github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-25 16:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
7542ebda5e5cb180af2d7dffce1256cef032ec41
capsule/charts/capsule/values.schema.json
T
Oliver Bähler 3c1c5f2039 feat: kubernetes bump and helm improvements (#1634) 
* feat(helm): add label and annotation vaules

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: remove harpoon from workflows

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* feat(helm): extend podlabels to crd jobs

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* feat: bump kubernetes 1.34

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* feat(helm): extend podlabels to crd jobs

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* feat(helm): extend podlabels to crd jobs

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* feat: bump kubernetes 1.34

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

---------

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
2025-09-04 12:21:05 +02:00

1371 lines
74 KiB
JSON
Raw Blame History

{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"properties": {
"affinity": {
"description": "Set affinity rules for the Capsule pod",
"type": "object"
},
"certManager": {
"type": "object",
"properties": {
"additionalSANS": {
"description": "Specify additional SANS to add to the certificate",
"type": "array"
},
"generateCertificates": {
"description": "Specifies whether capsule webhooks certificates should be generated using cert-manager",
"type": "boolean"
}
}
},
"crds": {
"type": "object",
"properties": {
"annnotations": {
"description": "Extra Annotations for CRDs",
"type": "object"
},
"exclusive": {
"description": "Only install the CRDs, no other primitives",
"type": "boolean"
},
"install": {
"description": "Install the CustomResourceDefinitions (This also manages the lifecycle of the CRDs for update operations)",
"type": "boolean"
},
"labels": {
"description": "Extra Labels for CRDs",
"type": "object"
}
}
},
"customAnnotations": {
"description": "Additional annotations which will be added to all resources created by Capsule helm chart",
"type": "object"
},
"customLabels": {
"description": "Additional labels which will be added to all resources created by Capsule helm chart",
"type": "object"
},
"global": {
"type": "object",
"properties": {
"jobs": {
"type": "object",
"properties": {
"kubectl": {
"type": "object",
"properties": {
"affinity": {
"description": "Set affinity rules",
"type": "object"
},
"annotations": {
"description": "Annotations to add to the job.",
"type": "object"
},
"backoffLimit": {
"description": "Backofflimit for jobs",
"type": "integer"
},
"image": {
"type": "object",
"properties": {
"pullPolicy": {
"description": "Set the image pull policy of the helm chart job",
"type": "string"
},
"registry": {
"description": "Set the image repository of the helm chart job",
"type": "string"
},
"repository": {
"description": "Set the image repository of the helm chart job",
"type": "string"
},
"tag": {
"description": "Set the image tag of the helm chart job",
"type": "string"
}
}
},
"imagePullSecrets": {
"description": "ImagePullSecrets",
"type": "array"
},
"labels": {
"description": "Labels to add to the job.",
"type": "object"
},
"nodeSelector": {
"description": "Set the node selector",
"type": "object"
},
"podAnnotations": {
"description": "Annotations to add to the job pod",
"type": "object"
},
"podLabels": {
"description": "Labels to add to the job pod",
"type": "object"
},
"podSecurityContext": {
"description": "Security context for the job pods.",
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"seccompProfile": {
"type": "object",
"properties": {
"type": {
"type": "string"
}
}
}
}
},
"priorityClassName": {
"description": "Set a pod priorityClassName",
"type": "string"
},
"resources": {
"description": "Job resources",
"type": "object"
},
"restartPolicy": {
"description": "Set the restartPolicy",
"type": "string"
},
"securityContext": {
"description": "Security context for the job containers.",
"type": "object",
"properties": {
"allowPrivilegeEscalation": {
"type": "boolean"
},
"capabilities": {
"type": "object",
"properties": {
"drop": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"enabled": {
"type": "boolean"
},
"readOnlyRootFilesystem": {
"type": "boolean"
},
"runAsGroup": {
"type": "integer"
},
"runAsNonRoot": {
"type": "boolean"
},
"runAsUser": {
"type": "integer"
}
}
},
"tolerations": {
"description": "Set list of tolerations",
"type": "array"
},
"topologySpreadConstraints": {
"description": "Set Topology Spread Constraints",
"type": "array"
},
"ttlSecondsAfterFinished": {
"description": "Sets the ttl in seconds after a finished certgen job is deleted. Set to -1 to never delete.",
"type": "integer"
}
}
}
}
}
}
},
"imagePullSecrets": {
"description": "Configuration for `imagePullSecrets` so that you can use a private images registry.",
"type": "array"
},
"jobs": {
"description": "Deprecated, use .global.jobs.kubectl instead",
"type": "object"
},
"manager": {
"type": "object",
"properties": {
"daemonsetStrategy": {
"description": "[Daemonset Strategy](https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/#creating-a-daemonset-with-rollingupdate-update-strategy)",
"type": "object",
"properties": {
"type": {
"type": "string"
}
}
},
"deploymentStrategy": {
