kubespray/roles/kubernetes-apps/ingress_controller/cert_manager/templates/crd-challenge.yml.j2

6040 lines
400 KiB
Django/Jinja
Raw Blame History

This file contains invisible Unicode characters!

This file contains invisible Unicode characters that may be processed differently from what appears below. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to reveal hidden characters.

# Copyright YEAR The Jetstack cert-manager contributors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
labels:
app: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/name: cert-manager
name: challenges.acme.cert-manager.io
spec:
conversion:
strategy: Webhook
webhook:
clientConfig:
service:
name: cert-manager-webhook
namespace: {{ cert_manager_namespace }}
path: /convert
conversionReviewVersions:
- v1
- v1beta1
group: acme.cert-manager.io
names:
kind: Challenge
listKind: ChallengeList
plural: challenges
singular: challenge
scope: Namespaced
versions:
- additionalPrinterColumns:
- jsonPath: .status.state
name: State
type: string
- jsonPath: .spec.dnsName
name: Domain
type: string
- jsonPath: .status.reason
name: Reason
priority: 1
type: string
- description: CreationTimestamp is a timestamp representing the server time when
this object was created. It is not guaranteed to be set in happens-before
order across separate operations. Clients may not set this value. It is represented
in RFC3339 form and is in UTC.
jsonPath: .metadata.creationTimestamp
name: Age
type: date
name: v1alpha2
schema:
openAPIV3Schema:
description: Challenge is a type to represent a Challenge request with an
ACME server
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
properties:
authzURL:
description: AuthzURL is the URL to the ACME Authorization resource
that this challenge is a part of.
type: string
dnsName:
description: DNSName is the identifier that this challenge is for,
e.g. example.com. If the requested DNSName is a 'wildcard', this
field MUST be set to the non-wildcard domain, e.g. for `*.example.com`,
it must be `example.com`.
type: string
issuerRef:
description: IssuerRef references a properly configured ACME-type
Issuer which should be used to create this Challenge. If the Issuer
does not exist, processing will be retried. If the Issuer is not
an 'ACME' Issuer, an error will be returned and the Challenge will
be marked as failed.
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
required:
- name
type: object
key:
description: 'Key is the ACME challenge key for this challenge For
HTTP01 challenges, this is the value that must be responded with
to complete the HTTP01 challenge in the format: `<private key JWK
thumbprint>.<key from acme server for challenge>`. For DNS01 challenges,
this is the base64 encoded SHA256 sum of the `<private key JWK thumbprint>.<key
from acme server for challenge>` text that must be set as the TXT
record content.'
type: string
solver:
description: Solver contains the domain solving configuration that
should be used to solve this challenge resource.
properties:
dns01:
description: Configures cert-manager to attempt to complete authorizations
by performing the DNS01 challenge flow.
properties:
acmedns:
description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns)
API to manage DNS01 challenge records.
properties:
accountSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
host:
type: string
required:
- accountSecretRef
- host
type: object
akamai:
description: Use the Akamai DNS zone management API to manage
DNS01 challenge records.
properties:
accessTokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
clientSecretSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
clientTokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
serviceConsumerDomain:
type: string
required:
- accessTokenSecretRef
- clientSecretSecretRef
- clientTokenSecretRef
- serviceConsumerDomain
type: object
azuredns:
description: Use the Microsoft Azure DNS API to manage DNS01
challenge records.
properties:
clientID:
description: if both this and ClientSecret are left unset
MSI will be used
type: string
clientSecretSecretRef:
description: if both this and ClientID are left unset
MSI will be used
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
environment:
enum:
- AzurePublicCloud
- AzureChinaCloud
- AzureGermanCloud
- AzureUSGovernmentCloud
type: string
hostedZoneName:
type: string
resourceGroupName:
type: string
subscriptionID:
type: string
tenantID:
description: when specifying ClientID and ClientSecret
then this field is also needed
type: string
required:
- resourceGroupName
- subscriptionID
type: object
clouddns:
description: Use the Google Cloud DNS API to manage DNS01
challenge records.
properties:
hostedZoneName:
description: HostedZoneName is an optional field that
tells cert-manager in which Cloud DNS zone the challenge
record has to be created. If left empty cert-manager
will automatically choose a zone.
type: string
project:
type: string
serviceAccountSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- project
type: object
cloudflare:
description: Use the Cloudflare API to manage DNS01 challenge
records.
properties:
apiKeySecretRef:
description: 'API key to use to authenticate with Cloudflare.
Note: using an API token to authenticate is now the
recommended method as it allows greater control of permissions.'
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
apiTokenSecretRef:
description: API token used to authenticate with Cloudflare.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
email:
description: Email of the account, only required when
using API key based authentication.
type: string
type: object
cnameStrategy:
description: CNAMEStrategy configures how the DNS01 provider
should handle CNAME records when found in DNS zones.
enum:
- None
- Follow
type: string
digitalocean:
description: Use the DigitalOcean DNS API to manage DNS01
challenge records.
properties:
tokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- tokenSecretRef
type: object
rfc2136:
description: Use RFC2136 ("Dynamic Updates in the Domain Name
System") (https://datatracker.ietf.org/doc/rfc2136/) to
manage DNS01 challenge records.
properties:
nameserver:
description: The IP address or hostname of an authoritative
DNS server supporting RFC2136 in the form host:port.
If the host is an IPv6 address it must be enclosed in
square brackets (e.g [2001:db8::1]) ; port is optional.
This field is required.
type: string
tsigAlgorithm:
description: 'The TSIG Algorithm configured in the DNS
supporting RFC2136. Used only when ``tsigSecretSecretRef``
and ``tsigKeyName`` are defined. Supported values are
(case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``,
``HMACSHA256`` or ``HMACSHA512``.'
type: string
tsigKeyName:
description: The TSIG Key name configured in the DNS.
