mirror of
https://github.com/clastix/kamaji.git
synced 2026-02-14 18:10:03 +00:00
1052 lines
43 KiB
YAML
1052 lines
43 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
labels:
|
|
control-plane: controller-manager
|
|
name: kamaji-system
|
|
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.6.1
|
|
creationTimestamp: null
|
|
name: tenantcontrolplanes.kamaji.clastix.io
|
|
spec:
|
|
group: kamaji.clastix.io
|
|
names:
|
|
kind: TenantControlPlane
|
|
listKind: TenantControlPlaneList
|
|
plural: tenantcontrolplanes
|
|
shortNames:
|
|
- tcp
|
|
singular: tenantcontrolplane
|
|
scope: Namespaced
|
|
versions:
|
|
- additionalPrinterColumns:
|
|
- description: Kubernetes version
|
|
jsonPath: .spec.kubernetes.version
|
|
name: Version
|
|
type: string
|
|
- description: Kubernetes version
|
|
jsonPath: .status.kubernetesResources.version.status
|
|
name: Status
|
|
type: string
|
|
- description: Tenant Control Plane Endpoint (API server)
|
|
jsonPath: .status.controlPlaneEndpoint
|
|
name: Control-Plane-Endpoint
|
|
type: string
|
|
- description: Secret which contains admin kubeconfig
|
|
jsonPath: .status.kubeconfig.admin.secretName
|
|
name: Kubeconfig
|
|
type: string
|
|
- description: Age
|
|
jsonPath: .metadata.creationTimestamp
|
|
name: Age
|
|
type: date
|
|
name: v1alpha1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: TenantControlPlane is the Schema for the tenantcontrolplanes API.
|
|
properties:
|
|
apiVersion:
|
|
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
type: string
|
|
kind:
|
|
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: TenantControlPlaneSpec defines the desired state of TenantControlPlane.
|
|
properties:
|
|
controlPlane:
|
|
description: ControlPlane defines how the Tenant Control Plane Kubernetes resources must be created in the Admin Cluster, such as the number of Pod replicas, the Service resource, or the Ingress.
|
|
properties:
|
|
deployment:
|
|
description: Defining the options for the deployed Tenant Control Plane as Deployment resource.
|
|
properties:
|
|
additionalMetadata:
|
|
description: AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.
|
|
properties:
|
|
annotations:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
labels:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
replicas:
|
|
default: 2
|
|
format: int32
|
|
type: integer
|
|
type: object
|
|
ingress:
|
|
description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane
|
|
properties:
|
|
additionalMetadata:
|
|
description: AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.
|
|
properties:
|
|
annotations:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
labels:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
enabled:
|
|
type: boolean
|
|
hostname:
|
|
description: Hostname is an optional field which will be used as Ingress's Host. If it is not defined, Ingress's host will be "<tenant>.<namespace>.<domain>", where domain is specified under NetworkProfileSpec
|
|
type: string
|
|
ingressClassName:
|
|
type: string
|
|
required:
|
|
- enabled
|
|
type: object
|
|
service:
|
|
description: Defining the options for the Tenant Control Plane Service resource.
|
|
properties:
|
|
additionalMetadata:
|
|
description: AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.
|
|
properties:
|
|
annotations:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
labels:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
serviceType:
|
|
description: ServiceType allows specifying how to expose the Tenant Control Plane.