"description": "[Deployment Strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy)",
"type": "object",
"properties": {
"type": {
"type": "string"
}
}
},
"env": {
"description": "Additional Environment Variables",
"type": "array"
},
"extraArgs": {
"description": "A list of extra arguments for the capsule controller",
"type": "array",
"items": {
"type": "string"
}
},
"hostNetwork": {
"description": "Specifies if the container should be started in hostNetwork mode. Required for use in some managed kubernetes clusters (such as AWS EKS) with custom CNI (such as calico), because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working",
"type": "boolean"
},
"hostPID": {
"description": "Specifies if the container should be started in hostPID mode.",
"type": "boolean"
},
"hostUsers": {
"description": "Don't use Host Users (User Namespaces)",
"type": "boolean"
},
"image": {
"type": "object",
"properties": {
"pullPolicy": {
"description": "Set the image pull policy.",
"type": "string"
},
"registry": {
"description": "Set the image registry of capsule.",
"type": "string"
},
"repository": {
"description": "Set the image repository of capsule.",
"type": "string"
},
"tag": {
"description": "Overrides the image tag whose default is the chart appVersion.",
"type": "string"
}
}
},
"kind": {
"description": "Set the controller deployment mode as `Deployment` or `DaemonSet`.",
"type": "string"
},
"livenessProbe": {
"description": "Configure the liveness probe using Deployment probe spec",
"type": "object",
"properties": {
"httpGet": {
"type": "object",
"properties": {
"path": {
"type": "string"
},
"port": {
"type": "integer"
}
}
}
}
},
"options": {
"type": "object",
"properties": {
"capsuleConfiguration": {
"description": "Change the default name of the capsule configuration name",
"type": "string"
},
"capsuleUserGroups": {
"description": "Names of the groups considered as Capsule users.",
"type": "array",
"items": {
"type": "string"
}
},
"forceTenantPrefix": {
"description": "Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash",
"type": "boolean"
},
"generateCertificates": {
"description": "Specifies whether capsule webhooks certificates should be generated by capsule operator",
"type": "boolean"
},
"ignoreUserWithGroups": {
"description": "Define groups which when found in the request of a user will be ignored by the Capsule this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups.",
"type": "array"
},
"logLevel": {
"description": "Set the log verbosity of the capsule with a value from 1 to 10",
"type": "string"
},
"nodeMetadata": {
"description": "Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant",
"type": "object",
"properties": {
"forbiddenAnnotations": {
"type": "object",
"properties": {
"denied": {
"type": "array"
},
"deniedRegex": {
"type": "string"
}
}
},
"forbiddenLabels": {
"type": "object",
"properties": {
"denied": {
"type": "array"
},
"deniedRegex": {
"type": "string"
}
}
}
}
},
"protectedNamespaceRegex": {
"description": "If specified, disallows creation of namespaces matching the passed regexp",
"type": "string"
},
"userNames": {
"description": "Names of the users considered as Capsule users.",
"type": "array"
}
}
},
"rbac": {
"type": "object",
"properties": {
"create": {
"description": "Specifies whether RBAC resources should be created.",
"type": "boolean"
},
"existingClusterRoles": {
"description": "Specifies further cluster roles to be added to the Capsule manager service account.",
"type": "array"
},
"existingRoles": {
"description": "Specifies further cluster roles to be added to the Capsule manager service account.",
"type": "array"
}
}
},
"readinessProbe": {
"description": "Configure the readiness probe using Deployment probe spec",
"type": "object",
"properties": {
"httpGet": {
"type": "object",
"properties": {
"path": {
"type": "string"
},
"port": {
"type": "integer"
}
}
}
}
},
"resources": {
"description": "Set the resource requests/limits for the Capsule manager container",
"type": "object"
},
"securityContext": {
"description": "Set the securityContext for the Capsule container",
"type": "object"
},
"volumeMounts": {
"description": "Set the additional volumeMounts needed for the Capsule manager container",
"type": "array"
},
"volumes": {
"description": "Set the additional volumes needed for the Capsule manager container",
"type": "array"
},
"webhookPort": {
"description": "Set an alternative to the default container port. Useful for use in some kubernetes clusters (such as GKE Private) with aggregator routing turned on, because pod ports have to be opened manually on the firewall side",
"type": "integer"
}
}
},
"monitoring": {
"type": "object",
"properties": {
"dashboards": {
"type": "object",
"properties": {
"annotations": {
"description": "Annotations for dashboard configmaps",
"type": "object"
},
"enabled": {
"description": "Enable Dashboards to be deployed",
"type": "boolean"
},
"labels": {
"description": "Labels for dashboard configmaps",
"type": "object"
},
"namespace": {
"description": "Custom namespace for dashboard configmaps",
"type": "string"
},
"operator": {
"type": "object",
"properties": {
"allowCrossNamespaceImport": {
"description": "Allow the Operator to match this resource with Grafanas outside the current namespace",
"type": "boolean"
},
"enabled": {
"description": "Enable Operator Resources (GrafanaDashboard)",
"type": "boolean"
},
"folder": {
"description": "folder assignment for dashboard",