If ``tsigSecretSecretRef`` is defined, this field is
required.
type: string
tsigSecretSecretRef:
description: The name of the secret containing the TSIG
value. If ``tsigKeyName`` is defined, this field is
required.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- nameserver
type: object
route53:
description: Use the AWS Route53 API to manage DNS01 challenge
records.
properties:
accessKeyID:
description: 'The AccessKeyID is used for authentication.
If not set we fall-back to using env vars, shared credentials
file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
type: string
hostedZoneID:
description: If set, the provider will manage only this
zone in Route53 and will not do an lookup using the
route53:ListHostedZonesByName api call.
type: string
region:
description: Always set the region when using AccessKeyID
and SecretAccessKey
type: string
role:
description: Role is a Role ARN which the Route53 provider
will assume using either the explicit credentials AccessKeyID/SecretAccessKey
or the inferred credentials from environment variables,
shared credentials file or AWS Instance metadata
type: string
secretAccessKeySecretRef:
description: The SecretAccessKey is used for authentication.
If not set we fall-back to using env vars, shared credentials
file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- region
type: object
webhook:
description: Configure an external webhook based DNS01 challenge
solver to manage DNS01 challenge records.
properties:
config:
description: Additional configuration that should be passed
to the webhook apiserver when challenges are processed.
This can contain arbitrary JSON data. Secret values
should not be specified in this stanza. If secret values
are needed (e.g. credentials for a DNS service), you
should use a SecretKeySelector to reference a Secret
resource. For details on the schema of this field, consult
the webhook provider implementation's documentation.
x-kubernetes-preserve-unknown-fields: true
groupName:
description: The API group name that should be used when
POSTing ChallengePayload resources to the webhook apiserver.
This should be the same as the GroupName specified in
the webhook provider implementation.
type: string
solverName:
description: The name of the solver to use, as defined
in the webhook provider implementation. This will typically
be the name of the provider, e.g. 'cloudflare'.
type: string
required:
- groupName
- solverName
type: object
type: object
http01:
description: Configures cert-manager to attempt to complete authorizations
by performing the HTTP01 challenge flow. It is not possible
to obtain certificates for wildcard domain names (e.g. `*.example.com`)
using the HTTP01 challenge mechanism.
properties:
ingress:
description: The ingress based HTTP01 challenge solver will
solve challenges by creating or modifying Ingress resources
in order to route requests for '/.well-known/acme-challenge/XYZ'
to 'challenge solver' pods that are provisioned by cert-manager
for each Challenge to be completed.
properties:
class:
description: The ingress class to use when creating Ingress
resources to solve ACME challenges that use this challenge
solver. Only one of 'class' or 'name' may be specified.
type: string
ingressTemplate:
description: Optional ingress template used to configure
the ACME challenge solver ingress used for HTTP01 challenges
properties:
metadata:
description: ObjectMeta overrides for the ingress
used to solve HTTP01 challenges. Only the 'labels'
and 'annotations' fields may be set. If labels or
annotations overlap with in-built values, the values
here will override the in-built values.
properties:
annotations:
additionalProperties:
type: string
description: Annotations that should be added
to the created ACME HTTP01 solver ingress.
type: object
labels:
additionalProperties:
type: string
description: Labels that should be added to the
created ACME HTTP01 solver ingress.
type: object
type: object
type: object
name:
description: The name of the ingress resource that should
have ACME challenge solving routes inserted into it
in order to solve HTTP01 challenges. This is typically
used in conjunction with ingress controllers like ingress-gce,
which maintains a 1:1 mapping between external IPs and
ingress resources.
type: string
podTemplate:
description: Optional pod template used to configure the
ACME challenge solver pods used for HTTP01 challenges
properties:
metadata:
description: ObjectMeta overrides for the pod used
to solve HTTP01 challenges. Only the 'labels' and
'annotations' fields may be set. If labels or annotations
overlap with in-built values, the values here will
override the in-built values.
properties:
annotations:
additionalProperties:
type: string
description: Annotations that should be added
to the create ACME HTTP01 solver pods.
type: object
labels:
additionalProperties:
type: string
description: Labels that should be added to the
created ACME HTTP01 solver pods.
type: object
type: object
spec:
description: PodSpec defines overrides for the HTTP01
challenge solver pod. Only the 'priorityClassName',
'nodeSelector', 'affinity', 'serviceAccountName'
and 'tolerations' fields are supported currently.
All other fields will be ignored.
properties:
affinity:
description: If specified, the pod's scheduling
constraints
properties:
nodeAffinity:
description: Describes node affinity scheduling
rules for the pod.
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the affinity expressions specified by
this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node matches the corresponding
matchExpressions; the node(s) with the
highest sum are the most preferred.
items:
description: An empty preferred scheduling
term matches all objects with implicit
weight 0 (i.e. it's a no-op). A null
preferred scheduling term matches
no objects (i.e. is also a no-op).
properties:
preference:
description: A node selector term,
associated with the corresponding
weight.
properties:
matchExpressions:
description: A list of node
selector requirements by node's
labels.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchFields:
description: A list of node
selector requirements by node's
fields.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
type: object
weight:
description: Weight associated with
matching the corresponding nodeSelectorTerm,
in the range 1-100.
format: int32
type: integer
required:
- preference
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to an update),
the system may or may not try to eventually
evict the pod from its node.
properties:
nodeSelectorTerms:
description: Required. A list of node
selector terms. The terms are ORed.
items:
description: A null or empty node
selector term matches no objects.
The requirements of them are ANDed.