|
|
enum:
|
|
- ClusterIP
|
|
- NodePort
|
|
- LoadBalancer
|
|
type: string
|
|
required:
|
|
- serviceType
|
|
type: object
|
|
required:
|
|
- service
|
|
type: object
|
|
kubernetes:
|
|
description: Kubernetes specification for tenant control plane
|
|
properties:
|
|
admissionControllers:
|
|
default:
|
|
- CertificateApproval
|
|
- CertificateSigning
|
|
- CertificateSubjectRestriction
|
|
- DefaultIngressClass
|
|
- DefaultStorageClass
|
|
- DefaultTolerationSeconds
|
|
- LimitRanger
|
|
- MutatingAdmissionWebhook
|
|
- NamespaceLifecycle
|
|
- PersistentVolumeClaimResize
|
|
- Priority
|
|
- ResourceQuota
|
|
- RuntimeClass
|
|
- ServiceAccount
|
|
- StorageObjectInUseProtection
|
|
- TaintNodesByCondition
|
|
- ValidatingAdmissionWebhook
|
|
description: 'List of enabled Admission Controllers for the Tenant cluster. Full reference available here: https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers'
|
|
items:
|
|
enum:
|
|
- AlwaysAdmit
|
|
- AlwaysDeny
|
|
- AlwaysPullImages
|
|
- CertificateApproval
|
|
- CertificateSigning
|
|
- CertificateSubjectRestriction
|
|
- DefaultIngressClass
|
|
- DefaultStorageClass
|
|
- DefaultTolerationSeconds
|
|
- DenyEscalatingExec
|
|
- DenyExecOnPrivileged
|
|
- DenyServiceExternalIPs
|
|
- EventRateLimit
|
|
- ExtendedResourceToleration
|
|
- ImagePolicyWebhook
|
|
- LimitPodHardAntiAffinityTopology
|
|
- LimitRanger
|
|
- MutatingAdmissionWebhook
|
|
- NamespaceAutoProvision
|
|
- NamespaceExists
|
|
- NamespaceLifecycle
|
|
- NodeRestriction
|
|
- OwnerReferencesPermissionEnforcement
|
|
- PersistentVolumeClaimResize
|
|
- PersistentVolumeLabel
|
|
- PodNodeSelector
|
|
- PodSecurity
|
|
- PodSecurityPolicy
|
|
- PodTolerationRestriction
|
|
- Priority
|
|
- ResourceQuota
|
|
- RuntimeClass
|
|
- SecurityContextDeny
|
|
- ServiceAccount
|
|
- StorageObjectInUseProtection
|
|
- TaintNodesByCondition
|
|
- ValidatingAdmissionWebhook
|
|
type: string
|
|
type: array
|
|
kubelet:
|
|
properties:
|
|
cgroupfs:
|
|
description: CGroupFS defines the cgroup driver for Kubelet https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver/
|
|
enum:
|
|
- systemd
|
|
- cgroupfs
|
|
type: string
|
|
type: object
|
|
version:
|
|
description: Kubernetes Version for the tenant control plane
|
|
type: string
|
|
required:
|
|
- kubelet
|
|
- version
|
|
type: object
|
|
networkProfile:
|
|
description: NetworkProfile specifies how the network is
|
|
properties:
|
|
address:
|
|
description: Address where API server of will be exposed. In case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager.
|
|
type: string
|
|
allowAddressAsExternalIP:
|
|
description: AllowAddressAsExternalIP will include tenantControlPlane.Spec.NetworkProfile.Address in the section of ExternalIPs of the Kubernetes Service (only ClusterIP or NodePort)
|
|
type: boolean
|
|
dnsServiceIPs:
|
|
items:
|
|
type: string
|
|
type: array
|
|
domain:
|
|
description: Domain of the tenant control plane
|
|
type: string
|
|
podCidr:
|
|
description: CIDR for Kubernetes Pods
|
|
type: string
|
|
port:
|
|
default: 6443
|
|
description: Port where API server of will be exposed
|
|
format: int32
|
|
type: integer
|
|
serviceCidr:
|
|
description: Kubernetes Service
|
|
type: string
|
|
required:
|
|
- dnsServiceIPs
|
|
- domain
|
|
- podCidr
|
|
- port
|
|
- serviceCidr
|
|
type: object
|
|
required:
|
|
- controlPlane
|
|
- kubernetes
|
|
type: object
|
|
status:
|
|
description: TenantControlPlaneStatus defines the observed state of TenantControlPlane.
|
|
properties:
|
|
certificates:
|
|
description: Certificates contains information about the different certificates that are necessary to run a kubernetes control plane
|
|
properties:
|
|
apiServer:
|
|
description: CertificatePrivateKeyPair defines the status.
|
|
properties:
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
secretName:
|
|
type: string
|
|
type: object
|
|
apiServerKubeletClient:
|
|
description: CertificatePrivateKeyPair defines the status.