"type": "string"
},
"instanceSelector": {
"description": "Selects Grafana instances for import",
"type": "object"
},
"resyncPeriod": {
"description": "How often the resource is synced, defaults to 10m0s if not set",
"type": "string"
}
}
}
}
},
"serviceMonitor": {
"type": "object",
"properties": {
"annotations": {
"description": "Assign additional Annotations",
"type": "object"
},
"enabled": {
"description": "Enable ServiceMonitor",
"type": "boolean"
},
"endpoint": {
"type": "object",
"properties": {
"interval": {
"description": "Set the scrape interval for the endpoint of the serviceMonitor",
"type": "string"
},
"metricRelabelings": {
"description": "Set metricRelabelings for the endpoint of the serviceMonitor",
"type": "array"
},
"relabelings": {
"description": "Set relabelings for the endpoint of the serviceMonitor",
"type": "array"
},
"scrapeTimeout": {
"description": "Set the scrape timeout for the endpoint of the serviceMonitor",
"type": "string"
}
}
},
"labels": {
"description": "Assign additional labels according to Prometheus' serviceMonitorSelector matching labels",
"type": "object"
},
"matchLabels": {
"description": "Change matching labels",
"type": "object"
},
"namespace": {
"description": "Install the ServiceMonitor into a different Namespace, as the monitoring stack one (default: the release one)",
"type": "string"
},
"targetLabels": {
"description": "Set targetLabels for the serviceMonitor",
"type": "array"
}
}
}
}
},
"nodeSelector": {
"description": "Set the node selector for the Capsule pod",
"type": "object"
},
"podAnnotations": {
"description": "Annotations to add to the capsule pod.",
"type": "object"
},
"podLabels": {
"description": "Labels to add to the capsule pod.",
"type": "object"
},
"podSecurityContext": {
"description": "Set the securityContext for the Capsule pod",
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"runAsGroup": {
"type": "integer"
},
"runAsNonRoot": {
"type": "boolean"
},
"runAsUser": {
"type": "integer"
},
"seccompProfile": {
"type": "object",
"properties": {
"type": {
"type": "string"
}
}
}
}
},
"ports": {
"description": "Set additional ports for the deployment",
"type": "array"
},
"priorityClassName": {
"description": "Set the priority class name of the Capsule pod",
"type": "string"
},
"proxy": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable Installation of Capsule Proxy",
"type": "boolean"
}
}
},
"rbac": {
"type": "object",
"properties": {
"resourcepoolclaims": {
"type": "object",
"properties": {
"create": {
"type": "boolean"
},
"labels": {
"type": "object",
"properties": {
"rbac.authorization.k8s.io/aggregate-to-admin": {
"type": "string"
}
}
}
}
},
"resources": {
"type": "object",
"properties": {
"create": {
"type": "boolean"
},
"labels": {
"type": "object",
"properties": {
"rbac.authorization.k8s.io/aggregate-to-admin": {
"type": "string"
}
}
}
}
}
}
},
"replicaCount": {
"description": "Set the replica count for capsule pod",
"type": "integer"
},
"securityContext": {
"description": "Set the securityContext for the Capsule container",
"type": "object",
"properties": {
"allowPrivilegeEscalation": {
"type": "boolean"
},
"capabilities": {
"type": "object",
"properties": {
"drop": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"enabled": {
"type": "boolean"
},
"readOnlyRootFilesystem": {
"type": "boolean"
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
"annotations": {
"description": "Annotations to add to the service account.",
"type": "object"
},
"create": {
"description": "Specifies whether a service account should be created.",
"type": "boolean"
},
"name": {
"description": "The name of the service account to use. If not set and `serviceAccount.create=true`, a name is generated using the fullname template",
"type": "string"
}
}
},
"tls": {
"type": "object",
"properties": {
"create": {
"description": "When cert-manager is disabled, Capsule will generate the TLS certificate for webhook and CRDs conversion.",
"type": "boolean"
},
"enableController": {
"description": "Start the Capsule controller that injects the CA into mutating and validating webhooks, and CRD as well.",
"type": "boolean"
},
"name": {
"description": "Override name of the Capsule TLS Secret name when externally managed.",
"type": "string"
}
}
},
"tolerations": {
"description": "Set list of tolerations for the Capsule pod",
"type": "array"
},
"topologySpreadConstraints": {
"description": "Set topology spread constraints for the Capsule pod",
"type": "array"
},
"webhooks": {
"type": "object",
"properties": {
"exclusive": {
"description": "When `crds.exclusive` is `true` the webhooks will be installed",
"type": "boolean"
},
"hooks": {
"type": "object",
"properties": {
"cordoning": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object",
"properties": {
"matchExpressions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"operator": {
"type": "string"
}
}
}
}
}
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
},
"rules": {
"description": "[Rules](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-rules)",
"type": "array",
"items": {
"type": "object",
"properties": {
"apiGroups": {
"type": "array",
"items": {
"type": "string"
}
},
"apiVersions": {
"type": "array",
"items": {
"type": "string"
}
},
"operations": {
"type": "array",
"items": {
"type": "string"
}
},
"resources": {
"type": "array",
"items": {
"type": "string"