The TopologySelectorTerm type
implements a subset of the NodeSelectorTerm.
properties:
matchExpressions:
description: A list of node
selector requirements by node's
labels.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchFields:
description: A list of node
selector requirements by node's
fields.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
type: object
type: array
required:
- nodeSelectorTerms
type: object
type: object
podAffinity:
description: Describes pod affinity scheduling
rules (e.g. co-locate this pod in the same
node, zone, etc. as some other pod(s)).
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the affinity expressions specified by
this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node has pods which matches the
corresponding podAffinityTerm; the node(s)
with the highest sum are the most preferred.
items:
description: The weights of all of the
matched WeightedPodAffinityTerm fields
are added per-node to find the most
preferred node(s)
properties:
podAffinityTerm:
description: Required. A pod affinity
term, associated with the corresponding
weight.
properties:
labelSelector:
description: A label query over
a set of resources, in this
case pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values,
a key, and an operator
that relates the key
and values.
properties:
key:
description: key is
the label key that
the selector applies
to.
type: string
operator:
description: operator
represents a key's
relationship to
a set of values.
Valid operators
are In, NotIn, Exists
and DoesNotExist.
type: string
values:
description: values
is an array of string
values. If the operator
is In or NotIn,
the values array
must be non-empty.
If the operator
is Exists or DoesNotExist,
the values array
must be empty. This
array is replaced
during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels
is a map of {key,value}
pairs. A single {key,value}
in the matchLabels map
is equivalent to an element
of matchExpressions, whose
key field is "key", the
operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should
be co-located (affinity) or
not co-located (anti-affinity)
with the pods matching the
labelSelector in the specified
namespaces, where co-located
is defined as running on a
node whose value of the label
with key topologyKey matches
that of any node on which
any of the selected pods is
running. Empty topologyKey
is not allowed.
type: string
required:
- topologyKey
type: object
weight:
description: weight associated with
matching the corresponding podAffinityTerm,
in the range 1-100.
format: int32
type: integer
required:
- podAffinityTerm
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to a pod label
update), the system may or may not try
to eventually evict the pod from its
node. When there are multiple elements,
the lists of nodes corresponding to
each podAffinityTerm are intersected,
i.e. all terms must be satisfied.
items:
description: Defines a set of pods (namely
those matching the labelSelector relative
to the given namespace(s)) that this
pod should be co-located (affinity)
or not co-located (anti-affinity)
with, where co-located is defined
as running on a node whose value of
the label with key <topologyKey> matches
that of any node on which a pod of
the set of pods is running
properties:
labelSelector:
description: A label query over
a set of resources, in this case
pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: key is the
label key that the selector
applies to.
type: string
operator:
description: operator
represents a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists and
DoesNotExist.
type: string
values:
description: values is
an array of string values.
If the operator is In
or NotIn, the values
array must be non-empty.
If the operator is Exists
or DoesNotExist, the
values array must be
empty. This array is
replaced during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels is
a map of {key,value} pairs.
A single {key,value} in the
matchLabels map is equivalent
to an element of matchExpressions,
whose key field is "key",
the operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should be
co-located (affinity) or not co-located
(anti-affinity) with the pods
matching the labelSelector in
the specified namespaces, where
co-located is defined as running
on a node whose value of the label
with key topologyKey matches that
of any node on which any of the
selected pods is running. Empty
topologyKey is not allowed.
type: string
required:
- topologyKey
type: object
type: array
type: object
podAntiAffinity:
description: Describes pod anti-affinity scheduling
rules (e.g. avoid putting this pod in the
same node, zone, etc. as some other pod(s)).
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the anti-affinity expressions specified
by this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling anti-affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node has pods which matches the
corresponding podAffinityTerm; the node(s)
with the highest sum are the most preferred.
items:
description: The weights of all of the
matched WeightedPodAffinityTerm fields
are added per-node to find the most
preferred node(s)
properties:
podAffinityTerm:
description: Required. A pod affinity
term, associated with the corresponding
weight.
properties:
labelSelector:
description: A label query over
a set of resources, in this
case pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values,
a key, and an operator
that relates the key
and values.
properties:
key:
description: key is
the label key that
the selector applies
to.
type: string
operator:
description: operator
represents a key's
relationship to
a set of values.
Valid operators
are In, NotIn, Exists
and DoesNotExist.
type: string
values:
description: values
is an array of string
values. If the operator
is In or NotIn,
the values array
must be non-empty.
If the operator
is Exists or DoesNotExist,
the values array
must be empty. This
array is replaced
during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels
is a map of {key,value}
pairs. A single {key,value}
in the matchLabels map
is equivalent to an element
of matchExpressions, whose
key field is "key", the
operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should
be co-located (affinity) or
not co-located (anti-affinity)
with the pods matching the
labelSelector in the specified
namespaces, where co-located
is defined as running on a
node whose value of the label
with key topologyKey matches
that of any node on which
any of the selected pods is
running. Empty topologyKey
is not allowed.
type: string
required:
- topologyKey
type: object
weight:
description: weight associated with
matching the corresponding podAffinityTerm,
in the range 1-100.
format: int32
type: integer
required:
- podAffinityTerm
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the anti-affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the anti-affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to a pod label
update), the system may or may not try
to eventually evict the pod from its
node. When there are multiple elements,
the lists of nodes corresponding to
each podAffinityTerm are intersected,
i.e. all terms must be satisfied.
items:
description: Defines a set of pods (namely
those matching the labelSelector relative
to the given namespace(s)) that this
pod should be co-located (affinity)
or not co-located (anti-affinity)
with, where co-located is defined
as running on a node whose value of
the label with key <topologyKey> matches
that of any node on which a pod of
the set of pods is running
properties:
labelSelector:
description: A label query over
a set of resources, in this case
pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: key is the
label key that the selector
applies to.
type: string
operator:
description: operator
represents a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists and
DoesNotExist.
type: string
values:
description: values is
an array of string values.