|
|
properties:
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
secretName:
|
|
type: string
|
|
type: object
|
|
ca:
|
|
description: CertificatePrivateKeyPair defines the status.
|
|
properties:
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
secretName:
|
|
type: string
|
|
type: object
|
|
etcd:
|
|
description: ETCDAPIServerCertificate defines the observed state of ETCD Certificate for API server.
|
|
properties:
|
|
apiServer:
|
|
description: ETCDAPIServerCertificate defines the observed state of ETCD Certificate for API server.
|
|
properties:
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
secretName:
|
|
type: string
|
|
type: object
|
|
ca:
|
|
description: ETCDAPIServerCertificate defines the observed state of ETCD Certificate for API server.
|
|
properties:
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
secretName:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
frontProxyCA:
|
|
description: CertificatePrivateKeyPair defines the status.
|
|
properties:
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
secretName:
|
|
type: string
|
|
type: object
|
|
frontProxyClient:
|
|
description: CertificatePrivateKeyPair defines the status.
|
|
properties:
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
secretName:
|
|
type: string
|
|
type: object
|
|
sa:
|
|
description: CertificatePrivateKeyPair defines the status.
|
|
properties:
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
secretName:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
controlPlaneEndpoint:
|
|
description: ControlPlaneEndpoint contains the status of the kubernetes control plane
|
|
type: string
|
|
kubeadmPhase:
|
|
description: KubeadmPhase contains the status of the kubeadm phases action
|
|
properties:
|
|
addonCoreDNS:
|
|
description: KubeadmPhasesStatus contains the status of of a kubeadm phase action.
|
|
properties:
|
|
kubeadmConfigResourceVersion:
|
|
type: string
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
type: object
|
|
addonKubeProxy:
|
|
description: KubeadmPhasesStatus contains the status of of a kubeadm phase action.
|
|
properties:
|
|
kubeadmConfigResourceVersion:
|
|
type: string
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
type: object
|
|
bootstrapToken:
|
|
description: KubeadmPhasesStatus contains the status of of a kubeadm phase action.
|
|
properties:
|
|
kubeadmConfigResourceVersion:
|
|
type: string
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
type: object
|
|
uploadConfigKubeadm:
|
|
description: KubeadmPhasesStatus contains the status of of a kubeadm phase action.
|
|
properties:
|
|
kubeadmConfigResourceVersion:
|
|
type: string
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
type: object
|
|
uploadConfigKubelet:
|
|
description: KubeadmPhasesStatus contains the status of of a kubeadm phase action.
|
|
properties:
|
|
kubeadmConfigResourceVersion:
|
|
type: string
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
type: object
|
|
required:
|
|
- addonCoreDNS
|
|
- addonKubeProxy
|
|
- bootstrapToken
|
|
- uploadConfigKubeadm
|
|
- uploadConfigKubelet
|
|
type: object
|
|
kubeadmconfig:
|
|
description: KubeadmConfig contains the status of the configuration required by kubeadm
|
|
properties:
|
|
configmapName:
|
|
type: string
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
resourceVersion:
|
|
type: string
|
|
required:
|
|
- resourceVersion
|
|
type: object
|
|
kubeconfig:
|
|
description: KubeConfig contains information about the kubenconfigs that control plane pieces need
|
|
properties:
|
|
admin:
|
|
description: TenantControlPlaneKubeconfigsStatus contains information about a the generated kubeconfig.
|
|
properties:
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
secretName:
|
|
type: string
|
|
type: object
|
|
controlerManager:
|
|
description: TenantControlPlaneKubeconfigsStatus contains information about a the generated kubeconfig.
|
|
properties:
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
secretName:
|
|
type: string
|
|
type: object
|
|
scheduler:
|
|
description: TenantControlPlaneKubeconfigsStatus contains information about a the generated kubeconfig.
|
|
properties:
|
|
lastUpdate:
|
|
format: date-time
|
|
type: string
|
|
secretName:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
kubernetesResources:
|
|
description: Kubernetes contains information about the reconciliation of the required Kubernetes resources deployed in the admin cluster
|
|
properties:
|
|
deployment:
|
|
description: KubernetesDeploymentStatus defines the status for the Tenant Control Plane Deployment in the management cluster.