}
},
"scope": {
"type": "string"
}
}
}
}
}
},
"customresources": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object",
"properties": {
"matchExpressions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"operator": {
"type": "string"
}
}
}
}
}
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
}
}
},
"defaults": {
"type": "object",
"properties": {
"ingress": {
"description": "Deprecated, use webhooks.hooks.ingresses instead",
"type": "object"
},
"pods": {
"description": "Deprecated, use webhooks.hooks.pods instead",
"type": "object"
},
"pvc": {
"description": "Deprecated, use webhooks.hooks.persistentvolumeclaims instead",
"type": "object"
}
}
},
"gateways": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object",
"properties": {
"matchExpressions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"operator": {
"type": "string"
}
}
}
}
}
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
}
}
},
"ingresses": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object",
"properties": {
"matchExpressions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"operator": {
"type": "string"
}
}
}
}
}
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
},
"reinvocationPolicy": {
"description": "[ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)",
"type": "string"
}
}
},
"namespaceOwnerReference": {
"description": "Deprecated, use webhooks.hooks.namespaces instead",
"type": "object"
},
"namespaces": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object"
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
},
"reinvocationPolicy": {
"description": "[ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)",
"type": "string"
}
}
},
"networkpolicies": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object",
"properties": {
"matchExpressions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"operator": {
"type": "string"
}
}
}
}
}
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
}
}
},
"nodes": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object"
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
}
}
},
"persistentvolumeclaims": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object",
"properties": {
"matchExpressions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"operator": {
"type": "string"
}
}
}
}
}
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
},
"reinvocationPolicy": {
"description": "[ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)",
"type": "string"
}
}
},
"pods": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object",
"properties": {
"matchExpressions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"operator": {
"type": "string"
}
}
}
}
}
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
},
"reinvocationPolicy": {
"description": "[ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)",
"type": "string"
}
}
},
"resourcepools": {
"type": "object",
"properties": {
"claims": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object"
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
}
}
},
"pools": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object"
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
}
}
}
}
},
"services": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object",
"properties": {
"matchExpressions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"operator": {
"type": "string"
}
}
}
}
}
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
}
}
},
"tenantResourceObjects": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object",
"properties": {
"matchExpressions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"operator": {
"type": "string"
}
}
}
}
}
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object",
"properties": {
"matchExpressions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"operator": {
"type": "string"
}
}
}
}
}
}
}
},
"tenants": {
"type": "object",
"properties": {
"enabled": {
"description": "Enable the Hook",
"type": "boolean"
},
"failurePolicy": {
"description": "[FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)",
"type": "string"
},
"matchConditions": {
"description": "[MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "array"
},
"matchPolicy": {
"description": "[MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)",
"type": "string"
},
"namespaceSelector": {
"description": "[NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)",
"type": "object"
},
"objectSelector": {
"description": "[ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)",
"type": "object"
}
}
}
}
},
"mutatingWebhooksTimeoutSeconds": {
"description": "Timeout in seconds for mutating webhooks",
"type": "integer"
},
"service": {
"type": "object",
"properties": {
"caBundle": {
"description": "CABundle for the webhook service",
"type": "string"
},
"name": {
"description": "Custom service name for the webhook service",
"type": "string"
},
"namespace": {
"description": "Custom service namespace for the webhook service",
"type": "string"
},
"port": {
"description": "Custom service port for the webhook service",
"type": "null"
},
"url": {
"description": "The URL where the capsule webhook services are running (Overwrites cluster scoped service definition)",
"type": "string"
}
}
},
"validatingWebhooksTimeoutSeconds": {
"description": "Timeout in seconds for validating webhooks",
"type": "integer"
}
}
}
}
}
Reference in New Issue View Git Blame Copy Permalink