied. OpenShift reserves 5 tags for internal use, allowing 10 tags for user configuration. - items: - description: AzureResourceTag is a tag to apply to Azure - resources created for the cluster. - properties: - key: - description: |- - key is the key part of the tag. A tag key can have a maximum of 128 characters and cannot be empty. Key - must begin with a letter, end with a letter, number or underscore, and must contain only alphanumeric - characters and the following special characters `_ . -`. - maxLength: 128 - minLength: 1 - pattern: ^[a-zA-Z]([0-9A-Za-z_.-]*[0-9A-Za-z_])?$ - type: string - value: - description: |- - value is the value part of the tag. A tag value can have a maximum of 256 characters and cannot be empty. Value - must contain only alphanumeric characters and the following special characters `_ + , - . / : ; < = > ? @`. - maxLength: 256 - minLength: 1 - pattern: ^[0-9A-Za-z_.=+-@]+$ - type: string - required: - - key - - value - type: object - maxItems: 10 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: resourceTags are immutable and may only be configured - during installation - rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self) - type: object - x-kubernetes-validations: - - message: resourceTags may only be configured during installation - rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags) - || has(oldSelf.resourceTags) && has(self.resourceTags)' - baremetal: - description: baremetal contains settings specific to the BareMetal - platform. - properties: - apiServerInternalIP: - description: |- - apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used - by components inside the cluster, like kubelets using the infrastructure rather - than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI - points to. It is the IP for a self-hosted load balancer in front of the API servers. - - Deprecated: Use APIServerInternalIPs instead. - type: string - apiServerInternalIPs: - description: |- - apiServerInternalIPs are the IP addresses to contact the Kubernetes API - server that can be used by components inside the cluster, like kubelets - using the infrastructure rather than Kubernetes networking. These are the - IPs for a self-hosted load balancer in front of the API servers. In dual - stack clusters this list contains two IPs otherwise only one. - format: ip - items: - type: string - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: apiServerInternalIPs must contain at most one IPv4 - address and at most one IPv6 address - rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0]) - && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family() - : true)' - dnsRecordsType: - description: |- - dnsRecordsType determines whether records for api, api-int, and ingress - are provided by the internal DNS service or externally. - Allowed values are `Internal`, `External`, and omitted. - When set to `Internal`, records are provided by the internal infrastructure and - no additional user configuration is required for the cluster to function. - When set to `External`, records are not provided by the internal infrastructure - and must be configured by the user on a DNS server outside the cluster. - Cluster nodes must use this external server for their upstream DNS requests. - This value may only be set when loadBalancer.type is set to UserManaged. - When omitted, this means the user has no opinion and the platform is left - to choose reasonable defaults. These defaults are subject to change over time. - The current default is `Internal`. - enum: - - Internal - - External - type: string - ingressIP: - description: |- - ingressIP is an external IP which routes to the default ingress controller. - The IP is a suitable target of a wildcard DNS record used to resolve default route host names. - - Deprecated: Use IngressIPs instead. - type: string - ingressIPs: - description: |- - ingressIPs are the external IPs which route to the default ingress - controller. The IPs are suitable targets of a wildcard DNS record used to - resolve default route host names. In dual stack clusters this list - contains two IPs otherwise only one. - format: ip - items: - type: string - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: ingressIPs must contain at most one IPv4 address - and at most one IPv6 address - rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0]) - && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family() - : true)' - loadBalancer: - default: - type: OpenShiftManagedDefault - description: loadBalancer defines how the load balancer used - by the cluster is configured. - properties: - type: - default: OpenShiftManagedDefault - description: |- - type defines the type of load balancer used by the cluster on BareMetal platform - which can be a user-managed or openshift-managed load balancer - that is to be used for the OpenShift API and Ingress endpoints. - When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing - defined in the machine config operator will be deployed. - When set to UserManaged these static pods will not be deployed and it is expected that - the load balancer is configured out of band by the deployer. - When omitted, this means no opinion and the platform is left to choose a reasonable default. - The default value is OpenShiftManagedDefault. - enum: - - OpenShiftManagedDefault - - UserManaged - type: string - x-kubernetes-validations: - - message: type is immutable once set - rule: oldSelf == '' || self == oldSelf - type: object - machineNetworks: - description: machineNetworks are IP networks used to connect - all the OpenShift cluster nodes. - items: - description: CIDR is an IP address range in CIDR notation - (for example, "10.0.0.0/8" or "fd00::/8"). - maxLength: 43 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid CIDR network address - rule: isCIDR(self) - maxItems: 32 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - rule: self.all(x, self.exists_one(y, x == y)) - nodeDNSIP: - description: |- - nodeDNSIP is the IP address for the internal DNS used by the - nodes. Unlike the one managed by the DNS operator, `NodeDNSIP` - provides name resolution for the nodes themselves. There is no DNS-as-a-service for - BareMetal deployments. In order to minimize necessary changes to the - datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames - to the nodes in the cluster. - type: string - type: object - x-kubernetes-validations: - - message: dnsRecordsType may only be set to External when loadBalancer.type - is UserManaged - rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal'' - || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')' - equinixMetal: - description: equinixMetal contains settings specific to the Equinix - Metal infrastructure provider. - properties: - apiServerInternalIP: - description: |- - apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used - by components inside the cluster, like kubelets using the infrastructure rather - than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI - points to. It is the IP for a self-hosted load balancer in front of the API servers. - type: string - ingressIP: - description: |- - ingressIP is an external IP which routes to the default ingress controller. - The IP is a suitable target of a wildcard DNS record used to resolve default route host names. - type: string - type: object - external: - description: external contains settings specific to the generic - External infrastructure provider. - properties: - cloudControllerManager: - description: |- - cloudControllerManager contains settings specific to the external Cloud Controller Manager (a.k.a. CCM or CPI). - When omitted, new nodes will be not tainted - and no extra initialization from the cloud controller manager is expected. - properties: - state: - description: |- - state determines whether or not an external Cloud Controller Manager is expected to - be installed within the cluster. - https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/#running-cloud-controller-manager - - Valid values are "External", "None" and omitted. - When set to "External", new nodes will be tainted as uninitialized when created, - preventing them from running workloads until they are initialized by the cloud controller manager. - When omitted or set to "None", new nodes will be not tainted - and no extra initialization from the cloud controller manager is expected. - enum: - - "" - - External - - None - type: string - x-kubernetes-validations: - - message: state is immutable once set - rule: self == oldSelf - type: object - x-kubernetes-validations: - - message: state may not be added or removed once set - rule: (has(self.state) == has(oldSelf.state)) || (!has(oldSelf.state) - && self.state != "External") - type: object - x-kubernetes-validations: - - message: cloudControllerManager may not be added or removed - once set - rule: has(self.cloudControllerManager) == has(oldSelf.cloudControllerManager) - gcp: - description: gcp contains settings specific to the Google Cloud - Platform infrastructure provider. - properties: - cloudLoadBalancerConfig: - default: - dnsType: PlatformDefault - description: |- - cloudLoadBalancerConfig holds configuration related to DNS and cloud - load balancers. It allows configuration of in-cluster DNS as an alternative - to the platform default DNS implementation. - When using the ClusterHosted DNS type, Load Balancer IP addresses - must be provided for the API and internal API load balancers as well as the - ingress load balancer. - nullable: true - properties: - clusterHosted: - description: |- - clusterHosted holds the IP addresses of API, API-Int and Ingress Load - Balancers on Cloud Platforms. The DNS solution hosted within the cluster - use these IP addresses to provide resolution for API, API-Int and Ingress - services. - properties: - apiIntLoadBalancerIPs: - description: |- - apiIntLoadBalancerIPs holds Load Balancer IPs for the internal API service. - These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. - Entries in the apiIntLoadBalancerIPs must be unique. - A maximum of 16 IP addresses are permitted. - format: ip - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 16 - type: array - x-kubernetes-list-type: set - apiLoadBalancerIPs: - description: |- - apiLoadBalancerIPs holds Load Balancer IPs for the API service. - These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. - Could be empty for private clusters. - Entries in the apiLoadBalancerIPs must be unique. - A maximum of 16 IP addresses are permitted. - format: ip - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 16 - type: array - x-kubernetes-list-type: set - ingressLoadBalancerIPs: - description: |- - ingressLoadBalancerIPs holds IPs for Ingress Load Balancers. - These Load Balancer IP addresses can be IPv4 and/or IPv6 addresses. - Entries in the ingressLoadBalancerIPs must be unique. - A maximum of 16 IP addresses are permitted. - format: ip - items: - description: IP is an IP address (for example, "10.0.0.0" - or "fd00::"). - maxLength: 39 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid IP address - rule: isIP(self) - maxItems: 16 - type: array - x-kubernetes-list-type: set - type: object - dnsType: - default: PlatformDefault - description: |- - dnsType indicates the type of DNS solution in use within the cluster. Its default value of - `PlatformDefault` indicates that the cluster's DNS is the default provided by the cloud platform. - It can be set to `ClusterHosted` to bypass the configuration of the cloud default DNS. In this mode, - the cluster needs to provide a self-hosted DNS solution for the cluster's installation to succeed. - The cluster's use of the cloud's Load Balancers is unaffected by this setting. - The value is immutable after it has been set at install time. - Currently, there is no way for the customer to add additional DNS entries into the cluster hosted DNS. - Enabling this functionality allows the user to start their own DNS solution outside the cluster after - installation is complete. The customer would be responsible for configuring this custom DNS solution, - and it can be run in addition to the in-cluster DNS solution. - enum: - - ClusterHosted - - PlatformDefault - type: string - x-kubernetes-validations: - - message: dnsType is immutable - rule: oldSelf == '' || self == oldSelf - type: object - x-kubernetes-validations: - - message: clusterHosted is permitted only when dnsType is - ClusterHosted - rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted'' - ? !has(self.clusterHosted) : true' - projectID: - description: resourceGroupName is the Project ID for new GCP - resources created for the cluster. - type: string - region: - description: region holds the region for new GCP resources - created for the cluster. - type: string - resourceLabels: - description: |- - resourceLabels is a list of additional labels to apply to GCP resources created for the cluster. - See https://cloud.google.com/compute/docs/labeling-resources for information on labeling GCP resources. - GCP supports a maximum of 64 labels per resource. OpenShift reserves 32 labels for internal use, - allowing 32 labels for user configuration. - items: - description: GCPResourceLabel is a label to apply to GCP - resources created for the cluster. - properties: - key: - description: |- - key is the key part of the label. A label key can have a maximum of 63 characters and cannot be empty. - Label key must begin with a lowercase letter, and must contain only lowercase letters, numeric characters, - and the following special characters `_-`. Label key must not have the reserved prefixes `kubernetes-io` - and `openshift-io`. - maxLength: 63 - minLength: 1 - pattern: ^[a-z][0-9a-z_-]{0,62}$ - type: string - x-kubernetes-validations: - - message: label keys must not start with either `openshift-io` - or `kubernetes-io` - rule: '!self.startsWith(''openshift-io'') && !self.startsWith(''kubernetes-io'')' - value: - description: |- - value is the value part of the label. A label value can have a maximum of 63 characters and cannot be empty. - Value must contain only lowercase letters, numeric characters, and the following special characters `_-`. - maxLength: 63 - minLength: 1 - pattern: ^[0-9a-z_-]{1,63}$ - type: string - required: - - key - - value - type: object - maxItems: 32 - type: array - x-kubernetes-list-map-keys: - - key - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: resourceLabels are immutable and may only be configured - during installation - rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self) - resourceTags: - description: |- - resourceTags is a list of additional tags to apply to GCP resources created for the cluster. - See https://cloud.google.com/resource-manager/docs/tags/tags-overview for information on - tagging GCP resources. GCP supports a maximum of 50 tags per resource. - items: - description: GCPResourceTag is a tag to apply to GCP resources - created for the cluster. - properties: - key: - description: |- - key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot be empty. - Tag key must begin and end with an alphanumeric character, and must contain only uppercase, lowercase - alphanumeric characters, and the following special characters `._-`. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$ - type: string - parentID: - description: |- - parentID is the ID of the hierarchical resource where the tags are defined, - e.g. at the Organization or the Project level. To find the Organization or Project ID refer to the following pages: - https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id, - https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects. - An OrganizationID must consist of decimal numbers, and cannot have leading zeroes. - A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters, numbers, - and hyphens, and must start with a letter, and cannot end with a hyphen. - maxLength: 32 - minLength: 1 - pattern: (^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$) - type: string - value: - description: |- - value is the value part of the tag. A tag value can have a maximum of 63 characters and cannot be empty. - Tag value must begin and end with an alphanumeric character, and must contain only uppercase, lowercase - alphanumeric characters, and the following special characters `_-.@%=+:,*#&(){}[]` and spaces. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$ - type: string - required: - - key - - parentID - - value - type: object - maxItems: 50 - type: array - x-kubernetes-list-map-keys: - - key - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: resourceTags are immutable and may only be configured - during installation - rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self) - type: object - x-kubernetes-validations: - - message: resourceLabels may only be configured during installation - rule: '!has(oldSelf.resourceLabels) && !has(self.resourceLabels) - || has(oldSelf.resourceLabels) && has(self.resourceLabels)' - - message: resourceTags may only be configured during installation - rule: '!has(oldSelf.resourceTags) && !has(self.resourceTags) - || has(oldSelf.resourceTags) && has(self.resourceTags)' - ibmcloud: - description: ibmcloud contains settings specific to the IBMCloud - infrastructure provider. - properties: - cisInstanceCRN: - description: |- - cisInstanceCRN is the CRN of the Cloud Internet Services instance managing - the DNS zone for the cluster's base domain - type: string - dnsInstanceCRN: - description: |- - dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone - for the cluster's base domain - type: string - location: - description: location is where the cluster has been deployed - type: string - providerType: - description: providerType indicates the type of cluster that - was created - type: string - resourceGroupName: - description: resourceGroupName is the Resource Group for new - IBMCloud resources created for the cluster. - type: string - serviceEndpoints: - description: |- - serviceEndpoints is a list of custom endpoints which will override the default - service endpoints of an IBM service. These endpoints are used by components - within the cluster when trying to reach the IBM Cloud Services that have been - overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each - endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus - are updated to reflect the same custom endpoints. - items: - description: |- - IBMCloudServiceEndpoint stores the configuration of a custom url to - override existing defaults of IBM Cloud Services. - properties: - name: - description: |- - name is the name of the IBM Cloud service. - Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC. - For example, the IBM Cloud Private IAM service could be configured with the - service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com` - Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured - with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com` - enum: - - CIS - - COS - - COSConfig - - DNSServices - - GlobalCatalog - - GlobalSearch - - GlobalTagging - - HyperProtect - - IAM - - KeyProtect - - ResourceController - - ResourceManager - - VPC - type: string - url: - description: |- - url is fully qualified URI with scheme https, that overrides the default generated - endpoint for a client. - This must be provided and cannot be empty. The path must follow the pattern - /v[0,9]+ or /api/v[0,9]+ - maxLength: 300 - type: string - x-kubernetes-validations: - - message: url must be a valid absolute URL - rule: isURL(self) - required: - - name - - url - type: object - maxItems: 13 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - kubevirt: - description: kubevirt contains settings specific to the kubevirt - infrastructure provider. - properties: - apiServerInternalIP: - description: |- - apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used - by components inside the cluster, like kubelets using the infrastructure rather - than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI - points to. It is the IP for a self-hosted load balancer in front of the API servers. - type: string - ingressIP: - description: |- - ingressIP is an external IP which routes to the