If the operator is In
or NotIn, the values
array must be non-empty.
If the operator is Exists
or DoesNotExist, the
values array must be
empty. This array is
replaced during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels is
a map of {key,value} pairs.
A single {key,value} in the
matchLabels map is equivalent
to an element of matchExpressions,
whose key field is "key",
the operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should be
co-located (affinity) or not co-located
(anti-affinity) with the pods
matching the labelSelector in
the specified namespaces, where
co-located is defined as running
on a node whose value of the label
with key topologyKey matches that
of any node on which any of the
selected pods is running. Empty
topologyKey is not allowed.
type: string
required:
- topologyKey
type: object
type: array
type: object
type: object
nodeSelector:
additionalProperties:
type: string
description: 'NodeSelector is a selector which
must be true for the pod to fit on a node. Selector
which must match a node''s labels for the pod
to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
priorityClassName:
description: If specified, the pod's priorityClassName.
type: string
serviceAccountName:
description: If specified, the pod's service account
type: string
tolerations:
description: If specified, the pod's tolerations.
items:
description: The pod this Toleration is attached
to tolerates any taint that matches the triple
<key,value,effect> using the matching operator
<operator>.
properties:
effect:
description: Effect indicates the taint
effect to match. Empty means match all
taint effects. When specified, allowed
values are NoSchedule, PreferNoSchedule
and NoExecute.
type: string
key:
description: Key is the taint key that the
toleration applies to. Empty means match
all taint keys. If the key is empty, operator
must be Exists; this combination means
to match all values and all keys.
type: string
operator:
description: Operator represents a key's
relationship to the value. Valid operators
are Exists and Equal. Defaults to Equal.
Exists is equivalent to wildcard for value,
so that a pod can tolerate all taints
of a particular category.
type: string
tolerationSeconds:
description: TolerationSeconds represents
the period of time the toleration (which
must be of effect NoExecute, otherwise
this field is ignored) tolerates the taint.
By default, it is not set, which means
tolerate the taint forever (do not evict).
Zero and negative values will be treated
as 0 (evict immediately) by the system.
format: int64
type: integer
value:
description: Value is the taint value the
toleration matches to. If the operator
is Exists, the value should be empty,
otherwise just a regular string.
type: string
type: object
type: array
type: object
type: object
serviceType:
description: Optional service type for Kubernetes solver
service
type: string
type: object
type: object
selector:
description: Selector selects a set of DNSNames on the Certificate
resource that should be solved using this challenge solver.
If not specified, the solver will be treated as the 'default'
solver with the lowest priority, i.e. if any other solver has
a more specific match, it will be used instead.
properties:
dnsNames:
description: List of DNSNames that this solver will be used
to solve. If specified and a match is found, a dnsNames
selector will take precedence over a dnsZones selector.
If multiple solvers match with the same dnsNames value,
the solver with the most matching labels in matchLabels
will be selected. If neither has more matches, the solver
defined earlier in the list will be selected.
items:
type: string
type: array
dnsZones:
description: List of DNSZones that this solver will be used
to solve. The most specific DNS zone match specified here
will take precedence over other DNS zone matches, so a solver
specifying sys.example.com will be selected over one specifying
example.com for the domain www.sys.example.com. If multiple
solvers match with the same dnsZones value, the solver with
the most matching labels in matchLabels will be selected.
If neither has more matches, the solver defined earlier
in the list will be selected.
items:
type: string
type: array
matchLabels:
additionalProperties:
type: string
description: A label selector that is used to refine the set
of certificate's that this challenge solver will apply to.
type: object
type: object
type: object
token:
description: Token is the ACME challenge token for this challenge.
This is the raw value returned from the ACME server.
type: string
type:
description: Type is the type of ACME challenge this resource represents.
One of "http-01" or "dns-01".
enum:
- http-01
- dns-01
type: string
url:
description: URL is the URL of the ACME Challenge resource for this
challenge. This can be used to lookup details about the status of
this challenge.
type: string
wildcard:
description: Wildcard will be true if this challenge is for a wildcard
identifier, for example '*.example.com'.
type: boolean
required:
- authzURL
- dnsName
- issuerRef
- key
- solver
- token
- type
- url
type: object
status:
properties:
presented:
description: Presented will be set to true if the challenge values
for this challenge are currently 'presented'. This *does not* imply
the self check is passing. Only that the values have been 'submitted'
for the appropriate challenge mechanism (i.e. the DNS01 TXT record
has been presented, or the HTTP01 configuration has been configured).
type: boolean
processing:
description: Processing is used to denote whether this challenge should
be processed or not. This field will only be set to true by the
'scheduling' component. It will only be set to false by the 'challenges'
controller, after the challenge has reached a final state or timed
out. If this field is set to false, the challenge controller will
not take any more action.
type: boolean
reason:
description: Reason contains human readable information on why the
Challenge is in the current state.
type: string
state:
description: State contains the current 'state' of the challenge.
If not set, the state of the challenge is unknown.