|
|
properties:
|
|
availableReplicas:
|
|
description: Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.
|
|
format: int32
|
|
type: integer
|
|
collisionCount:
|
|
description: Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet.
|
|
format: int32
|
|
type: integer
|
|
conditions:
|
|
description: Represents the latest available observations of a deployment's current state.
|
|
items:
|
|
description: DeploymentCondition describes the state of a deployment at a certain point.
|
|
properties:
|
|
lastTransitionTime:
|
|
description: Last time the condition transitioned from one status to another.
|
|
format: date-time
|
|
type: string
|
|
lastUpdateTime:
|
|
description: The last time this condition was updated.
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: A human readable message indicating details about the transition.
|
|
type: string
|
|
reason:
|
|
description: The reason for the condition's last transition.
|
|
type: string
|
|
status:
|
|
description: Status of the condition, one of True, False, Unknown.
|
|
type: string
|
|
type:
|
|
description: Type of deployment condition.
|
|
type: string
|
|
required:
|
|
- status
|
|
- type
|
|
type: object
|
|
type: array
|
|
name:
|
|
description: The name of the Deployment for the given cluster.
|
|
type: string
|
|
namespace:
|
|
description: The namespace which the Deployment for the given cluster is deployed.
|
|
type: string
|
|
observedGeneration:
|
|
description: The generation observed by the deployment controller.
|
|
format: int64
|
|
type: integer
|
|
readyReplicas:
|
|
description: readyReplicas is the number of pods targeted by this Deployment with a Ready Condition.
|
|
format: int32
|
|
type: integer
|
|
replicas:
|
|
description: Total number of non-terminated pods targeted by this deployment (their labels match the selector).
|
|
format: int32
|
|
type: integer
|
|
unavailableReplicas:
|
|
description: Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.
|
|
format: int32
|
|
type: integer
|
|
updatedReplicas:
|
|
description: Total number of non-terminated pods targeted by this deployment that have the desired template spec.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- name
|
|
- namespace
|
|
type: object
|
|
ingress:
|
|
description: KubernetesIngressStatus defines the status for the Tenant Control Plane Ingress in the management cluster.
|
|
properties:
|
|
loadBalancer:
|
|
description: LoadBalancer contains the current status of the load-balancer.
|
|
properties:
|
|
ingress:
|
|
description: Ingress is a list containing ingress points for the load-balancer. Traffic intended for the service should be sent to these ingress points.
|
|
items:
|
|
description: 'LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.'
|
|
properties:
|
|
hostname:
|
|
description: Hostname is set for load-balancer ingress points that are DNS based (typically AWS load-balancers)
|
|
type: string
|
|
ip:
|
|
description: IP is set for load-balancer ingress points that are IP based (typically GCE or OpenStack load-balancers)
|
|
type: string
|
|
ports:
|
|
description: Ports is a list of records of service ports If used, every port defined in the service should have an entry in it
|
|
items:
|
|
properties:
|
|
error:
|
|
description: 'Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
|
|
maxLength: 316
|
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
type: string
|
|
port:
|
|
description: Port is the port number of the service port of which status is recorded here
|
|
format: int32
|
|
type: integer
|
|
protocol:
|
|
default: TCP
|
|
description: 'Protocol is the protocol of the service port of which status is recorded here The supported values are: "TCP", "UDP", "SCTP"'
|
|
type: string
|
|
required:
|
|
- port
|
|
- protocol
|
|
type: object
|
|
type: array
|
|
x-kubernetes-list-type: atomic
|
|
type: object
|
|
type: array
|
|
type: object
|
|
name:
|
|
description: The name of the Ingress for the given cluster.
|
|
type: string
|
|
namespace:
|
|
description: The namespace which the Ingress for the given cluster is deployed.
|
|
type: string
|
|
required:
|
|
- name
|
|
- namespace
|
|
type: object
|
|
service:
|
|
description: KubernetesServiceStatus defines the status for the Tenant Control Plane Service in the management cluster.