default ingress controller. - The IP is a suitable target of a wildcard DNS record used to resolve default route host names. - type: string - type: object - nutanix: - description: nutanix contains settings specific to the Nutanix - infrastructure provider. - properties: - apiServerInternalIP: - description: |- - apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used - by components inside the cluster, like kubelets using the infrastructure rather - than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI - points to. It is the IP for a self-hosted load balancer in front of the API servers. - - Deprecated: Use APIServerInternalIPs instead. - type: string - apiServerInternalIPs: - description: |- - apiServerInternalIPs are the IP addresses to contact the Kubernetes API - server that can be used by components inside the cluster, like kubelets - using the infrastructure rather than Kubernetes networking. These are the - IPs for a self-hosted load balancer in front of the API servers. In dual - stack clusters this list contains two IPs otherwise only one. - format: ip - items: - type: string - maxItems: 2 - type: array - x-kubernetes-list-type: set - x-kubernetes-validations: - - message: apiServerInternalIPs must contain at most one IPv4 - address and at most one IPv6 address - rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0]) - && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family() - : true)' - dnsRecordsType: - description: |- - dnsRecordsType determines whether records for api, api-int, and ingress - are provided by the internal DNS service or externally. - Allowed values are `Internal`, `External`, and omitted. - When set to `Internal`, records are provided by the internal infrastructure and - no additional user configuration is required for the cluster to function. - When set to `External`, records are not provided by the internal infrastructure - and must be configured by the user on a DNS server outside the cluster. - Cluster nodes must use this external server for their upstream DNS requests. - This value may only be set when loadBalancer.type is set to UserManaged. - When omitted, this means the user has no opinion and the platform is left - to choose reasonable defaults. These defaults are subject to change over time. - The current default is `Internal`. - enum: - - Internal - - External - type: string - ingressIP: - description: |- - ingressIP is an external IP which routes to the default ingress controller. - The IP is a suitable target of a wildcard DNS record used to resolve default route host names. - - Deprecated: Use IngressIPs instead. - type: string - ingressIPs: - description: |- - ingressIPs are the external IPs which route to the default ingress - controller. The IPs are suitable targets of a wildcard DNS record used to - resolve default route host names. In dual stack clusters this list - contains two IPs otherwise only one. - format: ip - items: - type: string - maxItems: 2 - type: array - x-kubernetes-list-type: set - x-kubernetes-validations: - - message: ingressIPs must contain at most one IPv4 address - and at most one IPv6 address - rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0]) - && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family() - : true)' - loadBalancer: - default: - type: OpenShiftManagedDefault - description: loadBalancer defines how the load balancer used - by the cluster is configured. - properties: - type: - default: OpenShiftManagedDefault - description: |- - type defines the type of load balancer used by the cluster on Nutanix platform - which can be a user-managed or openshift-managed load balancer - that is to be used for the OpenShift API and Ingress endpoints. - When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing - defined in the machine config operator will be deployed. - When set to UserManaged these static pods will not be deployed and it is expected that - the load balancer is configured out of band by the deployer. - When omitted, this means no opinion and the platform is left to choose a reasonable default. - The default value is OpenShiftManagedDefault. - enum: - - OpenShiftManagedDefault - - UserManaged - type: string - x-kubernetes-validations: - - message: type is immutable once set - rule: oldSelf == '' || self == oldSelf - type: object - type: object - x-kubernetes-validations: - - message: dnsRecordsType may only be set to External when loadBalancer.type - is UserManaged - rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal'' - || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')' - openstack: - description: openstack contains settings specific to the OpenStack - infrastructure provider. - properties: - apiServerInternalIP: - description: |- - apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used - by components inside the cluster, like kubelets using the infrastructure rather - than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI - points to. It is the IP for a self-hosted load balancer in front of the API servers. - - Deprecated: Use APIServerInternalIPs instead. - type: string - apiServerInternalIPs: - description: |- - apiServerInternalIPs are the IP addresses to contact the Kubernetes API - server that can be used by components inside the cluster, like kubelets - using the infrastructure rather than Kubernetes networking. These are the - IPs for a self-hosted load balancer in front of the API servers. In dual - stack clusters this list contains two IPs otherwise only one. - format: ip - items: - type: string - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: apiServerInternalIPs must contain at most one IPv4 - address and at most one IPv6 address - rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0]) - && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family() - : true)' - cloudName: - description: |- - cloudName is the name of the desired OpenStack cloud in the - client configuration file (`clouds.yaml`). - type: string - dnsRecordsType: - description: |- - dnsRecordsType determines whether records for api, api-int, and ingress - are provided by the internal DNS service or externally. - Allowed values are `Internal`, `External`, and omitted. - When set to `Internal`, records are provided by the internal infrastructure and - no additional user configuration is required for the cluster to function. - When set to `External`, records are not provided by the internal infrastructure - and must be configured by the user on a DNS server outside the cluster. - Cluster nodes must use this external server for their upstream DNS requests. - This value may only be set when loadBalancer.type is set to UserManaged. - When omitted, this means the user has no opinion and the platform is left - to choose reasonable defaults. These defaults are subject to change over time. - The current default is `Internal`. - enum: - - Internal - - External - type: string - ingressIP: - description: |- - ingressIP is an external IP which routes to the default ingress controller. - The IP is a suitable target of a wildcard DNS record used to resolve default route host names. - - Deprecated: Use IngressIPs instead. - type: string - ingressIPs: - description: |- - ingressIPs are the external IPs which route to the default ingress - controller. The IPs are suitable targets of a wildcard DNS record used to - resolve default route host names. In dual stack clusters this list - contains two IPs otherwise only one. - format: ip - items: - type: string - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: ingressIPs must contain at most one IPv4 address - and at most one IPv6 address - rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0]) - && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family() - : true)' - loadBalancer: - default: - type: OpenShiftManagedDefault - description: loadBalancer defines how the load balancer used - by the cluster is configured. - properties: - type: - default: OpenShiftManagedDefault - description: |- - type defines the type of load balancer used by the cluster on OpenStack platform - which can be a user-managed or openshift-managed load balancer - that is to be used for the OpenShift API and Ingress endpoints. - When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing - defined in the machine config operator will be deployed. - When set to UserManaged these static pods will not be deployed and it is expected that - the load balancer is configured out of band by the deployer. - When omitted, this means no opinion and the platform is left to choose a reasonable default. - The default value is OpenShiftManagedDefault. - enum: - - OpenShiftManagedDefault - - UserManaged - type: string - x-kubernetes-validations: - - message: type is immutable once set - rule: oldSelf == '' || self == oldSelf - type: object - machineNetworks: - description: machineNetworks are IP networks used to connect - all the OpenShift cluster nodes. - items: - description: CIDR is an IP address range in CIDR notation - (for example, "10.0.0.0/8" or "fd00::/8"). - maxLength: 43 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid CIDR network address - rule: isCIDR(self) - maxItems: 32 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - rule: self.all(x, self.exists_one(y, x == y)) - nodeDNSIP: - description: |- - nodeDNSIP is the IP address for the internal DNS used by the - nodes. Unlike the one managed by the DNS operator, `NodeDNSIP` - provides name resolution for the nodes themselves. There is no DNS-as-a-service for - OpenStack deployments. In order to minimize necessary changes to the - datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames - to the nodes in the cluster. - type: string - type: object - x-kubernetes-validations: - - message: dnsRecordsType may only be set to External when loadBalancer.type - is UserManaged - rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal'' - || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')' - ovirt: - description: ovirt contains settings specific to the oVirt infrastructure - provider. - properties: - apiServerInternalIP: - description: |- - apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used - by components inside the cluster, like kubelets using the infrastructure rather - than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI - points to. It is the IP for a self-hosted load balancer in front of the API servers. - - Deprecated: Use APIServerInternalIPs instead. - type: string - apiServerInternalIPs: - description: |- - apiServerInternalIPs are the IP addresses to contact the Kubernetes API - server that can be used by components inside the cluster, like kubelets - using the infrastructure rather than Kubernetes networking. These are the - IPs for a self-hosted load balancer in front of the API servers. In dual - stack clusters this list contains two IPs otherwise only one. - format: ip - items: - type: string - maxItems: 2 - type: array - x-kubernetes-list-type: set - x-kubernetes-validations: - - message: apiServerInternalIPs must contain at most one IPv4 - address and at most one IPv6 address - rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0]) - && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family() - : true)' - dnsRecordsType: - description: |- - dnsRecordsType determines whether records for api, api-int, and ingress - are provided by the internal DNS service or externally. - Allowed values are `Internal`, `External`, and omitted. - When set to `Internal`, records are provided by the internal infrastructure and - no additional user configuration is required for the cluster to function. - When set to `External`, records are not provided by the internal infrastructure - and must be configured by the user on a DNS server outside the cluster. - Cluster nodes must use this external server for their upstream DNS requests. - This value may only be set when loadBalancer.type is set to UserManaged. - When omitted, this means the user has no opinion and the platform is left - to choose reasonable defaults. These defaults are subject to change over time. - The current default is `Internal`. - enum: - - Internal - - External - type: string - ingressIP: - description: |- - ingressIP is an external IP which routes to the default ingress controller. - The IP is a suitable target of a wildcard DNS record used to resolve default route host names. - - Deprecated: Use IngressIPs instead. - type: string - ingressIPs: - description: |- - ingressIPs are the external IPs which route to the default ingress - controller. The IPs are suitable targets of a wildcard DNS record used to - resolve default route host names. In dual stack clusters this list - contains two IPs otherwise only one. - format: ip - items: - type: string - maxItems: 2 - type: array - x-kubernetes-list-type: set - x-kubernetes-validations: - - message: ingressIPs must contain at most one IPv4 address - and at most one IPv6 address - rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0]) - && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family() - : true)' - loadBalancer: - default: - type: OpenShiftManagedDefault - description: loadBalancer defines how the load balancer used - by the cluster is configured. - properties: - type: - default: OpenShiftManagedDefault - description: |- - type defines the type of load balancer used by the cluster on Ovirt platform - which can be a user-managed or openshift-managed load balancer - that is to be used for the OpenShift API and Ingress endpoints. - When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing - defined in the machine config operator will be deployed. - When set to UserManaged these static pods will not be deployed and it is expected that - the load balancer is configured out of band by the deployer. - When omitted, this means no opinion and the platform is left to choose a reasonable default. - The default value is OpenShiftManagedDefault. - enum: - - OpenShiftManagedDefault - - UserManaged - type: string - x-kubernetes-validations: - - message: type is immutable once set - rule: oldSelf == '' || self == oldSelf - type: object - nodeDNSIP: - description: 'deprecated: as of 4.6, this field is no longer - set or honored. It will be removed in a future release.' - type: string - type: object - x-kubernetes-validations: - - message: dnsRecordsType may only be set to External when loadBalancer.type - is UserManaged - rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal'' - || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')' - powervs: - description: powervs contains settings specific to the Power Systems - Virtual Servers infrastructure provider. - properties: - cisInstanceCRN: - description: |- - cisInstanceCRN is the CRN of the Cloud Internet Services instance managing - the DNS zone for the cluster's base domain - type: string - dnsInstanceCRN: - description: |- - dnsInstanceCRN is the CRN of the DNS Services instance managing the DNS zone - for the cluster's base domain - type: string - region: - description: region holds the default Power VS region for - new Power VS resources created by the cluster. - type: string - resourceGroup: - description: |- - resourceGroup is the resource group name for new IBMCloud resources created for a cluster. - The resource group specified here will be used by cluster-image-registry-operator to set up a COS Instance in IBMCloud for the cluster registry. - More about resource groups can be found here: https://cloud.ibm.com/docs/account?topic=account-rgs. - When omitted, the image registry operator won't be able to configure storage, - which results in the image registry cluster operator not being in an available state. - maxLength: 40 - pattern: ^[a-zA-Z0-9-_ ]+$ - type: string - x-kubernetes-validations: - - message: resourceGroup is immutable once set - rule: oldSelf == '' || self == oldSelf - serviceEndpoints: - description: |- - serviceEndpoints is a list of custom endpoints which will override the default - service endpoints of a Power VS service. - items: - description: |- - PowervsServiceEndpoint stores the configuration of a custom url to - override existing defaults of PowerVS Services. - properties: - name: - description: |- - name is the name of the Power VS service. - Few of the services are - IAM - https://cloud.ibm.com/apidocs/iam-identity-token-api - ResourceController - https://cloud.ibm.com/apidocs/resource-controller/resource-controller - Power Cloud - https://cloud.ibm.com/apidocs/power-cloud - enum: - - CIS - - COS - - COSConfig - - DNSServices - - GlobalCatalog - - GlobalSearch - - GlobalTagging - - HyperProtect - - IAM - - KeyProtect - - Power - - ResourceController - - ResourceManager - - VPC - type: string - url: - description: |- - url is fully qualified URI with scheme https, that overrides the default generated - endpoint for a client. - This must be provided and cannot be empty. - format: uri - pattern: ^https:// - type: string - required: - - name - - url - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - zone: - description: |- - zone holds the default zone for the new Power VS resources created by the cluster. - Note: Currently only single-zone OCP clusters are supported - type: string - type: object - x-kubernetes-validations: - - message: cannot unset resourceGroup once set - rule: '!has(oldSelf.resourceGroup) || has(self.resourceGroup)' - type: - description: |- - type is the underlying infrastructure provider for the cluster. This - value controls whether infrastructure automation such as service load - balancers, dynamic volume provisioning, machine creation and deletion, and - other integrations are enabled. If None, no infrastructure automation is - enabled. Allowed values are "AWS", "Azure", "BareMetal", "GCP", "Libvirt", - "OpenStack", "VSphere", "oVirt", "EquinixMetal", "PowerVS", "AlibabaCloud", "Nutanix" and "None". - Individual components may not support all platforms, and must handle - unrecognized platforms as None if they do not support that platform. - - This value will be synced with to the `status.platform` and `status.platformStatus.type`. - Currently this value cannot be changed once set. - enum: - - "" - - AWS - - Azure - - BareMetal - - GCP - - Libvirt - - OpenStack - - None - - VSphere - - oVirt - - IBMCloud - - KubeVirt - - EquinixMetal - - PowerVS - - AlibabaCloud - - Nutanix - - External - type: string - vsphere: - description: vsphere contains settings specific to the VSphere - infrastructure provider. - properties: - apiServerInternalIP: - description: |- - apiServerInternalIP is an IP address to contact the Kubernetes API server that can be used - by components inside the cluster, like kubelets using the infrastructure rather - than Kubernetes networking. It is the IP that the Infrastructure.status.apiServerInternalURI - points to. It is the IP for a self-hosted load balancer in front of the API servers. - - Deprecated: Use APIServerInternalIPs instead. - type: string - apiServerInternalIPs: - description: |- - apiServerInternalIPs are the IP addresses to contact the Kubernetes API - server that can be used by components inside the cluster, like kubelets - using the infrastructure rather than Kubernetes networking. These are the - IPs for a self-hosted load balancer in front of the API servers. In dual - stack clusters this list contains two IPs otherwise only one. - format: ip - items: - type: string - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: apiServerInternalIPs must contain at most one IPv4 - address and at most one IPv6 address - rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0]) - && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family() - : true)' - dnsRecordsType: - description: |- - dnsRecordsType determines whether records for api, api-int, and ingress - are provided by the internal DNS service or externally. - Allowed values are `Internal`, `External`, and omitted. - When set to `Internal`, records are provided by the internal infrastructure and - no additional user configuration is required for the cluster to function. - When set to `External`, records are not provided by the internal infrastructure - and must be configured by the user on a DNS server