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
type: string
type: object
required:
- metadata
type: object
served: true
storage: false
subresources:
status: {}
- additionalPrinterColumns:
- jsonPath: .status.state
name: State
type: string
- jsonPath: .spec.dnsName
name: Domain
type: string
- jsonPath: .status.reason
name: Reason
priority: 1
type: string
- description: CreationTimestamp is a timestamp representing the server time when
this object was created. It is not guaranteed to be set in happens-before
order across separate operations. Clients may not set this value. It is represented
in RFC3339 form and is in UTC.
jsonPath: .metadata.creationTimestamp
name: Age
type: date
name: v1alpha3
schema:
openAPIV3Schema:
description: Challenge is a type to represent a Challenge request with an
ACME server
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
properties:
authzURL:
description: AuthzURL is the URL to the ACME Authorization resource
that this challenge is a part of.
type: string
dnsName:
description: DNSName is the identifier that this challenge is for,
e.g. example.com. If the requested DNSName is a 'wildcard', this
field MUST be set to the non-wildcard domain, e.g. for `*.example.com`,
it must be `example.com`.
type: string
issuerRef:
description: IssuerRef references a properly configured ACME-type
Issuer which should be used to create this Challenge. If the Issuer
does not exist, processing will be retried. If the Issuer is not
an 'ACME' Issuer, an error will be returned and the Challenge will
be marked as failed.
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
required:
- name
type: object
key:
description: 'Key is the ACME challenge key for this challenge For
HTTP01 challenges, this is the value that must be responded with
to complete the HTTP01 challenge in the format: `<private key JWK
thumbprint>.<key from acme server for challenge>`. For DNS01 challenges,
this is the base64 encoded SHA256 sum of the `<private key JWK thumbprint>.<key
from acme server for challenge>` text that must be set as the TXT
record content.'
type: string
solver:
description: Solver contains the domain solving configuration that
should be used to solve this challenge resource.
properties:
dns01:
description: Configures cert-manager to attempt to complete authorizations
by performing the DNS01 challenge flow.
properties:
acmedns:
description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns)
API to manage DNS01 challenge records.
properties:
accountSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
host:
type: string
required:
- accountSecretRef
- host
type: object
akamai:
description: Use the Akamai DNS zone management API to manage
DNS01 challenge records.
properties:
accessTokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
clientSecretSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
clientTokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
serviceConsumerDomain:
type: string
required:
- accessTokenSecretRef
- clientSecretSecretRef
- clientTokenSecretRef
- serviceConsumerDomain
type: object
azuredns:
description: Use the Microsoft Azure DNS API to manage DNS01
challenge records.
properties:
clientID:
description: if both this and ClientSecret are left unset
MSI will be used
type: string
clientSecretSecretRef:
description: if both this and ClientID are left unset
MSI will be used
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
environment:
enum:
- AzurePublicCloud
- AzureChinaCloud
- AzureGermanCloud
- AzureUSGovernmentCloud
type: string
hostedZoneName:
type: string
resourceGroupName:
type: string
subscriptionID:
type: string
tenantID:
description: when specifying ClientID and ClientSecret
then this field is also needed
type: string
required:
- resourceGroupName
- subscriptionID
type: object
clouddns:
description: Use the Google Cloud DNS API to manage DNS01
challenge records.
properties:
hostedZoneName:
description: HostedZoneName is an optional field that
tells cert-manager in which Cloud DNS zone the challenge
record has to be created. If left empty cert-manager
will automatically choose a zone.
type: string
project:
type: string
serviceAccountSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- project
type: object
cloudflare:
description: Use the Cloudflare API to manage DNS01 challenge
records.
properties:
apiKeySecretRef:
description: 'API key to use to authenticate with Cloudflare.
Note: using an API token to authenticate is now the
recommended method as it allows greater control of permissions.'
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
apiTokenSecretRef:
description: API token used to authenticate with Cloudflare.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
email:
description: Email of the account, only required when
using API key based authentication.
type: string
type: object
cnameStrategy:
description: CNAMEStrategy configures how the DNS01 provider
should handle CNAME records when found in DNS zones.
enum:
- None
- Follow
type: string
digitalocean:
description: Use the DigitalOcean DNS API to manage DNS01
challenge records.
properties:
tokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- tokenSecretRef
type: object
rfc2136:
description: Use RFC2136 ("Dynamic Updates in the Domain Name
System") (https://datatracker.ietf.org/doc/rfc2136/) to
manage DNS01 challenge records.
properties:
nameserver:
description: The IP address or hostname of an authoritative
DNS server supporting RFC2136 in the form host:port.
If the host is an IPv6 address it must be enclosed in
square brackets (e.g [2001:db8::1]) ; port is optional.
This field is required.
type: string
tsigAlgorithm:
description: 'The TSIG Algorithm configured in the DNS
supporting RFC2136. Used only when ``tsigSecretSecretRef``
and ``tsigKeyName`` are defined. Supported values are
(case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``,
``HMACSHA256`` or ``HMACSHA512``.'
type: string
tsigKeyName:
description: The TSIG Key name configured in the DNS.
If ``tsigSecretSecretRef`` is defined, this field is
required.
type: string
tsigSecretSecretRef:
description: The name of the secret containing the TSIG
value. If ``tsigKeyName`` is defined, this field is
required.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- nameserver
type: object
route53:
description: Use the AWS Route53 API to manage DNS01 challenge
records.
properties:
accessKeyID:
description: 'The AccessKeyID is used for authentication.
If not set we fall-back to using env vars, shared credentials
file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
type: string
hostedZoneID:
description: If set, the provider will manage only this
zone in Route53 and will not do an lookup using the
route53:ListHostedZonesByName api call.
type: string
region:
description: Always set the region when using AccessKeyID
and SecretAccessKey
type: string
role:
description: Role is a Role ARN which the Route53 provider
will assume using either the explicit credentials AccessKeyID/SecretAccessKey
or the inferred credentials from environment variables,
shared credentials file or AWS Instance metadata
type: string
secretAccessKeySecretRef:
description: The SecretAccessKey is used for authentication.