|
|
properties:
|
|
conditions:
|
|
description: Current service state
|
|
items:
|
|
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
|
properties:
|
|
lastTransitionTime:
|
|
description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: message is a human readable message indicating details about the transition. This may be an empty string.
|
|
maxLength: 32768
|
|
type: string
|
|
observedGeneration:
|
|
description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
|
format: int64
|
|
minimum: 0
|
|
type: integer
|
|
reason:
|
|
description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
|
|
maxLength: 1024
|
|
minLength: 1
|
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
|
type: string
|
|
status:
|
|
description: status of the condition, one of True, False, Unknown.
|
|
enum:
|
|
- "True"
|
|
- "False"
|
|
- Unknown
|
|
type: string
|
|
type:
|
|
description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
|
maxLength: 316
|
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
type: string
|
|
required:
|
|
- lastTransitionTime
|
|
- message
|
|
- reason
|
|
- status
|
|
- type
|
|
type: object
|
|
type: array
|
|
x-kubernetes-list-map-keys:
|
|
- type
|
|
x-kubernetes-list-type: map
|
|
loadBalancer:
|
|
description: LoadBalancer contains the current status of the load-balancer, if one is present.
|
|
properties:
|
|
ingress:
|
|
description: Ingress is a list containing ingress points for the load-balancer. Traffic intended for the service should be sent to these ingress points.
|
|
items:
|
|
description: 'LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.'
|
|
properties:
|
|
hostname:
|
|
description: Hostname is set for load-balancer ingress points that are DNS based (typically AWS load-balancers)
|
|
type: string
|
|
ip:
|
|
description: IP is set for load-balancer ingress points that are IP based (typically GCE or OpenStack load-balancers)
|
|
type: string
|
|
ports:
|
|
description: Ports is a list of records of service ports If used, every port defined in the service should have an entry in it
|
|
items:
|
|
properties:
|
|
error:
|
|
description: 'Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
|
|
maxLength: 316
|
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
type: string
|
|
port:
|
|
description: Port is the port number of the service port of which status is recorded here
|
|
format: int32
|
|
type: integer
|
|
protocol:
|
|
default: TCP
|
|
description: 'Protocol is the protocol of the service port of which status is recorded here The supported values are: "TCP", "UDP", "SCTP"'
|
|
type: string
|
|
required:
|
|
- port
|
|
- protocol
|
|
type: object
|
|
type: array
|
|
x-kubernetes-list-type: atomic
|
|
type: object
|
|
type: array
|
|
type: object
|
|
name:
|
|
description: The name of the Service for the given cluster.
|
|
type: string
|
|
namespace:
|
|
description: The namespace which the Service for the given cluster is deployed.
|
|
type: string
|
|
port:
|
|
description: The port where the service is running
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- name
|
|
- namespace
|
|
- port
|
|
type: object
|
|
version:
|
|
description: KubernetesVersion contains the information regarding the running Kubernetes version, and its upgrade status.
|
|
properties:
|
|
status:
|
|
default: Provisioning
|
|
description: Status returns the current status of the Kubernetes version, such as its provisioning state, or completed upgrade.
|
|
enum:
|
|
- Provisioning
|
|
- Upgrading
|
|
- Ready
|
|
- NotReady
|
|
type: string
|
|
version:
|
|
description: Version is the running Kubernetes version of the Tenant Control Plane.
|
|
type: string
|
|
required:
|
|
- status
|
|
type: object
|
|
type: object
|
|
storage:
|
|
description: Storage Status contains information about Kubernetes storage system
|
|
properties:
|
|
etcd:
|
|
description: ETCDStatus defines the observed state of ETCDStatus.