outside the cluster. - Cluster nodes must use this external server for their upstream DNS requests. - This value may only be set when loadBalancer.type is set to UserManaged. - When omitted, this means the user has no opinion and the platform is left - to choose reasonable defaults. These defaults are subject to change over time. - The current default is `Internal`. - enum: - - Internal - - External - type: string - ingressIP: - description: |- - ingressIP is an external IP which routes to the default ingress controller. - The IP is a suitable target of a wildcard DNS record used to resolve default route host names. - - Deprecated: Use IngressIPs instead. - type: string - ingressIPs: - description: |- - ingressIPs are the external IPs which route to the default ingress - controller. The IPs are suitable targets of a wildcard DNS record used to - resolve default route host names. In dual stack clusters this list - contains two IPs otherwise only one. - format: ip - items: - type: string - maxItems: 2 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - message: ingressIPs must contain at most one IPv4 address - and at most one IPv6 address - rule: 'self == oldSelf || (size(self) == 2 && isIP(self[0]) - && isIP(self[1]) ? ip(self[0]).family() != ip(self[1]).family() - : true)' - loadBalancer: - default: - type: OpenShiftManagedDefault - description: loadBalancer defines how the load balancer used - by the cluster is configured. - properties: - type: - default: OpenShiftManagedDefault - description: |- - type defines the type of load balancer used by the cluster on VSphere platform - which can be a user-managed or openshift-managed load balancer - that is to be used for the OpenShift API and Ingress endpoints. - When set to OpenShiftManagedDefault the static pods in charge of API and Ingress traffic load-balancing - defined in the machine config operator will be deployed. - When set to UserManaged these static pods will not be deployed and it is expected that - the load balancer is configured out of band by the deployer. - When omitted, this means no opinion and the platform is left to choose a reasonable default. - The default value is OpenShiftManagedDefault. - enum: - - OpenShiftManagedDefault - - UserManaged - type: string - x-kubernetes-validations: - - message: type is immutable once set - rule: oldSelf == '' || self == oldSelf - type: object - machineNetworks: - description: machineNetworks are IP networks used to connect - all the OpenShift cluster nodes. - items: - description: CIDR is an IP address range in CIDR notation - (for example, "10.0.0.0/8" or "fd00::/8"). - maxLength: 43 - minLength: 1 - type: string - x-kubernetes-validations: - - message: value must be a valid CIDR network address - rule: isCIDR(self) - maxItems: 32 - type: array - x-kubernetes-list-type: atomic - x-kubernetes-validations: - - rule: self.all(x, self.exists_one(y, x == y)) - nodeDNSIP: - description: |- - nodeDNSIP is the IP address for the internal DNS used by the - nodes. Unlike the one managed by the DNS operator, `NodeDNSIP` - provides name resolution for the nodes themselves. There is no DNS-as-a-service for - vSphere deployments. In order to minimize necessary changes to the - datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames - to the nodes in the cluster. - type: string - type: object - x-kubernetes-validations: - - message: dnsRecordsType may only be set to External when loadBalancer.type - is UserManaged - rule: '!has(self.dnsRecordsType) || self.dnsRecordsType == ''Internal'' - || (has(self.loadBalancer) && self.loadBalancer.type == ''UserManaged'')' - type: object - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml index 6cdb3f76af..ac54ddbd88 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml @@ -621,6 +621,7 @@ spec: description: |- failureDomains contains the definition of region, zone and the vCenter topology. If this is omitted failure domains (regions and zones) will not be used. + Each failure domain's server must match the server field of an entry in the vcenters list. items: description: VSpherePlatformFailureDomainSpec holds the region and zone failure domain and the vCenter topology @@ -665,8 +666,11 @@ spec: - format: ipv4 - format: ipv6 - format: hostname - description: server is the fully-qualified domain name - or the IP address of the vCenter server. + description: |- + server is the fully-qualified domain name or the IP address of the vCenter server. + This must match the server field of an entry in the vcenters list. + The match is case-sensitive; the value must be specified exactly as it appears in the vcenters entry. + The value must be between 1 and 255 characters long. maxLength: 255 minLength: 1 type: string @@ -1287,6 +1291,30 @@ spec: ClusterHosted rule: 'has(self.dnsType) && self.dnsType != ''ClusterHosted'' ? !has(self.clusterHosted) : true' + ipFamily: + default: IPv4 + description: |- + ipFamily specifies the IP protocol family that should be used for AWS + network resources. This controls whether AWS resources are created with + IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary + protocol family. + + Valid values are: + * "IPv4" (default): Cloud platform resources use IPv4 addressing only. + * "DualStackIPv6Primary": Cloud platform resources use dual-stack networking with IPv6 as the primary protocol family. + * "DualStackIPv4Primary": Cloud platform resources use dual-stack networking with IPv4 as the primary protocol family. + + When omitted, this field defaults to "IPv4". + + This field is immutable and cannot be changed once set. + enum: + - IPv4 + - DualStackIPv6Primary + - DualStackIPv4Primary + type: string + x-kubernetes-validations: + - message: ipFamily is immutable once set + rule: oldSelf == '' || self == oldSelf region: description: region holds the default AWS region for new AWS resources created by the cluster. diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-CustomNoUpgrade.crd.yaml index 310ba4ad38..d1cdddc8ed 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-CustomNoUpgrade.crd.yaml @@ -701,6 +701,7 @@ spec: description: |- failureDomains contains the definition of region, zone and the vCenter topology. If this is omitted failure domains (regions and zones) will not be used. + Each failure domain's server must match the server field of an entry in the vcenters list. items: description: VSpherePlatformFailureDomainSpec holds the region and zone failure domain and the vCenter topology @@ -745,8 +746,11 @@ spec: - format: ipv4 - format: ipv6 - format: hostname - description: server is the fully-qualified domain name - or the IP address of the vCenter server. + description: |- + server is the fully-qualified domain name or the IP address of the vCenter server. + This must match the server field of an entry in the vcenters list. + The match is case-sensitive; the value must be specified exactly as it appears in the vcenters entry. + The value must be between 1 and 255 characters long. maxLength: 255 minLength: 1 type: string @@ -1108,6 +1112,11 @@ spec: rule: self.all(x, self.exists_one(y, y.server == x.server)) type: object x-kubernetes-validations: + - message: all failure domains must have a corresponding vCenter + entry + rule: '!has(self.failureDomains) || size(self.failureDomains) + == 0 || (has(self.vcenters) && self.failureDomains.all(fd, + self.vcenters.exists(vc, vc.server == fd.server)))' - message: apiServerInternalIPs list is required once set rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)' - message: ingressIPs list is required once set @@ -1380,6 +1389,15 @@ spec: network resources. This controls whether AWS resources are created with IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary protocol family. + + Valid values are: + * "IPv4" (default): Cloud platform resources use IPv4 addressing only. + * "DualStackIPv6Primary": Cloud platform resources use dual-stack networking with IPv6 as the primary protocol family. + * "DualStackIPv4Primary": Cloud platform resources use dual-stack networking with IPv4 as the primary protocol family. + + When omitted, this field defaults to "IPv4". + + This field is immutable and cannot be changed once set. enum: - IPv4 - DualStackIPv6Primary @@ -1785,6 +1803,25 @@ spec: datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames to the nodes in the cluster. type: string + vipManagement: + description: |- + vipManagement indicates which VIP management mechanism is active + on this cluster. + Allowed values are `Keepalived`, `BGP`, and omitted. + Once set to a non-empty value, this field is immutable. + When set to `BGP`, kube-vip (Routing Table Mode) and frr-k8s are + deployed as static pods to advertise VIPs via BGP, replacing the + default keepalived/VRRP mechanism. + When set to `Keepalived`, the default keepalived-based VIP + management is used. + When omitted, the default keepalived-based VIP management is used. + enum: + - Keepalived + - BGP + type: string + x-kubernetes-validations: + - message: vipManagement is immutable once set + rule: oldSelf == '' || self == oldSelf type: object x-kubernetes-validations: - message: dnsRecordsType may only be set to External when loadBalancer.type @@ -2062,6 +2099,28 @@ spec: - message: resourceTags are immutable and may only be configured during installation rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self) + universeDomain: + description: |- + universeDomain is the GCP universe domain for the cluster, detected from + the installer credentials. Components with their own GCP credentials should + read the universe domain from those credentials, as they are the authoritative + source. This field is provided for components that do not have GCP credentials + and for general observability. + + When omitted, standard public GCP (googleapis.com) is assumed. + + universeDomain is an optional field that, when specified, must be non-empty and at most + 253 characters. It must be a valid DNS subdomain: containing only lowercase alphanumeric + characters, '-' or '.', and starting and ending with an alphanumeric character. + maxLength: 253 + minLength: 1 + type: string + x-kubernetes-validations: + - message: 'universeDomain must be a valid DNS subdomain: + contain no more than 253 characters, contain only lowercase + alphanumeric characters, ''-'' or ''.'', and start and + end with an alphanumeric character' + rule: '!format.dns1123Subdomain().validate(self).hasValue()' type: object x-kubernetes-validations: - message: resourceLabels may only be configured during installation diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml index f3b307973b..29c8c48b95 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml @@ -701,6 +701,7 @@ spec: description: |- failureDomains contains the definition of region, zone and the vCenter topology. If this is omitted failure domains (regions and zones) will not be used. + Each failure domain's server must match the server field of an entry in the vcenters list. items: description: VSpherePlatformFailureDomainSpec holds the region and zone failure domain and the vCenter topology @@ -745,8 +746,11 @@ spec: - format: ipv4 - format: ipv6 - format: hostname - description: server is the fully-qualified domain name - or the IP address of the vCenter server. + description: |- + server is the fully-qualified domain name or the IP address of the vCenter server. + This must match the server field of an entry in the vcenters list. + The match is case-sensitive; the value must be specified exactly as it appears in the vcenters entry. + The value must be between 1 and 255 characters long. maxLength: 255 minLength: 1 type: string @@ -1108,6 +1112,11 @@ spec: rule: self.all(x, self.exists_one(y, y.server == x.server)) type: object x-kubernetes-validations: + - message: all failure domains must have a corresponding vCenter + entry + rule: '!has(self.failureDomains) || size(self.failureDomains) + == 0 || (has(self.vcenters) && self.failureDomains.all(fd, + self.vcenters.exists(vc, vc.server == fd.server)))' - message: apiServerInternalIPs list is required once set rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)' - message: ingressIPs list is required once set @@ -1380,6 +1389,15 @@ spec: network resources. This controls whether AWS resources are created with IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary protocol family. + + Valid values are: + * "IPv4" (default): Cloud platform resources use IPv4 addressing only. + * "DualStackIPv6Primary": Cloud platform resources use dual-stack networking with IPv6 as the primary protocol family. + * "DualStackIPv4Primary": Cloud platform resources use dual-stack networking with IPv4 as the primary protocol family. + + When omitted, this field defaults to "IPv4". + + This field is immutable and cannot be changed once set. enum: - IPv4 - DualStackIPv6Primary @@ -1785,6 +1803,25 @@ spec: datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames to the nodes in the cluster. type: string + vipManagement: + description: |- + vipManagement indicates which VIP management mechanism is active + on this cluster. + Allowed values are `Keepalived`, `BGP`, and omitted. + Once set to a non-empty value, this field is immutable. + When set to `BGP`, kube-vip (Routing Table Mode) and frr-k8s are + deployed as static pods to advertise VIPs via BGP, replacing the + default keepalived/VRRP mechanism. + When set to `Keepalived`, the default keepalived-based VIP + management is used. + When omitted, the default keepalived-based VIP management is used. + enum: + - Keepalived + - BGP + type: string + x-kubernetes-validations: + - message: vipManagement is immutable once set + rule: oldSelf == '' || self == oldSelf type: object x-kubernetes-validations: - message: dnsRecordsType may only be set to External when loadBalancer.type @@ -2062,6 +2099,28 @@ spec: - message: resourceTags are immutable and may only be configured during installation rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self) + universeDomain: + description: |- + universeDomain is the GCP universe domain for the cluster, detected from + the installer credentials. Components with their own GCP credentials should + read the universe domain from those credentials, as they are the authoritative + source. This field is provided for components that do not have GCP credentials + and for general observability. + + When omitted, standard public GCP (googleapis.com) is assumed. + + universeDomain is an optional field that, when specified, must be non-empty and at most + 253 characters. It must be a valid DNS subdomain: containing only lowercase alphanumeric + characters, '-' or '.', and starting and ending with an alphanumeric character. + maxLength: 253 + minLength: 1 + type: string + x-kubernetes-validations: + - message: 'universeDomain must be a valid DNS subdomain: + contain no more than 253 characters, contain only lowercase + alphanumeric characters, ''-'' or ''.'', and start and + end with an alphanumeric character' + rule: '!format.dns1123Subdomain().validate(self).hasValue()' type: object x-kubernetes-validations: - message: resourceLabels may only be configured during installation diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml similarity index 98% rename from vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-TechPreviewNoUpgrade.crd.yaml rename to vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml index 998b9be396..09109065e6 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-SelfManagedHA-TechPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml @@ -4,6 +4,7 @@ metadata: annotations: api-approved.openshift.io: https://github.com/openshift/api/pull/470 api.openshift.io/merged-by-featuregates: "true" + include.release.openshift.io/ibm-cloud-managed: "true" include.release.openshift.io/self-managed-high-availability: "true" release.openshift.io/bootstrap-required: "true" release.openshift.io/feature-set: TechPreviewNoUpgrade @@ -686,6 +687,7 @@ spec: description: |- failureDomains contains the definition of region, zone and the vCenter topology. If this is omitted failure domains (regions and zones) will not be used. + Each failure domain's server must match the server field of an entry in the vcenters list. items: description: VSpherePlatformFailureDomainSpec holds the region and zone failure domain and the vCenter topology @@ -730,8 +732,11 @@ spec: - format: ipv4 - format: ipv6 - format: hostname - description: server is the fully-qualified domain name - or the IP address of the vCenter server. + description: |- + server is the fully-qualified domain name or the IP address of the vCenter server. + This must match the server field of an entry in the vcenters list. + The match is case-sensitive; the value must be specified exactly as it appears in the vcenters entry. + The value must be between 1 and 255 characters long. maxLength: 255 minLength: 1 type: string @@ -1093,6 +1098,11 @@ spec: rule: self.all(x, self.exists_one(y, y.server == x.server)) type: object x-kubernetes-validations: + - message: all failure domains must have a corresponding vCenter + entry + rule: '!has(self.failureDomains) || size(self.failureDomains) + == 0 || (has(self.vcenters) && self.failureDomains.all(fd, + self.vcenters.exists(vc, vc.server == fd.server)))' - message: apiServerInternalIPs list is required once set rule: '!has(oldSelf.apiServerInternalIPs) || has(self.apiServerInternalIPs)' - message: ingressIPs list is required once set @@ -1365,6 +1375,15 @@ spec: network resources. This controls whether AWS resources are created with IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary protocol family. + + Valid values are: + * "IPv4" (default): Cloud platform resources use IPv4 addressing only. + * "DualStackIPv6Primary": Cloud platform resources use dual-stack networking with IPv6 as the primary protocol family. + * "DualStackIPv4Primary": Cloud platform resources use dual-stack networking with IPv4 as the primary protocol family. + + When omitted, this field defaults to "IPv4". + + This field is immutable and cannot be changed once set. enum: - IPv4 - DualStackIPv6Primary @@ -2047,6 +2066,28 @@ spec: - message: resourceTags are immutable and may only be configured during installation rule: self.all(x, x in oldSelf) && oldSelf.all(x, x in self) + universeDomain: + description: |- + universeDomain is the GCP universe domain for the cluster, detected from + the installer credentials. Components with their own GCP credentials should + read the universe domain from those credentials, as they are the authoritative + source. This field is provided for components that do not have GCP credentials + and for general observability. + + When omitted, standard public GCP (googleapis.com) is assumed. + + universeDomain is an optional field that, when specified, must be non-empty and at most + 253 characters. It must be a valid DNS subdomain: containing only lowercase alphanumeric + characters, '-' or '.', and starting and ending with an alphanumeric character. + maxLength: 253 + minLength: 1 + type: string + x-kubernetes-validations: + - message: 'universeDomain must be a valid DNS subdomain: + contain no more than 253 characters, contain only lowercase + alphanumeric characters, ''-'' or ''.'', and start and + end with an alphanumeric character' + rule: '!format.dns1123Subdomain().validate(self).hasValue()' type: object x-kubernetes-validations: - message: resourceLabels may only be configured during installation diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml index 92f2913150..c94de0ff2e 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml @@ -85,12 +85,13 @@ spec: alphanumeric characters, '-', '_', or '.', starting and ending with an alphanumeric character. maxLength: 63 + minLength: 0 type: string x-kubernetes-validations: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self == "" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -114,12 +115,16 @@ spec: type: object x-kubernetes-map-type: granular x-kubernetes-validations: + - message: label keys must be between 1 and 63 characters in + length + rule: self.all(key, key.size() <= 63 && key.size() > 0) - message: label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml index 42e4209c6b..860bde0fb2 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml @@ -85,12 +85,13 @@ spec: alphanumeric characters, '-', '_', or '.', starting and ending with an alphanumeric character. maxLength: 63 + minLength: 0 type: string x-kubernetes-validations: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self == "" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -114,12 +115,16 @@ spec: type: object x-kubernetes-map-type: granular x-kubernetes-validations: + - message: label keys must be between 1 and 63 characters in + length + rule: self.all(key, key.size() <= 63 && key.size() > 0) - message: label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml index d7fc151b11..204708d871 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml @@ -85,12 +85,13 @@ spec: alphanumeric characters, '-', '_', or '.', starting and ending with an alphanumeric character. maxLength: 63 + minLength: 0 type: string x-kubernetes-validations: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self == "" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -114,12 +115,16 @@ spec: type: object x-kubernetes-map-type: granular x-kubernetes-validations: + - message: label keys must be between 1 and 63 characters in + length + rule: self.all(key, key.size() <= 63 && key.size() > 0) - message: label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml index 76f78df82d..6e9daaae51 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml @@ -397,8 +397,10 @@ infrastructures.config.openshift.io: - AWSClusterHostedDNSInstall - AWSDualStackInstall - AzureDualStackInstall + - BGPBasedVIPManagement - DualReplica - DyanmicServiceEndpointIBMCloud + - GCPSovereignCloudInstall - MutableTopology - NutanixMultiSubnets - OnPremDNSRecords diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go index 631f11a1b2..0519119af4 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go @@ -1581,7 +1581,7 @@ var map_AWSPlatformStatus = map[string]string{ "serviceEndpoints": "serviceEndpoints list contains custom endpoints which will override default service endpoint of AWS Services. There must be only one ServiceEndpoint for a service.", "resourceTags": "resourceTags is a list of additional tags to apply to AWS resources created for the cluster. See https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html for information on tagging AWS resources. AWS supports a maximum of 50 tags per resource. OpenShift reserves 25 tags for its use, leaving 25 tags available for the user.", "cloudLoadBalancerConfig": "cloudLoadBalancerConfig holds configuration related to DNS and cloud load balancers. It allows configuration of in-cluster DNS as an alternative to the platform default DNS implementation. When using the ClusterHosted DNS type, Load Balancer IP addresses must be provided for the API and internal API load balancers as well as the ingress load balancer.", - "ipFamily": "ipFamily specifies the IP protocol family that should be used for AWS network resources. This controls whether AWS resources are created with IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary protocol family.", + "ipFamily": "ipFamily specifies the IP protocol family that should be used for AWS network resources. This controls whether AWS resources are created with IPv4-only, or dual-stack networking with IPv4 or IPv6 as the primary protocol family.\n\nValid values are: * \"IPv4\" (default): Cloud platform resources use IPv4 addressing only. * \"DualStackIPv6Primary\": Cloud platform resources use dual-stack networking with IPv6 as the primary protocol family. * \"DualStackIPv4Primary\": Cloud platform resources use dual-stack networking with IPv4 as the primary protocol family.\n\nWhen omitted, this field defaults to \"IPv4\".\n\nThis field is immutable and cannot be changed once set.", } func (AWSPlatformStatus) SwaggerDoc() map[string]string { @@ -1698,6 +1698,7 @@ var map_BareMetalPlatformStatus = map[string]string{ "ingressIPs": "ingressIPs are the external IPs which route to the default ingress controller. The IPs are suitable targets of a wildcard DNS record used to resolve default route host names. In dual stack clusters this list contains two IPs otherwise only one.", "nodeDNSIP": "nodeDNSIP is the IP address for the internal DNS used by the nodes. Unlike the one managed by the DNS operator, `NodeDNSIP` provides name resolution for the nodes themselves. There is no DNS-as-a-service for BareMetal deployments. In order to minimize necessary changes to the datacenter DNS, a DNS service is hosted as a static pod to serve those hostnames to the nodes in the cluster.", "loadBalancer": "loadBalancer defines how the load balancer used by the cluster is configured.", + "vipManagement": "vipManagement indicates which VIP management mechanism is active on this cluster. Allowed values are `Keepalived`, `BGP`, and omitted. Once set to a non-empty value, this field is immutable. When set to `BGP`, kube-vip (Routing Table Mode) and frr-k8s are deployed as static pods to advertise VIPs via BGP, replacing the default keepalived/VRRP mechanism. When set to `Keepalived`, the default keepalived-based VIP management is used. When omitted, the default keepalived-based VIP management is used.", "dnsRecordsType": "dnsRecordsType determines whether records for api, api-int, and ingress are provided by the internal DNS service or externally. Allowed values are `Internal`, `External`, and omitted. When set to `Internal`, records are provided by the internal infrastructure and no additional user configuration is required for the cluster to function. When set to `External`, records are not provided by the internal infrastructure and must be configured by the user on a DNS server outside the cluster. Cluster nodes must use this external server for their upstream DNS requests. This value may only be set when loadBalancer.type is set to UserManaged. When omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. The current default is `Internal`.", "machineNetworks": "machineNetworks are IP networks used to connect all the OpenShift cluster nodes.", } @@ -1787,6 +1788,7 @@ var map_GCPPlatformStatus = map[string]string{ "resourceLabels": "resourceLabels is a list of additional labels to apply to GCP resources created for the cluster. See https://cloud.google.com/compute/docs/labeling-resources for information on labeling GCP resources. GCP supports a maximum of 64 labels per resource. OpenShift reserves 32 labels for internal use, allowing 32 labels for user configuration.", "resourceTags": "resourceTags is a list of additional tags to apply to GCP resources created for the cluster. See https://cloud.google.com/resource-manager/docs/tags/tags-overview for information on tagging GCP resources. GCP supports a maximum of 50 tags per resource.", "cloudLoadBalancerConfig": "cloudLoadBalancerConfig holds configuration related to DNS and cloud load balancers. It allows configuration of in-cluster DNS as an alternative to the platform default DNS implementation. When using the ClusterHosted DNS type, Load Balancer IP addresses must be provided for the API and internal API load balancers as well as the ingress load balancer.", + "universeDomain": "universeDomain is the GCP universe domain for the cluster, detected from the installer credentials. Components with their own GCP credentials should read the universe domain from those credentials, as they are the authoritative source. This field is provided for components that do not have GCP credentials and for general observability.\n\nWhen omitted, standard public GCP (googleapis.com) is assumed.\n\nuniverseDomain is an optional field that, when specified, must be non-empty and at most 253 characters. It must be a valid DNS subdomain: containing only lowercase alphanumeric characters, '-' or '.', and starting and ending with an alphanumeric character.", } func (GCPPlatformStatus) SwaggerDoc() map[string]string { @@ -2174,7 +2176,7 @@ var map_VSpherePlatformFailureDomainSpec = map[string]string{ "zone": "zone defines the name of a zone tag that will be attached to a vCenter cluster. The tag category in vCenter must be named openshift-zone.", "regionAffinity": "regionAffinity holds the type of region, Datacenter or ComputeCluster. When set to Datacenter, this means the region is a vCenter Datacenter as defined in topology. When set to ComputeCluster, this means the region is a vCenter Cluster as defined in topology.", "zoneAffinity": "zoneAffinity holds the type of the zone and the hostGroup which vmGroup and the hostGroup names in vCenter corresponds to a vm-host group of type Virtual Machine and Host respectively. Is also contains the vmHostRule which is an affinity vm-host rule in vCenter.", - "server": "server is the fully-qualified domain name or the IP address of the vCenter server.", + "server": "server is the fully-qualified domain name or the IP address of the vCenter server. This must match the server field of an entry in the vcenters list. The match is case-sensitive; the value must be specified exactly as it appears in the vcenters entry. The value must be between 1 and 255 characters long.", "topology": "topology describes a given failure domain using vSphere constructs", } @@ -2215,7 +2217,7 @@ func (VSpherePlatformNodeNetworkingSpec) SwaggerDoc() map[string]string { var map_VSpherePlatformSpec = map[string]string{ "": "VSpherePlatformSpec holds the desired state of the vSphere infrastructure provider. In the future the cloud provider operator, storage operator and machine operator will use these fields for configuration.", "vcenters": "vcenters holds the connection details for services to communicate with vCenter. Up to 3 vCenters are supported. Once the cluster has been installed, you are unable to change the current number of defined vCenters except when 1.) the cluster has been upgraded from a version of OpenShift where the vsphere platform spec was not present or 2.) in TechPreview you are able to add and remove vCenters but may not remove all vCenters. You may make modifications to the existing vCenters that are defined in the vcenters list in order to match with any added or modified failure domains.", - "failureDomains": "failureDomains contains the definition of region, zone and the vCenter topology. If this is omitted failure domains (regions and zones) will not be used.", + "failureDomains": "failureDomains contains the definition of region, zone and the vCenter topology. If this is omitted failure domains (regions and zones) will not be used. Each failure domain's server must match the server field of an entry in the vcenters list.", "nodeNetworking": "nodeNetworking contains the definition of internal and external network constraints for assigning the node's networking. If this field is omitted, networking defaults to the legacy address selection behavior which is to only support a single address and return the first one found.", "apiServerInternalIPs": "apiServerInternalIPs are the IP addresses to contact the Kubernetes API server that can be used by components inside the cluster, like kubelets using the infrastructure rather than Kubernetes networking. These are the IPs for a self-hosted load balancer in front of the API servers. In dual stack clusters this list contains two IP addresses, one from IPv4 family and one from IPv6. In single stack clusters a single IP address is expected. When omitted, values from the status.apiServerInternalIPs will be used. Once set, the list cannot be completely removed (but its second entry can).", "ingressIPs": "ingressIPs are the external IPs which route to the default ingress controller. The IPs are suitable targets of a wildcard DNS record used to resolve default route host names. In dual stack clusters this list contains two IP addresses, one from IPv4 family and one from IPv6. In single stack clusters a single IP address is expected. When omitted, values from the status.ingressIPs will be used. Once set, the list cannot be completely removed (but its second entry can).", @@ -2501,14 +2503,14 @@ func (VaultConfigMapReference) SwaggerDoc() map[string]string { } var map_VaultKMSPluginConfig = map[string]string{ - "": "VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS", - "kmsPluginImage": "kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.\n\nThe image must be a fully qualified OCI image pull spec with a SHA256 digest. The format is: host[:port][/namespace]/name@sha256: where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. The total length must be between 75 and 447 characters.\n\nShort names (e.g., \"vault-plugin\" or \"hashicorp/vault-plugin\") are not allowed. The registry hostname must be included and must contain at least one dot. Image tags (e.g., \":latest\", \":v1.0.0\") are not allowed.\n\nConsult the OpenShift documentation for compatible plugin versions with your cluster version, then obtain the image digest for that version from HashiCorp's container registry.\n\nFor disconnected environments, mirror the plugin image to an accessible registry and reference the mirrored location with its digest.", - "vaultAddress": "vaultAddress specifies the address of the HashiCorp Vault instance. The value must be a valid HTTPS URL containing only scheme, host, and optional port. Paths, user info, query parameters, and fragments are not allowed.\n\nFormat: https://hostname[:port] Example: https://vault.example.com:8200\n\nThe value must be between 1 and 512 characters.", - "vaultNamespace": "vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. This is only applicable for Vault Enterprise installations. When this field is not set, no namespace is used.\n\nThe value must be between 1 and 4096 characters. The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", - "tls": "tls contains the TLS configuration for connecting to the Vault server. When this field is not set, system default TLS settings are used.", - "authentication": "authentication defines the authentication method used to authenticate with Vault.", - "transitMount": "transitMount specifies the mount path of the Vault Transit engine.\n\nThe transit mount must be between 1 and 1024 characters, cannot start or end with a forward slash, cannot contain consecutive forward slashes, and must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) and forward slashes as path separators.", - "transitKey": "transitKey specifies the name of the encryption key in Vault's Transit engine. This key is used to encrypt and decrypt data.\n\nThe transit key must be between 1 and 512 characters, cannot contain forward slashes, and must only contain alphanumeric characters, hyphens, periods, and underscores.", + "": "VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS", + "kmsPluginImage": "kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.\n\nThe image must be a fully qualified OCI image pull spec with a SHA256 digest. The format is: host[:port][/namespace]/name@sha256: where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. The total length must be between 75 and 447 characters.\n\nShort names (e.g., \"vault-plugin\" or \"hashicorp/vault-plugin\") are not allowed. The registry hostname must be included and must contain at least one dot. Image tags (e.g., \":latest\", \":v1.0.0\") are not allowed.\n\nConsult the OpenShift documentation for compatible plugin versions with your cluster version, then obtain the image digest for that version from HashiCorp's container registry.\n\nFor disconnected environments, mirror the plugin image to an accessible registry and reference the mirrored location with its digest.", + "vaultAddress": "vaultAddress specifies the address of the HashiCorp Vault instance. The value must be a valid HTTPS URL containing only scheme, host, and optional port. Paths, user info, query parameters, and fragments are not allowed.\n\nFormat: https://hostname[:port] Example: https://vault.example.com:8200\n\nThe value must be between 1 and 512 characters.", + "vaultNamespace": "vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. This is only applicable for Vault Enterprise installations. When this field is not set, no namespace is used.\n\nThe value must be between 1 and 4096 characters. The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", + "vaultAuthNamespace": "vaultAuthNamespace specifies the Vault namespace to use for authentication. This is only applicable for Vault Enterprise installations where authentication and Transit operations may be in different namespaces. When this field is not set, the value of vaultNamespace is used for both authentication and Transit key operations.\n\nThe value must be between 1 and 4096 characters. The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", + "tls": "tls contains the TLS configuration for connecting to the Vault server. When this field is not set, system default TLS settings are used.", + "authentication": "authentication defines the authentication method used to authenticate with Vault.", + "vaultKeyPath": "vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine, combining the Transit engine mount path and the key name separated by \"/keys/\". Format: /keys/ (e.g., transit/keys/my-key, myteam/transit/keys/production-key).\n\nThe total path length must be between 8 and 1542 characters. The path cannot start or end with a forward slash, cannot contain consecutive forward slashes, must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) and forward slashes as path separators, and must not contain \".\" or \"..\" path segments. The key name must start and end with an alphanumeric character or underscore, and may contain alphanumeric characters, underscores, hyphens, and periods in the middle.", } func (VaultKMSPluginConfig) SwaggerDoc() map[string]string { diff --git a/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go b/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go index d4846fd1cd..7692fe21b4 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go @@ -466,6 +466,28 @@ type NodeExporterCollectorConfig struct { // Enable when you need visibility into kernel softirq processing across CPUs. // +optional Softirqs NodeExporterCollectorSoftirqsConfig `json:"softirqs,omitempty,omitzero"` + // deviceMapperMultipath configures the dmmultipath collector, which collects statistics + // about DM-Multipath devices. + // deviceMapperMultipath is optional. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, + // which is subject to change over time. The current default is enabled. + // +optional + DeviceMapperMultipath NodeExporterCollectorDeviceMapperMultipathConfig `json:"deviceMapperMultipath,omitzero"` + // zoneinfo configures the zoneinfo collector, which exposes per-zone memory page counts, + // watermarks, and protection thresholds from /proc/zoneinfo. + // zoneinfo is optional. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, + // which is subject to change over time. The current default is to not collect zoneinfo metrics. + // Enable when you need visibility into kernel memory zone allocation and pressure. + // +optional + Zoneinfo NodeExporterCollectorZoneinfoConfig `json:"zoneinfo,omitzero"` + // nvmExpressSubsystem configures the nvmesubsystem collector, which + // collects statistics about NVM Express (NVMe) subsystem devices. + // nvmExpressSubsystem is optional. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, + // which is subject to change over time. The current default is enabled. + // +optional + NVMExpressSubsystem NodeExporterCollectorNVMExpressSubsystemConfig `json:"nvmExpressSubsystem,omitzero"` } // NodeExporterCollectorCpufreqConfig provides configuration for the cpufreq collector @@ -689,6 +711,48 @@ type NodeExporterCollectorSoftirqsConfig struct { CollectionPolicy NodeExporterCollectorCollectionPolicy `json:"collectionPolicy,omitempty"` } +// NodeExporterCollectorDeviceMapperMultipathConfig provides configuration for the dmmultipath collector +// of the node-exporter agent. The dmmultipath collector collects statistics about +// DM-Multipath devices. +// It is enabled by default. +type NodeExporterCollectorDeviceMapperMultipathConfig struct { + // collectionPolicy declares whether the dmmultipath collector collects metrics. + // This field is required. + // Valid values are "Collect" and "DoNotCollect". + // When set to "Collect", the dmmultipath collector is active and DM-Multipath device statistics are collected. + // When set to "DoNotCollect", the dmmultipath collector is inactive and the corresponding metrics become unavailable. + // +required + CollectionPolicy NodeExporterCollectorCollectionPolicy `json:"collectionPolicy,omitempty"` +} + +// NodeExporterCollectorZoneinfoConfig provides configuration for the zoneinfo collector +// of the node-exporter agent. The zoneinfo collector exposes per-zone memory page counts, +// watermarks, and protection thresholds from /proc/zoneinfo. +// By default, the zoneinfo collector does not collect metrics. +type NodeExporterCollectorZoneinfoConfig struct { + // collectionPolicy declares whether the zoneinfo collector collects metrics. + // This field is required. + // Valid values are "Collect" and "DoNotCollect". + // When set to "Collect", the zoneinfo collector is active and zone memory statistics are collected. + // When set to "DoNotCollect", the zoneinfo collector is inactive. + // +required + CollectionPolicy NodeExporterCollectorCollectionPolicy `json:"collectionPolicy,omitempty"` +} + +// NodeExporterCollectorNVMExpressSubsystemConfig provides configuration for +// the nvmesubsystem collector of the node-exporter agent. The nvmesubsystem +// collector collects statistics about NVM Express (NVMe) subsystem devices. +// It is enabled by default. +type NodeExporterCollectorNVMExpressSubsystemConfig struct { + // collectionPolicy declares whether the nvmesubsystem collector collects metrics. + // This field is required. + // Valid values are "Collect" and "DoNotCollect". + // When set to "Collect", the nvmesubsystem collector is active and NVMe subsystem statistics are collected. + // When set to "DoNotCollect", the nvmesubsystem collector is inactive and the corresponding metrics become unavailable. + // +required + CollectionPolicy NodeExporterCollectorCollectionPolicy `json:"collectionPolicy,omitempty"` +} + // MonitoringPluginConfig provides configuration options for the monitoring plugin // that runs as a dynamic plugin of the OpenShift web console. // The monitoring plugin provides the monitoring UI in the OpenShift web console @@ -1550,6 +1614,13 @@ type RemoteWriteSpec struct { // +kubebuilder:validation:MaxLength=63 // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9_-]+$')",message="must contain only alphanumeric characters, hyphens, and underscores" Name string `json:"name,omitempty"` + // messageVersion defines the Remote Write message's version to use when writing to the endpoint. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The default value is "V1.0". + // When set to "V1.0", Prometheus uses the `prometheus.WriteRequest` protobuf message introduced in Remote Write 1.0. + // When set to "V2.0", Prometheus uses the `io.prometheus.write.v2.Request` protobuf message introduced in Remote Write 2.0. + // +optional + MessageVersion RemoteWriteMessageVersion `json:"messageVersion,omitempty,omitzero"` // authorization defines the authorization method for the remote write endpoint. // When omitted, no authorization is performed. // When set, type must be one of Authorization, BasicAuth, OAuth2, SigV4, or ServiceAccount; the corresponding nested config must be set (ServiceAccount has no config). @@ -1747,6 +1818,17 @@ type RemoteWriteAuthorization struct { // SafeAuthorization *v1.SecretKeySelector `json:"safeAuthorization,omitempty"` } +// RemoteWriteMessageVersion defines the version of the remote-write protocol. +// +kubebuilder:validation:Enum=V1.0;V2.0 +type RemoteWriteMessageVersion string + +const ( + // RemoteWriteMessageVersion1_0 indicates the version 1.0 of the remote-write protocol. + RemoteWriteMessageVersion1_0 RemoteWriteMessageVersion = "V1.0" + // RemoteWriteMessageVersion2_0 indicates the version 2.0 of the remote-write protocol. + RemoteWriteMessageVersion2_0 RemoteWriteMessageVersion = "V2.0" +) + // MetadataConfigSendPolicy defines whether to send metadata with platform defaults or with custom settings. // +kubebuilder:validation:Enum=Default;Custom type MetadataConfigSendPolicy string diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go index 12dd0cd312..660e2931a7 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go @@ -1024,6 +1024,9 @@ func (in *NodeExporterCollectorConfig) DeepCopyInto(out *NodeExporterCollectorCo out.Processes = in.Processes in.Systemd.DeepCopyInto(&out.Systemd) out.Softirqs = in.Softirqs + out.DeviceMapperMultipath = in.DeviceMapperMultipath + out.Zoneinfo = in.Zoneinfo + out.NVMExpressSubsystem = in.NVMExpressSubsystem return } @@ -1053,6 +1056,22 @@ func (in *NodeExporterCollectorCpufreqConfig) DeepCopy() *NodeExporterCollectorC return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *NodeExporterCollectorDeviceMapperMultipathConfig) DeepCopyInto(out *NodeExporterCollectorDeviceMapperMultipathConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeExporterCollectorDeviceMapperMultipathConfig. +func (in *NodeExporterCollectorDeviceMapperMultipathConfig) DeepCopy() *NodeExporterCollectorDeviceMapperMultipathConfig { + if in == nil { + return nil + } + out := new(NodeExporterCollectorDeviceMapperMultipathConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NodeExporterCollectorEthtoolConfig) DeepCopyInto(out *NodeExporterCollectorEthtoolConfig) { *out = *in @@ -1101,6 +1120,22 @@ func (in *NodeExporterCollectorMountStatsConfig) DeepCopy() *NodeExporterCollect return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *NodeExporterCollectorNVMExpressSubsystemConfig) DeepCopyInto(out *NodeExporterCollectorNVMExpressSubsystemConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeExporterCollectorNVMExpressSubsystemConfig. +func (in *NodeExporterCollectorNVMExpressSubsystemConfig) DeepCopy() *NodeExporterCollectorNVMExpressSubsystemConfig { + if in == nil { + return nil + } + out := new(NodeExporterCollectorNVMExpressSubsystemConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NodeExporterCollectorNetClassCollectConfig) DeepCopyInto(out *NodeExporterCollectorNetClassCollectConfig) { *out = *in @@ -1236,6 +1271,22 @@ func (in *NodeExporterCollectorTcpStatConfig) DeepCopy() *NodeExporterCollectorT return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *NodeExporterCollectorZoneinfoConfig) DeepCopyInto(out *NodeExporterCollectorZoneinfoConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeExporterCollectorZoneinfoConfig. +func (in *NodeExporterCollectorZoneinfoConfig) DeepCopy() *NodeExporterCollectorZoneinfoConfig { + if in == nil { + return nil + } + out := new(NodeExporterCollectorZoneinfoConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NodeExporterConfig) DeepCopyInto(out *NodeExporterConfig) { *out = *in diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go index 36a7803bf2..e7e61f4450 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go @@ -230,6 +230,11 @@ func (in NodeExporterCollectorCpufreqConfig) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorCpufreqConfig" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in NodeExporterCollectorDeviceMapperMultipathConfig) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorDeviceMapperMultipathConfig" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in NodeExporterCollectorEthtoolConfig) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorEthtoolConfig" @@ -245,6 +250,11 @@ func (in NodeExporterCollectorMountStatsConfig) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorMountStatsConfig" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in NodeExporterCollectorNVMExpressSubsystemConfig) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorNVMExpressSubsystemConfig" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in NodeExporterCollectorNetClassCollectConfig) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorNetClassCollectConfig" @@ -285,6 +295,11 @@ func (in NodeExporterCollectorTcpStatConfig) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorTcpStatConfig" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in NodeExporterCollectorZoneinfoConfig) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorZoneinfoConfig" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in NodeExporterConfig) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.NodeExporterConfig" diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go index 8f6cda1915..2c20659cac 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go @@ -344,18 +344,21 @@ func (NodeExporterCollectorBuddyInfoConfig) SwaggerDoc() map[string]string { } var map_NodeExporterCollectorConfig = map[string]string{ - "": "NodeExporterCollectorConfig defines settings for individual collectors of the node-exporter agent. Each collector can be individually set to collect or not collect metrics. At least one collector must be specified.", - "cpuFreq": "cpuFreq configures the cpufreq collector, which collects CPU frequency statistics. cpuFreq is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Consider enabling when you need to observe CPU frequency scaling; expect higher CPU usage on many-core nodes when collectionPolicy is Collect.", - "tcpStat": "tcpStat configures the tcpstat collector, which collects TCP connection statistics. tcpStat is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable when debugging TCP connection behavior or capacity at the node level.", - "ethtool": "ethtool configures the ethtool collector, which collects ethernet device statistics. ethtool is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable when you need NIC driver-level ethtool metrics beyond generic netdev counters.", - "netDev": "netDev configures the netdev collector, which collects network device statistics. netDev is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is enabled. Turn off if you must reduce per-interface metric cardinality on hosts with many virtual interfaces.", - "netClass": "netClass configures the netclass collector, which collects information about network devices. netClass is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is enabled with netlink mode active. Use statsGatherer when sysfs vs netlink implementation matters or when matching node_exporter tuning.", - "buddyInfo": "buddyInfo configures the buddyinfo collector, which collects statistics about memory fragmentation from the node_buddyinfo_blocks metric. This metric collects data from /proc/buddyinfo. buddyInfo is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable when investigating kernel memory fragmentation; typically for advanced troubleshooting only.", - "mountStats": "mountStats configures the mountstats collector, which collects statistics about NFS volume I/O activities. mountStats is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enabling this collector may produce metrics with high cardinality. If you enable this collector, closely monitor the prometheus-k8s deployment for excessive memory usage. Enable when you care about per-mount NFS client statistics.", - "ksmd": "ksmd configures the ksmd collector, which collects statistics from the kernel same-page merger daemon. ksmd is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable on nodes where KSM is in use and you want visibility into merging activity.", - "processes": "processes configures the processes collector, which collects statistics from processes and threads running in the system. processes is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable for process/thread-level insight; can be expensive on busy nodes.", - "systemd": "systemd configures the systemd collector, which collects statistics on the systemd daemon and its managed services. systemd is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enabling this collector with a long list of selected units may produce metrics with high cardinality. If you enable this collector, closely monitor the prometheus-k8s deployment for excessive memory usage. Enable when you need metrics for specific units; scope units carefully.", - "softirqs": "softirqs configures the softirqs collector, which exposes detailed softirq statistics from /proc/softirqs. softirqs is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable when you need visibility into kernel softirq processing across CPUs.", + "": "NodeExporterCollectorConfig defines settings for individual collectors of the node-exporter agent. Each collector can be individually set to collect or not collect metrics. At least one collector must be specified.", + "cpuFreq": "cpuFreq configures the cpufreq collector, which collects CPU frequency statistics. cpuFreq is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Consider enabling when you need to observe CPU frequency scaling; expect higher CPU usage on many-core nodes when collectionPolicy is Collect.", + "tcpStat": "tcpStat configures the tcpstat collector, which collects TCP connection statistics. tcpStat is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable when debugging TCP connection behavior or capacity at the node level.", + "ethtool": "ethtool configures the ethtool collector, which collects ethernet device statistics. ethtool is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable when you need NIC driver-level ethtool metrics beyond generic netdev counters.", + "netDev": "netDev configures the netdev collector, which collects network device statistics. netDev is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is enabled. Turn off if you must reduce per-interface metric cardinality on hosts with many virtual interfaces.", + "netClass": "netClass configures the netclass collector, which collects information about network devices. netClass is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is enabled with netlink mode active. Use statsGatherer when sysfs vs netlink implementation matters or when matching node_exporter tuning.", + "buddyInfo": "buddyInfo configures the buddyinfo collector, which collects statistics about memory fragmentation from the node_buddyinfo_blocks metric. This metric collects data from /proc/buddyinfo. buddyInfo is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable when investigating kernel memory fragmentation; typically for advanced troubleshooting only.", + "mountStats": "mountStats configures the mountstats collector, which collects statistics about NFS volume I/O activities. mountStats is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enabling this collector may produce metrics with high cardinality. If you enable this collector, closely monitor the prometheus-k8s deployment for excessive memory usage. Enable when you care about per-mount NFS client statistics.", + "ksmd": "ksmd configures the ksmd collector, which collects statistics from the kernel same-page merger daemon. ksmd is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable on nodes where KSM is in use and you want visibility into merging activity.", + "processes": "processes configures the processes collector, which collects statistics from processes and threads running in the system. processes is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable for process/thread-level insight; can be expensive on busy nodes.", + "systemd": "systemd configures the systemd collector, which collects statistics on the systemd daemon and its managed services. systemd is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enabling this collector with a long list of selected units may produce metrics with high cardinality. If you enable this collector, closely monitor the prometheus-k8s deployment for excessive memory usage. Enable when you need metrics for specific units; scope units carefully.", + "softirqs": "softirqs configures the softirqs collector, which exposes detailed softirq statistics from /proc/softirqs. softirqs is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. Enable when you need visibility into kernel softirq processing across CPUs.", + "deviceMapperMultipath": "deviceMapperMultipath configures the dmmultipath collector, which collects statistics about DM-Multipath devices. deviceMapperMultipath is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is enabled.", + "zoneinfo": "zoneinfo configures the zoneinfo collector, which exposes per-zone memory page counts, watermarks, and protection thresholds from /proc/zoneinfo. zoneinfo is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is to not collect zoneinfo metrics. Enable when you need visibility into kernel memory zone allocation and pressure.", + "nvmExpressSubsystem": "nvmExpressSubsystem configures the nvmesubsystem collector, which collects statistics about NVM Express (NVMe) subsystem devices. nvmExpressSubsystem is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is enabled.", } func (NodeExporterCollectorConfig) SwaggerDoc() map[string]string { @@ -371,6 +374,15 @@ func (NodeExporterCollectorCpufreqConfig) SwaggerDoc() map[string]string { return map_NodeExporterCollectorCpufreqConfig } +var map_NodeExporterCollectorDeviceMapperMultipathConfig = map[string]string{ + "": "NodeExporterCollectorDeviceMapperMultipathConfig provides configuration for the dmmultipath collector of the node-exporter agent. The dmmultipath collector collects statistics about DM-Multipath devices. It is enabled by default.", + "collectionPolicy": "collectionPolicy declares whether the dmmultipath collector collects metrics. This field is required. Valid values are \"Collect\" and \"DoNotCollect\". When set to \"Collect\", the dmmultipath collector is active and DM-Multipath device statistics are collected. When set to \"DoNotCollect\", the dmmultipath collector is inactive and the corresponding metrics become unavailable.", +} + +func (NodeExporterCollectorDeviceMapperMultipathConfig) SwaggerDoc() map[string]string { + return map_NodeExporterCollectorDeviceMapperMultipathConfig +} + var map_NodeExporterCollectorEthtoolConfig = map[string]string{ "": "NodeExporterCollectorEthtoolConfig provides configuration for the ethtool collector of the node-exporter agent. The ethtool collector collects ethernet device statistics. It is disabled by default.", "collectionPolicy": "collectionPolicy declares whether the ethtool collector collects metrics. This field is required. Valid values are \"Collect\" and \"DoNotCollect\". When set to \"Collect\", the ethtool collector is active and ethernet device statistics are collected. When set to \"DoNotCollect\", the ethtool collector is inactive.", @@ -398,6 +410,15 @@ func (NodeExporterCollectorMountStatsConfig) SwaggerDoc() map[string]string { return map_NodeExporterCollectorMountStatsConfig } +var map_NodeExporterCollectorNVMExpressSubsystemConfig = map[string]string{ + "": "NodeExporterCollectorNVMExpressSubsystemConfig provides configuration for the nvmesubsystem collector of the node-exporter agent. The nvmesubsystem collector collects statistics about NVM Express (NVMe) subsystem devices. It is enabled by default.", + "collectionPolicy": "collectionPolicy declares whether the nvmesubsystem collector collects metrics. This field is required. Valid values are \"Collect\" and \"DoNotCollect\". When set to \"Collect\", the nvmesubsystem collector is active and NVMe subsystem statistics are collected. When set to \"DoNotCollect\", the nvmesubsystem collector is inactive and the corresponding metrics become unavailable.", +} + +func (NodeExporterCollectorNVMExpressSubsystemConfig) SwaggerDoc() map[string]string { + return map_NodeExporterCollectorNVMExpressSubsystemConfig +} + var map_NodeExporterCollectorNetClassCollectConfig = map[string]string{ "": "NodeExporterCollectorNetClassCollectConfig holds configuration options for the netclass collector when it is actively collecting metrics. At least one field must be specified.", "statsGatherer": "statsGatherer selects which implementation the netclass collector uses to gather statistics (sysfs or netlink). statsGatherer is optional. Valid values are \"Sysfs\" and \"Netlink\". When set to \"Netlink\", the netlink implementation is used; when set to \"Sysfs\", the sysfs implementation is used. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is Netlink.", @@ -472,6 +493,15 @@ func (NodeExporterCollectorTcpStatConfig) SwaggerDoc() map[string]string { return map_NodeExporterCollectorTcpStatConfig } +var map_NodeExporterCollectorZoneinfoConfig = map[string]string{ + "": "NodeExporterCollectorZoneinfoConfig provides configuration for the zoneinfo collector of the node-exporter agent. The zoneinfo collector exposes per-zone memory page counts, watermarks, and protection thresholds from /proc/zoneinfo. By default, the zoneinfo collector does not collect metrics.", + "collectionPolicy": "collectionPolicy declares whether the zoneinfo collector collects metrics. This field is required. Valid values are \"Collect\" and \"DoNotCollect\". When set to \"Collect\", the zoneinfo collector is active and zone memory statistics are collected. When set to \"DoNotCollect\", the zoneinfo collector is inactive.", +} + +func (NodeExporterCollectorZoneinfoConfig) SwaggerDoc() map[string]string { + return map_NodeExporterCollectorZoneinfoConfig +} + var map_NodeExporterConfig = map[string]string{ "": "NodeExporterConfig provides configuration options for the node-exporter agent that runs as a DaemonSet in the `openshift-monitoring` namespace. The node-exporter agent collects hardware and OS-level metrics from every node in the cluster, including CPU, memory, disk, and network statistics. At least one field must be specified.", "resources": "resources defines the compute resource requests and limits for the node-exporter container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 8m\n limit: null\n - name: memory\n request: 32Mi\n limit: null", @@ -635,6 +665,7 @@ var map_RemoteWriteSpec = map[string]string{ "": "RemoteWriteSpec represents configuration for remote write endpoints.", "url": "url is the URL of the remote write endpoint. Must be a valid URL with http or https scheme and a non-empty hostname. Query parameters, fragments, and user information (e.g. user:password@host) are not allowed. Empty string is invalid. Must be between 1 and 2048 characters in length.", "name": "name is a required identifier for this remote write configuration (name is the list key for the remoteWrite list). This name is used in metrics and logging to differentiate remote write queues. Must contain only alphanumeric characters, hyphens, and underscores. Must be between 1 and 63 characters in length.", + "messageVersion": "messageVersion defines the Remote Write message's version to use when writing to the endpoint. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The default value is \"V1.0\". When set to \"V1.0\", Prometheus uses the `prometheus.WriteRequest` protobuf message introduced in Remote Write 1.0. When set to \"V2.0\", Prometheus uses the `io.prometheus.write.v2.Request` protobuf message introduced in Remote Write 2.0.", "authorization": "authorization defines the authorization method for the remote write endpoint. When omitted, no authorization is performed. When set, type must be one of Authorization, BasicAuth, OAuth2, SigV4, or ServiceAccount; the corresponding nested config must be set (ServiceAccount has no config).", "headers": "headers specifies the custom HTTP headers to be sent along with each remote write request. Sending custom headers makes the configuration of a proxy in between optional and helps the receiver recognize the given source better. Clients MAY allow users to send custom HTTP headers; they MUST NOT allow users to configure them in such a way as to send reserved headers. Headers set by Prometheus cannot be overwritten. When omitted, no custom headers are sent. Maximum of 50 headers can be specified. Each header name must be unique. Each header name must contain only alphanumeric characters, hyphens, and underscores, and must not be a reserved Prometheus header (Host, Authorization, Content-Encoding, Content-Type, X-Prometheus-Remote-Write-Version, User-Agent, Connection, Keep-Alive, Proxy-Authenticate, Proxy-Authorization, WWW-Authenticate).", "metadataConfig": "metadataConfig configures the sending of series metadata to remote storage. When omitted, no metadata is sent. When set to sendPolicy: Default, metadata is sent using platform-chosen defaults (e.g. send interval 30 seconds). When set to sendPolicy: Custom, metadata is sent using the settings in the custom field (e.g. custom.sendIntervalSeconds).", diff --git a/vendor/github.com/openshift/api/envtest-releases.yaml b/vendor/github.com/openshift/api/envtest-releases.yaml index ea376ded55..4705c327e0 100644 --- a/vendor/github.com/openshift/api/envtest-releases.yaml +++ b/vendor/github.com/openshift/api/envtest-releases.yaml @@ -116,3 +116,16 @@ releases: envtest-v1.35.1-linux-arm64.tar.gz: hash: 309308f9c66f9e2e5192c65a333a388faaaa903841f26f8a96b8f13a5eb3039bcbb818ef6ddbb5803a9cfa9b25e37249a0aed5d472badb25539696569923f87f selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.35.1-linux-arm64.tar.gz + v1.36.2: + envtest-v1.36.2-darwin-amd64.tar.gz: + hash: ca924b4435784f12ac3c2513a78d9c6527bb83f2cece48e07d017616843cb67d2ec5836b7a83818f8817c3e0b4de1319c55ead061f3e41c05553a40bf240017a + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.36.2-darwin-amd64.tar.gz + envtest-v1.36.2-darwin-arm64.tar.gz: + hash: f5e45f660fb2abb05a55093bfd3f9594ca91b074a86126112b4645d463bc4b0e0b10261da26420c4dfbef18d189ab92da6c881c347159541481185e157d37d92 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.36.2-darwin-arm64.tar.gz + envtest-v1.36.2-linux-amd64.tar.gz: + hash: 4322b73b1d43c7a16fb46819d2e8a95e34ab2412bcc502c75231c61bdd799a2b43916e12c11f5f0251573260e60a641e34f67e81da37d2726abfcca1720b1e73 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.36.2-linux-amd64.tar.gz + envtest-v1.36.2-linux-arm64.tar.gz: + hash: bbe6810d76c91349cdee6daf65a6a9289010d48ddc2c42d9e163897a927b6ff7de9d0addc75bd54721cfa5048f8aafcac06a950efa59f4a686f037d1386811de + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.36.2-linux-arm64.tar.gz diff --git a/vendor/github.com/openshift/api/features.md b/vendor/github.com/openshift/api/features.md index c78d402696..e466369e5b 100644 --- a/vendor/github.com/openshift/api/features.md +++ b/vendor/github.com/openshift/api/features.md @@ -13,6 +13,7 @@ | KarpenterOperator| | | | Enabled | | | | | | MutableTopology| | | | Enabled | | | | | | AuthenticationComponentProxy| | | | Enabled | | | | Enabled | +| BGPBasedVIPManagement| | | Enabled | Enabled | | | | | | ClusterAPIComputeInstall| | | Enabled | Enabled | | | | | | ClusterAPIControlPlaneInstall| | | Enabled | Enabled | | | | | | ClusterUpdatePreflight| | | Enabled | Enabled | | | | | @@ -24,15 +25,10 @@ | NewOLMCatalogdAPIV1Metas| | | | Enabled | | | | Enabled | | NewOLMConfigAPI| | | | Enabled | | | | Enabled | | NewOLMOwnSingleNamespace| | | | Enabled | | | | Enabled | -| NewOLMPreflightPermissionChecks| | | | Enabled | | | | Enabled | -| NoRegistryClusterInstall| | | | Enabled | | | | Enabled | -| OLMLifecycleAndCompatibility| | | | Enabled | | | | Enabled | | ProvisioningRequestAvailable| | | Enabled | Enabled | | | | | | AWSClusterHostedDNS| | | Enabled | Enabled | | | Enabled | Enabled | | AWSDedicatedHosts| | | Enabled | Enabled | | | Enabled | Enabled | -| AWSDualStackInstall| | | Enabled | Enabled | | | Enabled | Enabled | | AWSEuropeanSovereignCloudInstall| | | Enabled | Enabled | | | Enabled | Enabled | -| AdditionalStorageConfig| | | Enabled | Enabled | | | Enabled | Enabled | | AutomatedEtcdBackup| | | Enabled | Enabled | | | Enabled | Enabled | | AzureDedicatedHosts| | | Enabled | Enabled | | | Enabled | Enabled | | AzureDualStackInstall| | | Enabled | Enabled | | | Enabled | Enabled | @@ -40,7 +36,7 @@ | BootcNodeManagement| | | Enabled | Enabled | | | Enabled | Enabled | | CBORServingAndStorage| | | Enabled | Enabled | | | Enabled | Enabled | | CRDCompatibilityRequirementOperator| | | Enabled | Enabled | | | Enabled | Enabled | -| CRIOCredentialProviderConfig| | | Enabled | Enabled | | | Enabled | Enabled | +| CRIOCredentialProviderConfig| | Enabled | | Enabled | | Enabled | | Enabled | | ClientsPreferCBOR| | | Enabled | Enabled | | | Enabled | Enabled | | ClusterAPIInstallIBMCloud| | | Enabled | Enabled | | | Enabled | Enabled | | ClusterAPIMachineManagement| | | Enabled | Enabled | | | Enabled | Enabled | @@ -60,17 +56,15 @@ | EtcdBackendQuota| | | Enabled | Enabled | | | Enabled | Enabled | | Example| | | Enabled | Enabled | | | Enabled | Enabled | | ExternalOIDCExternalClaimsSourcing| | | Enabled | Enabled | | | Enabled | Enabled | -| ExternalOIDCWithUpstreamParity| | | Enabled | Enabled | | | Enabled | Enabled | | ExternalSnapshotMetadata| | | Enabled | Enabled | | | Enabled | Enabled | | GCPCustomAPIEndpoints| | | Enabled | Enabled | | | Enabled | Enabled | | GCPCustomAPIEndpointsInstall| | | Enabled | Enabled | | | Enabled | Enabled | | GCPDualStackInstall| | | Enabled | Enabled | | | Enabled | Enabled | +| GCPSovereignCloudInstall| | | Enabled | Enabled | | | Enabled | Enabled | +| GatewayAPIManagementMode| | | Enabled | Enabled | | | Enabled | Enabled | | HyperShiftOnlyDynamicResourceAllocation| Enabled | | Enabled | | Enabled | | Enabled | | | ImageModeStatusReporting| | | Enabled | Enabled | | | Enabled | Enabled | | IngressComponentRouteLabels| | | Enabled | Enabled | | | Enabled | Enabled | -| IngressControllerDynamicConfigurationManager| | | Enabled | Enabled | | | Enabled | Enabled | -| IngressControllerMultipleHAProxyVersions| | | Enabled | Enabled | | | Enabled | Enabled | -| IrreconcilableMachineConfig| | | Enabled | Enabled | | | Enabled | Enabled | | KMSEncryption| | | Enabled | Enabled | | | Enabled | Enabled | | MachineAPIMigration| | | Enabled | Enabled | | | Enabled | Enabled | | MachineAPIMigrationAWS| | | Enabled | Enabled | | | Enabled | Enabled | @@ -83,20 +77,22 @@ | NewOLM| | Enabled | | Enabled | | Enabled | | Enabled | | NewOLMWebhookProviderOpenshiftServiceCA| | Enabled | | Enabled | | Enabled | | Enabled | | NoOverlayMode| | | Enabled | Enabled | | | Enabled | Enabled | +| NoRegistryClusterInstall| | Enabled | | Enabled | | Enabled | | Enabled | | NutanixMultiSubnets| | | Enabled | Enabled | | | Enabled | Enabled | +| OLMLifecycleAndCompatibility| | Enabled | | Enabled | | Enabled | | Enabled | | OVNObservability| | | Enabled | Enabled | | | Enabled | Enabled | | OnPremDNSRecords| | | Enabled | Enabled | | | Enabled | Enabled | | SELinuxMount| | | Enabled | Enabled | | | Enabled | Enabled | -| SELinuxMountGAReadiness| | | Enabled | Enabled | | | Enabled | Enabled | | SignatureStores| | | Enabled | Enabled | | | Enabled | Enabled | | TLSAdherence| | | Enabled | Enabled | | | Enabled | Enabled | | TLSGroupPreferences| | | Enabled | Enabled | | | Enabled | Enabled | | VSphereConfigurableMaxAllowedBlockVolumesPerNode| | | Enabled | Enabled | | | Enabled | Enabled | | VSphereMultiVCenterDay2| | | Enabled | Enabled | | | Enabled | Enabled | -| VolumeGroupSnapshot| | | Enabled | Enabled | | | Enabled | Enabled | | OSStreams| | Enabled | Enabled | Enabled | | Enabled | Enabled | Enabled | | AWSClusterHostedDNSInstall| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| AWSDualStackInstall| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | AWSServiceLBNetworkSecurityGroup| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| AdditionalStorageConfig| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | AzureWorkloadIdentity| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | BootImageSkewEnforcement| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | BuildCSIVolumes| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | @@ -105,17 +101,21 @@ | EventTTL| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ExternalOIDC| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ExternalOIDCWithUIDAndExtraClaimMappings| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| ExternalOIDCWithUpstreamParity| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | GatewayAPIWithoutOLM| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ImageStreamImportMode| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| IngressControllerDynamicConfigurationManager| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| IngressControllerMultipleHAProxyVersions| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | InsightsConfig| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | InsightsOnDemandDataGather| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| IrreconcilableMachineConfig| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | KMSv1| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ManagedBootImagesCPMS| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | MetricsCollectionProfiles| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | MutableCSINodeAllocatableCount| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | MutatingAdmissionPolicy| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | OpenShiftPodSecurityAdmission| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| RouteExternalCertificate| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| SELinuxMountGAReadiness| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ServiceAccountTokenNodeBinding| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | SigstoreImageVerification| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | SigstoreImageVerificationPKI| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | @@ -125,3 +125,4 @@ | VSphereMixedNodeEnv| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | VSphereMultiDisk| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | VSphereMultiNetworks| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| VolumeGroupSnapshot| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | diff --git a/vendor/github.com/openshift/api/features/features.go b/vendor/github.com/openshift/api/features/features.go index b45bef7705..35851b8781 100644 --- a/vendor/github.com/openshift/api/features/features.go +++ b/vendor/github.com/openshift/api/features/features.go @@ -159,7 +159,7 @@ var ( contactPerson("QiWang"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1861"). - enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + enable(inClusterProfile(SelfManaged), inDefault(), inOKD(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). mustRegister() FeatureGateVSphereHostVMGroupZonal = newFeatureGate("VSphereHostVMGroupZonal"). @@ -178,14 +178,6 @@ var ( enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateRouteExternalCertificate = newFeatureGate("RouteExternalCertificate"). - reportProblemsToJiraComponent("router"). - contactPerson("chiragkyal"). - productScope(ocpSpecific). - enhancementPR(legacyFeatureGateWithoutEnhancement). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateNetworkConnect = newFeatureGate("NetworkConnect"). reportProblemsToJiraComponent("Networking/ovn-kubernetes"). contactPerson("tssurya"). @@ -325,7 +317,7 @@ var ( contactPerson("saschagrunert"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1934"). - enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateUpgradeStatus = newFeatureGate("UpgradeStatus"). @@ -341,7 +333,7 @@ var ( contactPerson("fbertina"). productScope(kubernetes). enhancementPR("https://github.com/kubernetes/enhancements/issues/3476"). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateExternalSnapshotMetadata = newFeatureGate("ExternalSnapshotMetadata"). @@ -381,7 +373,7 @@ var ( contactPerson("saldawam"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1763"). - enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateExternalOIDCExternalClaimsSourcing = newFeatureGate("ExternalOIDCExternalClaimsSourcing"). @@ -424,14 +416,6 @@ var ( enable(inClusterProfile(SelfManaged), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateNewOLMPreflightPermissionChecks = newFeatureGate("NewOLMPreflightPermissionChecks"). - reportProblemsToJiraComponent("olm"). - contactPerson("tshort"). - productScope(ocpSpecific). - enhancementPR("https://github.com/openshift/enhancements/pull/1768"). - enable(inClusterProfile(SelfManaged), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateNewOLMOwnSingleNamespace = newFeatureGate("NewOLMOwnSingleNamespace"). reportProblemsToJiraComponent("olm"). contactPerson("nschieder"). @@ -469,7 +453,7 @@ var ( contactPerson("joelanford"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1991"). - enable(inClusterProfile(SelfManaged), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inClusterProfile(SelfManaged), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateInsightsOnDemandDataGather = newFeatureGate("InsightsOnDemandDataGather"). @@ -663,7 +647,7 @@ var ( contactPerson("miciah"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1687"). - enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). mustRegister() FeatureGateIngressComponentRouteLabels = newFeatureGate("IngressComponentRouteLabels"). @@ -679,7 +663,7 @@ var ( contactPerson("miciah"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1965"). - enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). mustRegister() FeatureGateMinimumKubeletVersion = newFeatureGate("MinimumKubeletVersion"). @@ -838,7 +822,7 @@ var ( contactPerson("andfasano"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1821"). - enable(inClusterProfile(SelfManaged), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inClusterProfile(SelfManaged), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateAWSClusterHostedDNSInstall = newFeatureGate("AWSClusterHostedDNSInstall"). @@ -862,14 +846,14 @@ var ( contactPerson("pabrodri"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1785"). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateAWSDualStackInstall = newFeatureGate("AWSDualStackInstall"). reportProblemsToJiraComponent("Installer"). contactPerson("sadasu"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1806"). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateAzureDualStackInstall = newFeatureGate("AzureDualStackInstall"). @@ -888,6 +872,14 @@ var ( enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() + FeatureGateGCPSovereignCloudInstall = newFeatureGate("GCPSovereignCloudInstall"). + reportProblemsToJiraComponent("Installer"). + contactPerson("barbacbd"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/1977"). + enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + mustRegister() + FeatureCBORServingAndStorage = newFeatureGate("CBORServingAndStorage"). reportProblemsToJiraComponent("kube-apiserver"). contactPerson("benluddy"). @@ -950,6 +942,14 @@ var ( enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() + FeatureGateBGPBasedVIPManagement = newFeatureGate("BGPBasedVIPManagement"). + reportProblemsToJiraComponent("Networking / On-Prem Networking"). + contactPerson("mkowalski"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/1982"). + enable(inDevPreviewNoUpgrade()). + mustRegister() + FeatureGateProvisioningRequestAvailable = newFeatureGate("ProvisioningRequestAvailable"). reportProblemsToJiraComponent("Cluster Autoscaler"). contactPerson("elmiko"). @@ -1006,6 +1006,14 @@ var ( enable(inDefault(), inOKD(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). mustRegister() + FeatureGateGatewayAPIManagementMode = newFeatureGate("GatewayAPIManagementMode"). + reportProblemsToJiraComponent("Routing"). + contactPerson("miciah"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/2023"). + enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + mustRegister() + FeatureGateTLSAdherence = newFeatureGate("TLSAdherence"). reportProblemsToJiraComponent("HPCASE / TLS Adherence"). contactPerson("joelanford"). @@ -1050,7 +1058,7 @@ var ( contactPerson("jsafrane"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/2010"). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateKarpenterOperator = newFeatureGate("KarpenterOperator"). diff --git a/vendor/github.com/openshift/api/features/legacyfeaturegates.go b/vendor/github.com/openshift/api/features/legacyfeaturegates.go index a82089b9f7..53b8962a28 100644 --- a/vendor/github.com/openshift/api/features/legacyfeaturegates.go +++ b/vendor/github.com/openshift/api/features/legacyfeaturegates.go @@ -83,8 +83,6 @@ var legacyFeatureGates = sets.New( // never add to this list, if you think you have an exception ask @deads2k "PrivateHostedZoneAWS", // never add to this list, if you think you have an exception ask @deads2k - "RouteExternalCertificate", - // never add to this list, if you think you have an exception ask @deads2k "SetEIPForNLBIngressController", // never add to this list, if you think you have an exception ask @deads2k "SignatureStores", diff --git a/vendor/github.com/openshift/api/machine/v1beta1/types_gcpprovider.go b/vendor/github.com/openshift/api/machine/v1beta1/types_gcpprovider.go index 9713a4e4a8..d6a408ce29 100644 --- a/vendor/github.com/openshift/api/machine/v1beta1/types_gcpprovider.go +++ b/vendor/github.com/openshift/api/machine/v1beta1/types_gcpprovider.go @@ -244,6 +244,26 @@ type GCPDisk struct { // encryptionKey is the customer-supplied encryption key of the disk. // +optional EncryptionKey *GCPEncryptionKeyReference `json:"encryptionKey,omitempty"` + // licenses is a list of URLs of license resources attached to this disk. + // License URLs must match exactly either the full HTTPS URI format + // (https://www.googleapis.com/compute/v1/projects/{project}/global/licenses/{license}) + // or the short self-link format (projects/{project}/global/licenses/{license}). + // Project IDs must use lowercase letters, digits, and hyphens, begin with a letter, + // end with a lowercase letter or digit, and be 6 to 30 characters long. License + // names must be RFC1035-style lowercase names that begin with a letter, end with a + // lowercase letter or digit, contain only lowercase letters, digits, and hyphens, + // and are at most 63 characters long. + // Each license URL must be at least 1 character and must not exceed 256 characters. + // When specified, at least 1 and a maximum of 8 licenses may be provided. + // When omitted, no additional licenses are applied. + // +optional + // +listType=atomic + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=8 + // +kubebuilder:validation:items:MinLength=1 + // +kubebuilder:validation:items:MaxLength=256 + // +kubebuilder:validation:items:Pattern=`^(https://www\.googleapis\.com/compute/v1/)?projects/[a-z][a-z0-9-]{4,28}[a-z0-9]/global/licenses/[a-z]([-a-z0-9]{0,61}[a-z0-9])?$` + Licenses []string `json:"licenses,omitempty"` } // GCPMetadata describes metadata for GCP. diff --git a/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.deepcopy.go index 63b9bb5ff8..09ce343305 100644 --- a/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.deepcopy.go @@ -696,6 +696,11 @@ func (in *GCPDisk) DeepCopyInto(out *GCPDisk) { *out = new(GCPEncryptionKeyReference) (*in).DeepCopyInto(*out) } + if in.Licenses != nil { + in, out := &in.Licenses, &out.Licenses + *out = make([]string, len(*in)) + copy(*out, *in) + } return } diff --git a/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go index e686cad25a..8f5058ff96 100644 --- a/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go @@ -436,6 +436,7 @@ var map_GCPDisk = map[string]string{ "image": "image is the source image to create this disk.", "labels": "labels list of labels to apply to the disk.", "encryptionKey": "encryptionKey is the customer-supplied encryption key of the disk.", + "licenses": "licenses is a list of URLs of license resources attached to this disk. License URLs must match exactly either the full HTTPS URI format (https://www.googleapis.com/compute/v1/projects/{project}/global/licenses/{license}) or the short self-link format (projects/{project}/global/licenses/{license}). Project IDs must use lowercase letters, digits, and hyphens, begin with a letter, end with a lowercase letter or digit, and be 6 to 30 characters long. License names must be RFC1035-style lowercase names that begin with a letter, end with a lowercase letter or digit, contain only lowercase letters, digits, and hyphens, and are at most 63 characters long. Each license URL must be at least 1 character and must not exceed 256 characters. When specified, at least 1 and a maximum of 8 licenses may be provided. When omitted, no additional licenses are applied.", } func (GCPDisk) SwaggerDoc() map[string]string { diff --git a/vendor/github.com/openshift/api/operator/v1/types.go b/vendor/github.com/openshift/api/operator/v1/types.go index 3a2141abb9..599ceb03e1 100644 --- a/vendor/github.com/openshift/api/operator/v1/types.go +++ b/vendor/github.com/openshift/api/operator/v1/types.go @@ -266,6 +266,18 @@ type NodeStatus struct { // +required NodeName string `json:"nodeName"` + // nodeUID is the UID of the node. + // This field is used to detect that a node has been deleted and recreated + // with the same name. When the UID changes, it indicates the node is a + // new instance and the controller should treat this status entry as stale. + // When omitted, UID-based node replacement detection is not available + // for this entry. + // +kubebuilder:validation:MinLength=36 + // +kubebuilder:validation:MaxLength=36 + // +kubebuilder:validation:Format=uuid + // +optional + NodeUID string `json:"nodeUID,omitempty"` + // currentRevision is the generation of the most recently successful deployment. // Can not be set on creation of a nodeStatus. Updates must only increase the value. // +kubebuilder:validation:XValidation:rule="self >= oldSelf",message="must only increase" diff --git a/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go b/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go index a5dcf7d334..51a981b716 100644 --- a/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go +++ b/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go @@ -15,11 +15,10 @@ const ( KMSPluginHealthStatusError KMSPluginHealthStatus = "Error" ) -// +openshift:compatibility-gen:level=1 type KMSPluginHealthReport struct { // nodeName is the name of the node this instance of the plugin runs on. - // The combination of nodeName and keyId makes this health report unique. + // The combination of nodeName and keyID makes this health report unique. // The value must be a valid Kubernetes node name: a lowercase RFC 1123 subdomain // consisting of lowercase alphanumeric characters, '-' or '.', starting and ending with // an alphanumeric character, and be at most 253 characters in length. @@ -29,13 +28,24 @@ type KMSPluginHealthReport struct { // +required NodeName string `json:"nodeName,omitempty"` + // keyID is the encryption-key-secret id (kms-{keyID}.sock), a unique identifier of the plugin on that node. + // This is not a cryptographic key used to encrypt/decrypt any resources. + // The value must be between 1 and 512 characters. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=512 + // +required + KeyID string `json:"keyID,omitempty"` + + // --- TOMBSTONE --- // keyId is the encryption-key-secret id (kms-{keyId}.sock), a unique identifier of the plugin on that node. // This is not a cryptographic key used to encrypt/decrypt any resources. // The value must be between 1 and 512 characters. + // It has been renamed to keyID. + // The field name is reserved to prevent reuse. // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=512 // +required - KeyId string `json:"keyId,omitempty"` + // KeyId string `json:"keyId,omitempty"` // status contains a health indicator for the respective KMS plugin // The field can have three states: healthy, unhealthy, error. @@ -47,13 +57,24 @@ type KMSPluginHealthReport struct { // +required LastCheckedTime metav1.Time `json:"lastCheckedTime,omitempty"` + // remoteKeyID refers to the remote key identifier from KMS v2 StatusResponse.key_id. + // This is not a cryptographic key, but a unique representation of the KEK. + // The value must be between 1 and 1024 characters. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=1024 + // +required + RemoteKeyID string `json:"remoteKeyID,omitempty"` + + // --- TOMBSTONE --- // kekId refers to the remote KEK id from KMS v2 StatusResponse.key_id. // This is not a cryptographic key, but a unique representation of the KEK. // The value must be between 1 and 1024 characters. + // It has been renamed to remoteKeyID. + // The field name is reserved to prevent reuse. // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=1024 // +required - KEKId string `json:"kekId,omitempty"` + // KEKId string `json:"kekId,omitempty"` // detail contains additional error/health information for the respective KMS plugin. // When omitted, no additional error or health information is provided. @@ -69,12 +90,82 @@ type KMSPluginHealthReport struct { type KMSEncryptionStatus struct { // healthReports contains all KMS plugin health reports. // When omitted, no health reports are available. - // Each entry must have a unique combination of nodeName and keyId. + // Each entry must have a unique combination of nodeName and keyID. // +optional // +kubebuilder:validation:MinItems=1 // +kubebuilder:validation:MaxItems=200 // +listType=map // +listMapKey=nodeName - // +listMapKey=keyId + // +listMapKey=keyID HealthReports []KMSPluginHealthReport `json:"healthReports,omitempty"` + + // preflight contains the state of KMS preflight validation for this operator. + // The preflight validates the KMS provider configuration before it is used + // to create a new encryption key, catching configuration issues early such + // as incorrect login credentials or an unreachable Vault service. + // When omitted, no preflight validation is in progress. + // +optional + Preflight KMSPreflightCheck `json:"preflight,omitzero"` +} + +// KMSPreflightCheck describes a preflight validation request and its result. +// +// +kubebuilder:validation:MinProperties=1 +type KMSPreflightCheck struct { + // observedConfigHash is a hash of the KMS provider configuration and + // its referenced resources that has been observed and requires preflight + // validation before a new encryption key can be created. + // The value must be exactly 8 characters. + // +kubebuilder:validation:MinLength=8 + // +kubebuilder:validation:MaxLength=8 + // +kubebuilder:validation:XValidation:rule="self.matches('^[A-Za-z0-9_-]*={0,2}$')",message="must be a valid base64url encoded value" + // +required + ObservedConfigHash string `json:"observedConfigHash,omitempty"` + + // result contains the outcome of the most recent preflight check. + // Preflight is considered passed when result.status is Succeeded and + // result.configHash matches observedConfigHash. + // When omitted, no preflight check result has been reported yet. + // +optional + Result KMSPreflightResult `json:"result,omitzero"` +} + +// +kubebuilder:validation:Enum=Succeeded;Failed +type KMSPreflightResultStatus string + +const ( + KMSPreflightResultSucceeded KMSPreflightResultStatus = "Succeeded" + + KMSPreflightResultFailed KMSPreflightResultStatus = "Failed" +) + +// KMSPreflightResult contains the outcome of a preflight validation. +// +// +openshift:compatibility-gen:level=1 +type KMSPreflightResult struct { + // status indicates the outcome of the preflight check. + // Succeeded means the KMS plugin responded to Status, Encrypt, and + // Decrypt calls successfully. + // Failed means the validation did not pass. + // +required + Status KMSPreflightResultStatus `json:"status,omitempty"` + + // configHash is the hash of the configuration that was validated. + // This is compared against observedConfigHash to confirm the result + // corresponds to the current configuration. + // The value must be exactly 8 characters. + // +kubebuilder:validation:MinLength=8 + // +kubebuilder:validation:MaxLength=8 + // +kubebuilder:validation:XValidation:rule="self.matches('^[A-Za-z0-9_-]*={0,2}$')",message="must be a valid base64url encoded value" + // +required + ConfigHash string `json:"configHash,omitempty"` + + // remoteKeyID is the remote key encryption key identifier from KMS v2 + // StatusResponse.key_id. This is not a cryptographic key, but a unique + // representation of the remote key used to encrypt data. + // The value must be between 1 and 1024 characters. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=1024 + // +required + RemoteKeyID string `json:"remoteKeyID,omitempty"` } diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go index 3c244a9867..8f7441b6c7 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go @@ -2815,6 +2815,7 @@ func (in *KMSEncryptionStatus) DeepCopyInto(out *KMSEncryptionStatus) { (*in)[i].DeepCopyInto(&(*out)[i]) } } + out.Preflight = in.Preflight return } @@ -2845,6 +2846,39 @@ func (in *KMSPluginHealthReport) DeepCopy() *KMSPluginHealthReport { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSPreflightCheck) DeepCopyInto(out *KMSPreflightCheck) { + *out = *in + out.Result = in.Result + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSPreflightCheck. +func (in *KMSPreflightCheck) DeepCopy() *KMSPreflightCheck { + if in == nil { + return nil + } + out := new(KMSPreflightCheck) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSPreflightResult) DeepCopyInto(out *KMSPreflightResult) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSPreflightResult. +func (in *KMSPreflightResult) DeepCopy() *KMSPreflightResult { + if in == nil { + return nil + } + out := new(KMSPreflightResult) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *KubeAPIServer) DeepCopyInto(out *KubeAPIServer) { *out = *in diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go index 271665a7ec..13ab0c5f6f 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go @@ -625,6 +625,16 @@ func (in KMSPluginHealthReport) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.KMSPluginHealthReport" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in KMSPreflightCheck) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.KMSPreflightCheck" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in KMSPreflightResult) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.KMSPreflightResult" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in KubeAPIServer) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.KubeAPIServer" diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go index 114b5c7a68..27e0916168 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go @@ -37,6 +37,7 @@ func (MyOperatorResource) SwaggerDoc() map[string]string { var map_NodeStatus = map[string]string{ "": "NodeStatus provides information about the current state of a particular node managed by this operator.", "nodeName": "nodeName is the name of the node", + "nodeUID": "nodeUID is the UID of the node. This field is used to detect that a node has been deleted and recreated with the same name. When the UID changes, it indicates the node is a new instance and the controller should treat this status entry as stale. When omitted, UID-based node replacement detection is not available for this entry.", "currentRevision": "currentRevision is the generation of the most recently successful deployment. Can not be set on creation of a nodeStatus. Updates must only increase the value.", "targetRevision": "targetRevision is the generation of the deployment we're trying to apply. Can not be set on creation of a nodeStatus.", "lastFailedRevision": "lastFailedRevision is the generation of the deployment we tried and failed to deploy.", @@ -1389,7 +1390,8 @@ func (InsightsReport) SwaggerDoc() map[string]string { } var map_KMSEncryptionStatus = map[string]string{ - "healthReports": "healthReports contains all KMS plugin health reports. When omitted, no health reports are available. Each entry must have a unique combination of nodeName and keyId.", + "healthReports": "healthReports contains all KMS plugin health reports. When omitted, no health reports are available. Each entry must have a unique combination of nodeName and keyID.", + "preflight": "preflight contains the state of KMS preflight validation for this operator. The preflight validates the KMS provider configuration before it is used to create a new encryption key, catching configuration issues early such as incorrect login credentials or an unreachable Vault service. When omitted, no preflight validation is in progress.", } func (KMSEncryptionStatus) SwaggerDoc() map[string]string { @@ -1397,11 +1399,11 @@ func (KMSEncryptionStatus) SwaggerDoc() map[string]string { } var map_KMSPluginHealthReport = map[string]string{ - "nodeName": "nodeName is the name of the node this instance of the plugin runs on. The combination of nodeName and keyId makes this health report unique. The value must be a valid Kubernetes node name: a lowercase RFC 1123 subdomain consisting of lowercase alphanumeric characters, '-' or '.', starting and ending with an alphanumeric character, and be at most 253 characters in length.", - "keyId": "keyId is the encryption-key-secret id (kms-{keyId}.sock), a unique identifier of the plugin on that node. This is not a cryptographic key used to encrypt/decrypt any resources. The value must be between 1 and 512 characters.", + "nodeName": "nodeName is the name of the node this instance of the plugin runs on. The combination of nodeName and keyID makes this health report unique. The value must be a valid Kubernetes node name: a lowercase RFC 1123 subdomain consisting of lowercase alphanumeric characters, '-' or '.', starting and ending with an alphanumeric character, and be at most 253 characters in length.", + "keyID": "keyID is the encryption-key-secret id (kms-{keyID}.sock), a unique identifier of the plugin on that node. This is not a cryptographic key used to encrypt/decrypt any resources. The value must be between 1 and 512 characters.", "status": "status contains a health indicator for the respective KMS plugin The field can have three states: healthy, unhealthy, error. With error and unhealthy containing additional information in Detail.", "lastCheckedTime": "lastCheckedTime is a timestamp of when the probe was last checked.", - "kekId": "kekId refers to the remote KEK id from KMS v2 StatusResponse.key_id. This is not a cryptographic key, but a unique representation of the KEK. The value must be between 1 and 1024 characters.", + "remoteKeyID": "remoteKeyID refers to the remote key identifier from KMS v2 StatusResponse.key_id. This is not a cryptographic key, but a unique representation of the KEK. The value must be between 1 and 1024 characters.", "detail": "detail contains additional error/health information for the respective KMS plugin. When omitted, no additional error or health information is provided. When set, the value must be between 1 and 1024 characters.", } @@ -1409,6 +1411,27 @@ func (KMSPluginHealthReport) SwaggerDoc() map[string]string { return map_KMSPluginHealthReport } +var map_KMSPreflightCheck = map[string]string{ + "": "KMSPreflightCheck describes a preflight validation request and its result.", + "observedConfigHash": "observedConfigHash is a hash of the KMS provider configuration and its referenced resources that has been observed and requires preflight validation before a new encryption key can be created. The value must be exactly 8 characters.", + "result": "result contains the outcome of the most recent preflight check. Preflight is considered passed when result.status is Succeeded and result.configHash matches observedConfigHash. When omitted, no preflight check result has been reported yet.", +} + +func (KMSPreflightCheck) SwaggerDoc() map[string]string { + return map_KMSPreflightCheck +} + +var map_KMSPreflightResult = map[string]string{ + "": "KMSPreflightResult contains the outcome of a preflight validation.", + "status": "status indicates the outcome of the preflight check. Succeeded means the KMS plugin responded to Status, Encrypt, and Decrypt calls successfully. Failed means the validation did not pass.", + "configHash": "configHash is the hash of the configuration that was validated. This is compared against observedConfigHash to confirm the result corresponds to the current configuration. The value must be exactly 8 characters.", + "remoteKeyID": "remoteKeyID is the remote key encryption key identifier from KMS v2 StatusResponse.key_id. This is not a cryptographic key, but a unique representation of the remote key used to encrypt data. The value must be between 1 and 1024 characters.", +} + +func (KMSPreflightResult) SwaggerDoc() map[string]string { + return map_KMSPreflightResult +} + var map_KubeAPIServer = map[string]string{ "": "KubeAPIServer provides information to configure an operator to manage kube-apiserver.