If not set we fall-back to using env vars, shared credentials
file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- region
type: object
webhook:
description: Configure an external webhook based DNS01 challenge
solver to manage DNS01 challenge records.
properties:
config:
description: Additional configuration that should be passed
to the webhook apiserver when challenges are processed.
This can contain arbitrary JSON data. Secret values
should not be specified in this stanza. If secret values
are needed (e.g. credentials for a DNS service), you
should use a SecretKeySelector to reference a Secret
resource. For details on the schema of this field, consult
the webhook provider implementation's documentation.
x-kubernetes-preserve-unknown-fields: true
groupName:
description: The API group name that should be used when
POSTing ChallengePayload resources to the webhook apiserver.
This should be the same as the GroupName specified in
the webhook provider implementation.
type: string
solverName:
description: The name of the solver to use, as defined
in the webhook provider implementation. This will typically
be the name of the provider, e.g. 'cloudflare'.
type: string
required:
- groupName
- solverName
type: object
type: object
http01:
description: Configures cert-manager to attempt to complete authorizations
by performing the HTTP01 challenge flow. It is not possible
to obtain certificates for wildcard domain names (e.g. `*.example.com`)
using the HTTP01 challenge mechanism.
properties:
ingress:
description: The ingress based HTTP01 challenge solver will
solve challenges by creating or modifying Ingress resources
in order to route requests for '/.well-known/acme-challenge/XYZ'
to 'challenge solver' pods that are provisioned by cert-manager
for each Challenge to be completed.
properties:
class:
description: The ingress class to use when creating Ingress
resources to solve ACME challenges that use this challenge
solver. Only one of 'class' or 'name' may be specified.
type: string
ingressTemplate:
description: Optional ingress template used to configure
the ACME challenge solver ingress used for HTTP01 challenges
properties:
metadata:
description: ObjectMeta overrides for the ingress
used to solve HTTP01 challenges. Only the 'labels'
and 'annotations' fields may be set. If labels or
annotations overlap with in-built values, the values
here will override the in-built values.
properties:
annotations:
additionalProperties:
type: string
description: Annotations that should be added
to the created ACME HTTP01 solver ingress.
type: object
labels:
additionalProperties:
type: string
description: Labels that should be added to the
created ACME HTTP01 solver ingress.
type: object
type: object
type: object
name:
description: The name of the ingress resource that should
have ACME challenge solving routes inserted into it
in order to solve HTTP01 challenges. This is typically
used in conjunction with ingress controllers like ingress-gce,
which maintains a 1:1 mapping between external IPs and
ingress resources.
type: string
podTemplate:
description: Optional pod template used to configure the
ACME challenge solver pods used for HTTP01 challenges
properties:
metadata:
description: ObjectMeta overrides for the pod used
to solve HTTP01 challenges. Only the 'labels' and
'annotations' fields may be set. If labels or annotations
overlap with in-built values, the values here will
override the in-built values.
properties:
annotations:
additionalProperties:
type: string
description: Annotations that should be added
to the create ACME HTTP01 solver pods.
type: object
labels:
additionalProperties:
type: string
description: Labels that should be added to the
created ACME HTTP01 solver pods.
type: object
type: object
spec:
description: PodSpec defines overrides for the HTTP01
challenge solver pod. Only the 'priorityClassName',
'nodeSelector', 'affinity', 'serviceAccountName'
and 'tolerations' fields are supported currently.
All other fields will be ignored.
properties:
affinity:
description: If specified, the pod's scheduling
constraints
properties:
nodeAffinity:
description: Describes node affinity scheduling
rules for the pod.
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the affinity expressions specified by
this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node matches the corresponding
matchExpressions; the node(s) with the
highest sum are the most preferred.
items:
description: An empty preferred scheduling
term matches all objects with implicit
weight 0 (i.e. it's a no-op). A null
preferred scheduling term matches
no objects (i.e. is also a no-op).
properties:
preference:
description: A node selector term,
associated with the corresponding
weight.
properties:
matchExpressions:
description: A list of node
selector requirements by node's
labels.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchFields:
description: A list of node
selector requirements by node's
fields.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
type: object
weight:
description: Weight associated with
matching the corresponding nodeSelectorTerm,
in the range 1-100.
format: int32
type: integer
required:
- preference
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to an update),
the system may or may not try to eventually
evict the pod from its node.
properties:
nodeSelectorTerms:
description: Required. A list of node
selector terms. The terms are ORed.
items:
description: A null or empty node
selector term matches no objects.
The requirements of them are ANDed.
The TopologySelectorTerm type
implements a subset of the NodeSelectorTerm.
properties:
matchExpressions:
description: A list of node
selector requirements by node's
labels.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchFields:
description: A list of node
selector requirements by node's
fields.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
type: object
type: array
required:
- nodeSelectorTerms
type: object
type: object
podAffinity:
description: Describes pod affinity scheduling
rules (e.g. co-locate this pod in the same
node, zone, etc. as some other pod(s)).
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the affinity expressions specified by
this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node has pods which matches the
corresponding podAffinityTerm; the node(s)
with the highest sum are the most preferred.
items:
description: The weights of all of the
matched WeightedPodAffinityTerm fields
are added per-node to find the most
preferred node(s)
properties:
podAffinityTerm:
description: Required. A pod affinity
term, associated with the corresponding
weight.
properties:
labelSelector:
description: A label query over
a set of resources, in this
case pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values,
a key, and an operator
that relates the key
and values.
properties:
key:
description: key is
the label key that
the selector applies
to.
type: string
operator:
description: operator
represents a key's
relationship to
a set of values.
Valid operators
are In, NotIn, Exists
and DoesNotExist.
type: string
values:
description: values
is an array of string
values. If the operator
is In or NotIn,
the values array
must be non-empty.