|
|
properties:
|
|
role:
|
|
properties:
|
|
exists:
|
|
type: boolean
|
|
name:
|
|
type: string
|
|
permissions:
|
|
items:
|
|
properties:
|
|
key:
|
|
type: string
|
|
rangeEnd:
|
|
type: string
|
|
type:
|
|
type: integer
|
|
type: object
|
|
type: array
|
|
required:
|
|
- exists
|
|
- name
|
|
type: object
|
|
user:
|
|
properties:
|
|
exists:
|
|
type: boolean
|
|
name:
|
|
type: string
|
|
roles:
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- exists
|
|
- name
|
|
type: object
|
|
type: object
|
|
type: object
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|
|
status:
|
|
acceptedNames:
|
|
kind: ""
|
|
plural: ""
|
|
conditions: []
|
|
storedVersions: []
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: kamaji-controller-manager
|
|
namespace: kamaji-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: kamaji-leader-election-role
|
|
namespace: kamaji-system
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- patch
|
|
- delete
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- patch
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- create
|
|
- patch
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
creationTimestamp: null
|
|
name: kamaji-manager-role
|
|
rules:
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- services
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- kamaji.clastix.io
|
|
resources:
|
|
- tenantcontrolplanes
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- kamaji.clastix.io
|
|
resources:
|
|
- tenantcontrolplanes/finalizers
|
|
verbs:
|
|
- update
|
|
- apiGroups:
|
|
- kamaji.clastix.io
|
|
resources:
|
|
- tenantcontrolplanes/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- networking.k8s.io
|
|
resources:
|
|
- ingresses
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kamaji-metrics-reader
|
|
rules:
|
|
- nonResourceURLs:
|
|
- /metrics
|
|
verbs:
|
|
- get
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kamaji-proxy-role
|
|
rules:
|
|
- apiGroups:
|
|
- authentication.k8s.io
|
|
resources:
|
|
- tokenreviews
|
|
verbs:
|
|
- create
|
|
- apiGroups:
|
|
- authorization.k8s.io
|
|
resources:
|
|
- subjectaccessreviews
|
|
verbs:
|
|
- create
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: kamaji-leader-election-rolebinding
|
|
namespace: kamaji-system
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: kamaji-leader-election-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kamaji-controller-manager
|
|
namespace: kamaji-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: kamaji-manager-rolebinding
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kamaji-manager-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kamaji-controller-manager
|
|
namespace: kamaji-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: kamaji-proxy-rolebinding
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kamaji-proxy-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kamaji-controller-manager
|
|
namespace: kamaji-system
|
|
---
|
|
apiVersion: v1
|
|
data:
|
|
controller_manager_config.yaml: |
|
|
apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
|
|
kind: ControllerManagerConfig
|
|
health:
|
|
healthProbeBindAddress: :8081
|
|
metrics:
|
|
bindAddress: 127.0.0.1:8080
|
|
webhook:
|
|
port: 9443
|
|
leaderElection:
|
|
leaderElect: true
|
|
resourceName: 799b98bc.clastix.io
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: kamaji-manager-config
|
|
namespace: kamaji-system
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
control-plane: controller-manager
|
|
name: kamaji-controller-manager-metrics-service
|
|
namespace: kamaji-system
|
|
spec:
|
|
ports:
|
|
- name: https
|
|
port: 8443
|
|
protocol: TCP
|
|
targetPort: https
|
|
selector:
|
|
control-plane: controller-manager
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
control-plane: controller-manager
|
|
name: kamaji-controller-manager
|
|
namespace: kamaji-system
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
control-plane: controller-manager
|
|
template:
|
|
metadata:
|
|
labels:
|
|
control-plane: controller-manager
|
|
spec:
|
|
containers:
|
|
- args:
|
|
- --secure-listen-address=0.0.0.0:8443
|
|
- --upstream=http://127.0.0.1:8080/
|
|
- --logtostderr=true
|
|
- --v=10
|
|
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
|
|
name: kube-rbac-proxy
|
|
ports:
|
|
- containerPort: 8443
|
|
name: https
|
|
protocol: TCP
|
|
- args:
|
|
- --health-probe-bind-address=:8081
|
|
- --metrics-bind-address=127.0.0.1:8080
|
|
- --leader-elect
|
|
command:
|
|
- /manager
|
|
image: quay.io/clastix/kamaji:latest
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8081
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
name: manager
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readyz
|
|
port: 8081
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
resources:
|
|
limits:
|
|
cpu: 200m
|
|
memory: 100Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 20Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
serviceAccountName: kamaji-controller-manager
|
|
terminationGracePeriodSeconds: 10
|