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/register.go b/vendor/github.com/openshift/api/operator/v1alpha1/register.go index ec19cba3a9..099f1f7557 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/register.go +++ b/vendor/github.com/openshift/api/operator/v1alpha1/register.go @@ -43,6 +43,8 @@ func addKnownTypes(scheme *runtime.Scheme) error { &ClusterVersionOperatorList{}, &ClusterAPI{}, &ClusterAPIList{}, + &Ingress{}, + &IngressList{}, ) return nil diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/types_ingress.go b/vendor/github.com/openshift/api/operator/v1alpha1/types_ingress.go new file mode 100644 index 0000000000..0dbf9ead8b --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1alpha1/types_ingress.go @@ -0,0 +1,146 @@ +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// +genclient +// +genclient:nonNamespaced +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// Ingress contains configuration options specific to the Ingress Operator itself, +// including how it manages Gateway API integration. +// +// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. +// +openshift:compatibility-gen:level=4 +// +openshift:file-pattern=cvoRunLevel=0000_50,operatorName=ingress,operatorOrdering=02 +// +kubebuilder:object:root=true +// +kubebuilder:resource:path=ingresses,scope=Cluster +// +kubebuilder:subresource:status +// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/2890 +// +openshift:capability=Ingress +// +openshift:enable:FeatureGate=GatewayAPIManagementMode +// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'cluster'",message="Ingress is a singleton; the .metadata.name field must be 'cluster'" +type Ingress struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard object's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + // +required + metav1.ObjectMeta `json:"metadata"` + + // spec holds user settable values for configuration. + // +required + Spec IngressSpec `json:"spec,omitzero"` + + // status holds observed values from the cluster. + // +optional + Status IngressStatus `json:"status,omitzero"` +} + +// IngressSpec is the specification of the desired behavior of the Ingress Operator. +// +kubebuilder:validation:MinProperties=1 +type IngressSpec struct { + // gatewayAPI holds configuration for Gateway API integration, including how the + // ingress operator manages Gateway API CRDs, the OpenShift Gateway API + // implementation, and its Gateway API controllers. + // + // +optional + GatewayAPI GatewayAPIIngressConfig `json:"gatewayAPI,omitzero"` +} + +// IngressStatus defines the observed status of the Ingress Operator. +// +kubebuilder:validation:MinProperties=1 +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.observedGeneration) || (has(self.observedGeneration) && self.observedGeneration >= oldSelf.observedGeneration)",message="observedGeneration must remain set and only increase once set" +type IngressStatus struct { + // conditions is a list of conditions and their status. + // + // Gateway API CRD management conditions are reported here with the "GatewayAPI" prefix: + // + // * "GatewayAPICRDsManaged" indicates whether the ingress operator is actively + // managing Gateway API CRDs. + // * "GatewayAPICRDsPresent" indicates whether Gateway API CRDs exist on the + // cluster. + // * "GatewayAPICRDsCompliant" indicates whether the installed CRDs match the + // version expected by this ingress operator release. + // + // +listType=map + // +listMapKey=type + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=32 + // +optional + Conditions []metav1.Condition `json:"conditions,omitempty"` + + // observedGeneration represents the most recent generation observed by the operator and specifies the version of + // the spec field currently being synced. + // + // When omitted, the operator has not yet observed the resource. + // +optional + // +kubebuilder:validation:Minimum=1 + ObservedGeneration int64 `json:"observedGeneration,omitempty"` +} + +// GatewayAPIIngressConfig holds configuration for Gateway API integration in the +// Cluster Ingress Operator. +// +kubebuilder:validation:MinProperties=1 +type GatewayAPIIngressConfig struct { + // managementMode specifies how the Cluster Ingress Operator manages Gateway API + // Custom Resource Definitions (CRDs), the OpenShift Gateway API implementation, + // and its Gateway API controllers. + // + // Allowed values are "Managed" and "Unmanaged". + // + // When omitted or set to "Managed", the ingress operator installs, owns, and + // upgrades the Gateway API CRDs, protects them with a Validating Admission + // Policy, and deploys the OpenShift Gateway API implementation and its Gateway + // API controllers. + // + // When set to "Unmanaged", the ingress operator does not install or manage + // Gateway API CRDs and does not deploy the OpenShift Gateway API implementation + // or its Gateway API controllers. The cluster administrator or a third-party + // product is responsible for providing their own CRDs and Gateway controller. + // The ingress operator reports observational status only. + // + // +optional + ManagementMode GatewayAPIManagementMode `json:"managementMode,omitempty"` +} + +// GatewayAPIManagementMode describes how the Cluster Ingress Operator manages +// Gateway API Custom Resource Definitions. +// +kubebuilder:validation:Enum=Managed;Unmanaged +type GatewayAPIManagementMode string + +const ( + // GatewayAPIManagementModeManaged means the ingress operator installs, owns, + // protects (via a Validating Admission Policy), and upgrades the Gateway API + // CRDs, deploys the OpenShift Gateway API implementation, and runs its Gateway + // API controllers. This is the default mode and the only fully supported + // configuration. + GatewayAPIManagementModeManaged GatewayAPIManagementMode = "Managed" + + // GatewayAPIManagementModeUnmanaged means the ingress operator does not + // install or manage Gateway API CRDs, does not deploy the OpenShift Gateway + // API implementation, and does not run its Gateway API controllers. The + // cluster administrator or a third-party product is responsible for bringing + // their own CRDs and Gateway controller. The ingress operator reports + // observational status only. + GatewayAPIManagementModeUnmanaged GatewayAPIManagementMode = "Unmanaged" +) + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// IngressList is a collection of Ingresses. +// +// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. +// +openshift:compatibility-gen:level=4 +type IngressList struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard list's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + metav1.ListMeta `json:"metadata"` + + // items is a list of Ingresses. + // +optional + Items []Ingress `json:"items,omitempty"` +} diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go index 3c3dc8e7a5..4d864f167e 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.deepcopy.go @@ -469,6 +469,22 @@ func (in *EtcdBackupStatus) DeepCopy() *EtcdBackupStatus { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *GatewayAPIIngressConfig) DeepCopyInto(out *GatewayAPIIngressConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GatewayAPIIngressConfig. +func (in *GatewayAPIIngressConfig) DeepCopy() *GatewayAPIIngressConfig { + if in == nil { + return nil + } + out := new(GatewayAPIIngressConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *GenerationHistory) DeepCopyInto(out *GenerationHistory) { *out = *in @@ -597,6 +613,107 @@ func (in *ImageContentSourcePolicySpec) DeepCopy() *ImageContentSourcePolicySpec return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Ingress) DeepCopyInto(out *Ingress) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + out.Spec = in.Spec + in.Status.DeepCopyInto(&out.Status) + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Ingress. +func (in *Ingress) DeepCopy() *Ingress { + if in == nil { + return nil + } + out := new(Ingress) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *Ingress) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IngressList) DeepCopyInto(out *IngressList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]Ingress, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressList. +func (in *IngressList) DeepCopy() *IngressList { + if in == nil { + return nil + } + out := new(IngressList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *IngressList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IngressSpec) DeepCopyInto(out *IngressSpec) { + *out = *in + out.GatewayAPI = in.GatewayAPI + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressSpec. +func (in *IngressSpec) DeepCopy() *IngressSpec { + if in == nil { + return nil + } + out := new(IngressSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IngressStatus) DeepCopyInto(out *IngressStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]v1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressStatus. +func (in *IngressStatus) DeepCopy() *IngressStatus { + if in == nil { + return nil + } + out := new(IngressStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *LoggingConfig) DeepCopyInto(out *LoggingConfig) { *out = *in diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.featuregated-crd-manifests.yaml index 3ad442d9d8..bb0d1025d4 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.featuregated-crd-manifests.yaml @@ -90,6 +90,29 @@ imagecontentsourcepolicies.operator.openshift.io: TopLevelFeatureGates: [] Version: v1alpha1 +ingresses.operator.openshift.io: + Annotations: {} + ApprovedPRNumber: https://github.com/openshift/api/pull/2890 + CRDName: ingresses.operator.openshift.io + Capability: Ingress + Category: "" + FeatureGates: + - GatewayAPIManagementMode + FilenameOperatorName: ingress + FilenameOperatorOrdering: "02" + FilenameRunLevel: "0000_50" + GroupName: operator.openshift.io + HasStatus: true + KindName: Ingress + Labels: {} + PluralName: ingresses + PrinterColumns: [] + Scope: Cluster + ShortNames: null + TopLevelFeatureGates: + - GatewayAPIManagementMode + Version: v1alpha1 + olms.operator.openshift.io: Annotations: include.release.openshift.io/ibm-cloud-managed: "false" diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.model_name.go b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.model_name.go index e3fe9897dd..cd4dbe030a 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.model_name.go +++ b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.model_name.go @@ -105,6 +105,11 @@ func (in EtcdBackupStatus) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1alpha1.EtcdBackupStatus" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in GatewayAPIIngressConfig) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1alpha1.GatewayAPIIngressConfig" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in GenerationHistory) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1alpha1.GenerationHistory" @@ -130,6 +135,26 @@ func (in ImageContentSourcePolicySpec) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1alpha1.ImageContentSourcePolicySpec" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in Ingress) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1alpha1.Ingress" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in IngressList) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1alpha1.IngressList" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in IngressSpec) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1alpha1.IngressSpec" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in IngressStatus) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1alpha1.IngressStatus" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in LoggingConfig) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1alpha1.LoggingConfig" diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go index bf4117768d..57a7d19669 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go @@ -351,6 +351,55 @@ func (RepositoryDigestMirrors) SwaggerDoc() map[string]string { return map_RepositoryDigestMirrors } +var map_GatewayAPIIngressConfig = map[string]string{ + "": "GatewayAPIIngressConfig holds configuration for Gateway API integration in the Cluster Ingress Operator.", + "managementMode": "managementMode specifies how the Cluster Ingress Operator manages Gateway API Custom Resource Definitions (CRDs), the OpenShift Gateway API implementation, and its Gateway API controllers.\n\nAllowed values are \"Managed\" and \"Unmanaged\".\n\nWhen omitted or set to \"Managed\", the ingress operator installs, owns, and upgrades the Gateway API CRDs, protects them with a Validating Admission Policy, and deploys the OpenShift Gateway API implementation and its Gateway API controllers.\n\nWhen set to \"Unmanaged\", the ingress operator does not install or manage Gateway API CRDs and does not deploy the OpenShift Gateway API implementation or its Gateway API controllers. The cluster administrator or a third-party product is responsible for providing their own CRDs and Gateway controller. The ingress operator reports observational status only.", +} + +func (GatewayAPIIngressConfig) SwaggerDoc() map[string]string { + return map_GatewayAPIIngressConfig +} + +var map_Ingress = map[string]string{ + "": "Ingress contains configuration options specific to the Ingress Operator itself, including how it manages Gateway API integration.\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", + "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "spec": "spec holds user settable values for configuration.", + "status": "status holds observed values from the cluster.", +} + +func (Ingress) SwaggerDoc() map[string]string { + return map_Ingress +} + +var map_IngressList = map[string]string{ + "": "IngressList is a collection of Ingresses.\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", + "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "items": "items is a list of Ingresses.", +} + +func (IngressList) SwaggerDoc() map[string]string { + return map_IngressList +} + +var map_IngressSpec = map[string]string{ + "": "IngressSpec is the specification of the desired behavior of the Ingress Operator.", + "gatewayAPI": "gatewayAPI holds configuration for Gateway API integration, including how the ingress operator manages Gateway API CRDs, the OpenShift Gateway API implementation, and its Gateway API controllers.", +} + +func (IngressSpec) SwaggerDoc() map[string]string { + return map_IngressSpec +} + +var map_IngressStatus = map[string]string{ + "": "IngressStatus defines the observed status of the Ingress Operator.", + "conditions": "conditions is a list of conditions and their status.\n\nGateway API CRD management conditions are reported here with the \"GatewayAPI\" prefix:\n\n* \"GatewayAPICRDsManaged\" indicates whether the ingress operator is actively\n managing Gateway API CRDs.\n* \"GatewayAPICRDsPresent\" indicates whether Gateway API CRDs exist on the\n cluster.\n* \"GatewayAPICRDsCompliant\" indicates whether the installed CRDs match the\n version expected by this ingress operator release.", + "observedGeneration": "observedGeneration represents the most recent generation observed by the operator and specifies the version of the spec field currently being synced.\n\nWhen omitted, the operator has not yet observed the resource.", +} + +func (IngressStatus) SwaggerDoc() map[string]string { + return map_IngressStatus +} + var map_OLM = map[string]string{ "": "OLM provides information to configure an operator to manage the OLM controllers\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", diff --git a/vendor/github.com/openshift/api/route/v1/generated.proto b/vendor/github.com/openshift/api/route/v1/generated.proto index 85018b16b7..28f8c311ee 100644 --- a/vendor/github.com/openshift/api/route/v1/generated.proto +++ b/vendor/github.com/openshift/api/route/v1/generated.proto @@ -411,7 +411,7 @@ message RouterShard { // TLSConfig defines config used to secure a route and provide termination // // +kubebuilder:validation:XValidation:rule="has(self.termination) && has(self.insecureEdgeTerminationPolicy) ? !((self.termination=='passthrough') && (self.insecureEdgeTerminationPolicy=='Allow')) : true", message="cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=RouteExternalCertificate,rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate" +// +kubebuilder:validation:XValidation:rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate" message TLSConfig { // termination indicates the TLS termination type. // @@ -464,7 +464,6 @@ message TLSConfig { // The router service account needs to be granted with read-only access to this secret, // please refer to openshift docs for additional details. // - // +openshift:enable:FeatureGate=RouteExternalCertificate // +optional optional LocalObjectReference externalCertificate = 7; } diff --git a/vendor/github.com/openshift/api/route/v1/types.go b/vendor/github.com/openshift/api/route/v1/types.go index 35c4064825..41f362fdf4 100644 --- a/vendor/github.com/openshift/api/route/v1/types.go +++ b/vendor/github.com/openshift/api/route/v1/types.go @@ -422,7 +422,7 @@ type RouterShard struct { // TLSConfig defines config used to secure a route and provide termination // // +kubebuilder:validation:XValidation:rule="has(self.termination) && has(self.insecureEdgeTerminationPolicy) ? !((self.termination=='passthrough') && (self.insecureEdgeTerminationPolicy=='Allow')) : true", message="cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=RouteExternalCertificate,rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate" +// +kubebuilder:validation:XValidation:rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate" type TLSConfig struct { // termination indicates the TLS termination type. // @@ -475,7 +475,6 @@ type TLSConfig struct { // The router service account needs to be granted with read-only access to this secret, // please refer to openshift docs for additional details. // - // +openshift:enable:FeatureGate=RouteExternalCertificate // +optional ExternalCertificate *LocalObjectReference `json:"externalCertificate,omitempty" protobuf:"bytes,7,opt,name=externalCertificate"` } diff --git a/vendor/github.com/openshift/api/route/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/route/v1/zz_generated.featuregated-crd-manifests.yaml index 0277ba2f32..33666eba4b 100644 --- a/vendor/github.com/openshift/api/route/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/route/v1/zz_generated.featuregated-crd-manifests.yaml @@ -4,8 +4,7 @@ routes.route.openshift.io: CRDName: routes.route.openshift.io Capability: "" Category: "" - FeatureGates: - - RouteExternalCertificate + FeatureGates: [] FilenameOperatorName: "" FilenameOperatorOrdering: "" FilenameRunLevel: "" diff --git a/vendor/modules.txt b/vendor/modules.txt index 5261291068..1d7f23162c 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1022,7 +1022,7 @@ github.com/openshift-eng/openshift-tests-extension/pkg/ginkgo github.com/openshift-eng/openshift-tests-extension/pkg/junit github.com/openshift-eng/openshift-tests-extension/pkg/util/sets github.com/openshift-eng/openshift-tests-extension/pkg/version -# github.com/openshift/api v0.0.0-20260715165912-72066cc9718b +# github.com/openshift/api v0.0.0-20260715165912-72066cc9718b => github.com/redhat-chai-bot/api v0.0.0-20260912110502-b75db3fbbc59 ## explicit; go 1.26.0 github.com/openshift/api github.com/openshift/api/annotations @@ -4512,6 +4512,7 @@ sigs.k8s.io/structured-merge-diff/v6/value sigs.k8s.io/yaml sigs.k8s.io/yaml/kyaml # github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20260424201627-4d4cc33d669d +# github.com/openshift/api => github.com/redhat-chai-bot/api v0.0.0-20260912110502-b75db3fbbc59 # k8s.io/apiserver => github.com/openshift/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20260716191900-78acd4d422b2 # k8s.io/cri-streaming => github.com/openshift/kubernetes/staging/src/k8s.io/cri-streaming v0.0.0-20260716191900-78acd4d422b2 # k8s.io/endpointslice => github.com/openshift/kubernetes/staging/src/k8s.io/endpointslice v0.0.0-20260716191900-78acd4d422b2