If the operator
is Exists or DoesNotExist,
the values array
must be empty. This
array is replaced
during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels
is a map of {key,value}
pairs. A single {key,value}
in the matchLabels map
is equivalent to an element
of matchExpressions, whose
key field is "key", the
operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should
be co-located (affinity) or
not co-located (anti-affinity)
with the pods matching the
labelSelector in the specified
namespaces, where co-located
is defined as running on a
node whose value of the label
with key topologyKey matches
that of any node on which
any of the selected pods is
running. Empty topologyKey
is not allowed.
type: string
required:
- topologyKey
type: object
weight:
description: weight associated with
matching the corresponding podAffinityTerm,
in the range 1-100.
format: int32
type: integer
required:
- podAffinityTerm
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to a pod label
update), the system may or may not try
to eventually evict the pod from its
node. When there are multiple elements,
the lists of nodes corresponding to
each podAffinityTerm are intersected,
i.e. all terms must be satisfied.
items:
description: Defines a set of pods (namely
those matching the labelSelector relative
to the given namespace(s)) that this
pod should be co-located (affinity)
or not co-located (anti-affinity)
with, where co-located is defined
as running on a node whose value of
the label with key <topologyKey> matches
that of any node on which a pod of
the set of pods is running
properties:
labelSelector:
description: A label query over
a set of resources, in this case
pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: key is the
label key that the selector
applies to.
type: string
operator:
description: operator
represents a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists and
DoesNotExist.
type: string
values:
description: values is
an array of string values.
If the operator is In
or NotIn, the values
array must be non-empty.
If the operator is Exists
or DoesNotExist, the
values array must be
empty. This array is
replaced during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels is
a map of {key,value} pairs.
A single {key,value} in the
matchLabels map is equivalent
to an element of matchExpressions,
whose key field is "key",
the operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should be
co-located (affinity) or not co-located
(anti-affinity) with the pods
matching the labelSelector in
the specified namespaces, where
co-located is defined as running
on a node whose value of the label
with key topologyKey matches that
of any node on which any of the
selected pods is running. Empty
topologyKey is not allowed.
type: string
required:
- topologyKey
type: object
type: array
type: object
podAntiAffinity:
description: Describes pod anti-affinity scheduling
rules (e.g. avoid putting this pod in the
same node, zone, etc. as some other pod(s)).
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the anti-affinity expressions specified
by this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling anti-affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node has pods which matches the
corresponding podAffinityTerm; the node(s)
with the highest sum are the most preferred.
items:
description: The weights of all of the
matched WeightedPodAffinityTerm fields
are added per-node to find the most
preferred node(s)
properties:
podAffinityTerm:
description: Required. A pod affinity
term, associated with the corresponding
weight.
properties:
labelSelector:
description: A label query over
a set of resources, in this
case pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values,
a key, and an operator
that relates the key
and values.
properties:
key:
description: key is
the label key that
the selector applies
to.
type: string
operator:
description: operator
represents a key's
relationship to
a set of values.
Valid operators
are In, NotIn, Exists
and DoesNotExist.
type: string
values:
description: values
is an array of string
values. If the operator
is In or NotIn,
the values array
must be non-empty.
If the operator
is Exists or DoesNotExist,
the values array
must be empty. This
array is replaced
during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels
is a map of {key,value}
pairs. A single {key,value}
in the matchLabels map
is equivalent to an element
of matchExpressions, whose
key field is "key", the
operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should
be co-located (affinity) or
not co-located (anti-affinity)
with the pods matching the
labelSelector in the specified
namespaces, where co-located
is defined as running on a
node whose value of the label
with key topologyKey matches
that of any node on which
any of the selected pods is
running. Empty topologyKey
is not allowed.
type: string
required:
- topologyKey
type: object
weight:
description: weight associated with
matching the corresponding podAffinityTerm,
in the range 1-100.
format: int32
type: integer
required:
- podAffinityTerm
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the anti-affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the anti-affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to a pod label
update), the system may or may not try
to eventually evict the pod from its
node. When there are multiple elements,
the lists of nodes corresponding to
each podAffinityTerm are intersected,
i.e. all terms must be satisfied.
items:
description: Defines a set of pods (namely
those matching the labelSelector relative
to the given namespace(s)) that this
pod should be co-located (affinity)
or not co-located (anti-affinity)
with, where co-located is defined
as running on a node whose value of
the label with key <topologyKey> matches
that of any node on which a pod of
the set of pods is running
properties:
labelSelector:
description: A label query over
a set of resources, in this case
pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: key is the
label key that the selector
applies to.
type: string
operator:
description: operator
represents a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists and
DoesNotExist.
type: string
values:
description: values is
an array of string values.
If the operator is In
or NotIn, the values
array must be non-empty.
If the operator is Exists
or DoesNotExist, the
values array must be
empty. This array is
replaced during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels is
a map of {key,value} pairs.
A single {key,value} in the
matchLabels map is equivalent
to an element of matchExpressions,
whose key field is "key",
the operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should be
co-located (affinity) or not co-located
(anti-affinity) with the pods
matching the labelSelector in
the specified namespaces, where
co-located is defined as running
on a node whose value of the label
with key topologyKey matches that
of any node on which any of the
selected pods is running. Empty
topologyKey is not allowed.
type: string
required:
- topologyKey
type: object
type: array
type: object
type: object
nodeSelector:
additionalProperties:
type: string
description: 'NodeSelector is a selector which
must be true for the pod to fit on a node. Selector
which must match a node''s labels for the pod
to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
priorityClassName:
description: If specified, the pod's priorityClassName.
type: string
serviceAccountName:
description: If specified, the pod's service account
type: string
tolerations:
description: If specified, the pod's tolerations.
items:
description: The pod this Toleration is attached
to tolerates any taint that matches the triple
<key,value,effect> using the matching operator
<operator>.
properties:
effect:
description: Effect indicates the taint
effect to match. Empty means match all
taint effects. When specified, allowed
values are NoSchedule, PreferNoSchedule
and NoExecute.
type: string
key:
description: Key is the taint key that the
toleration applies to. Empty means match
all taint keys. If the key is empty, operator
must be Exists; this combination means
to match all values and all keys.
type: string
operator:
description: Operator represents a key's
relationship to the value. Valid operators
are Exists and Equal. Defaults to Equal.
Exists is equivalent to wildcard for value,
so that a pod can tolerate all taints
of a particular category.
type: string
tolerationSeconds:
description: TolerationSeconds represents
the period of time the toleration (which
must be of effect NoExecute, otherwise
this field is ignored) tolerates the taint.
By default, it is not set, which means
tolerate the taint forever (do not evict).
Zero and negative values will be treated
as 0 (evict immediately) by the system.
format: int64
type: integer
value:
description: Value is the taint value the
toleration matches to. If the operator
is Exists, the value should be empty,
otherwise just a regular string.
type: string
type: object
type: array
type: object
type: object
serviceType:
description: Optional service type for Kubernetes solver
service
type: string
type: object
type: object
selector:
description: Selector selects a set of DNSNames on the Certificate
resource that should be solved using this challenge solver.
If not specified, the solver will be treated as the 'default'
solver with the lowest priority, i.e. if any other solver has
a more specific match, it will be used instead.
properties:
dnsNames:
description: List of DNSNames that this solver will be used
to solve. If specified and a match is found, a dnsNames
selector will take precedence over a dnsZones selector.
If multiple solvers match with the same dnsNames value,
the solver with the most matching labels in matchLabels
will be selected. If neither has more matches, the solver
defined earlier in the list will be selected.
items:
type: string
type: array
dnsZones:
description: List of DNSZones that this solver will be used
to solve. The most specific DNS zone match specified here
will take precedence over other DNS zone matches, so a solver
specifying sys.example.com will be selected over one specifying
example.com for the domain www.sys.example.com. If multiple
solvers match with the same dnsZones value, the solver with
the most matching labels in matchLabels will be selected.
If neither has more matches, the solver defined earlier
in the list will be selected.
items:
type: string
type: array
matchLabels:
additionalProperties:
type: string
description: A label selector that is used to refine the set
of certificate's that this challenge solver will apply to.
type: object
type: object
type: object
token:
description: Token is the ACME challenge token for this challenge.
This is the raw value returned from the ACME server.
type: string
type:
description: Type is the type of ACME challenge this resource represents.
One of "http-01" or "dns-01".
enum:
- http-01
- dns-01
type: string
url:
description: URL is the URL of the ACME Challenge resource for this
challenge. This can be used to lookup details about the status of
this challenge.
type: string
wildcard:
description: Wildcard will be true if this challenge is for a wildcard
identifier, for example '*.example.com'.
type: boolean
required:
- authzURL
- dnsName
- issuerRef
- key
- solver
- token
- type
- url
type: object
status:
properties:
presented:
description: Presented will be set to true if the challenge values
for this challenge are currently 'presented'. This *does not* imply
the self check is passing. Only that the values have been 'submitted'
for the appropriate challenge mechanism (i.e. the DNS01 TXT record
has been presented, or the HTTP01 configuration has been configured).
type: boolean
processing:
description: Processing is used to denote whether this challenge should
be processed or not. This field will only be set to true by the
'scheduling' component. It will only be set to false by the 'challenges'
controller, after the challenge has reached a final state or timed
out. If this field is set to false, the challenge controller will
not take any more action.
type: boolean
reason:
description: Reason contains human readable information on why the
Challenge is in the current state.
type: string
state:
description: State contains the current 'state' of the challenge.
If not set, the state of the challenge is unknown.
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
type: string
type: object
required:
- metadata
type: object
served: true
storage: false
subresources:
status: {}
- additionalPrinterColumns:
- jsonPath: .status.state
name: State
type: string
- jsonPath: .spec.dnsName
name: Domain
type: string
- jsonPath: .status.reason
name: Reason
priority: 1
type: string
- description: CreationTimestamp is a timestamp representing the server time when
this object was created. It is not guaranteed to be set in happens-before
order across separate operations. Clients may not set this value. It is represented
in RFC3339 form and is in UTC.
jsonPath: .metadata.creationTimestamp
name: Age
type: date
name: v1beta1
schema:
openAPIV3Schema:
description: Challenge is a type to represent a Challenge request with an
ACME server
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
properties:
authorizationURL:
description: The URL to the ACME Authorization resource that this
challenge is a part of.
type: string
dnsName:
description: dnsName is the identifier that this challenge is for,
e.g. example.com. If the requested DNSName is a 'wildcard', this
field MUST be set to the non-wildcard domain, e.g. for `*.example.com`,
it must be `example.com`.
type: string
issuerRef:
description: References a properly configured ACME-type Issuer which
should be used to create this Challenge. If the Issuer does not
exist, processing will be retried. If the Issuer is not an 'ACME'
Issuer, an error will be returned and the Challenge will be marked
as failed.
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
required:
- name
type: object
key:
description: 'The ACME challenge key for this challenge For HTTP01
challenges, this is the value that must be responded with to complete
the HTTP01 challenge in the format: `<private key JWK thumbprint>.<key
from acme server for challenge>`. For DNS01 challenges, this is
the base64 encoded SHA256 sum of the `<private key JWK thumbprint>.<key
from acme server for challenge>` text that must be set as the TXT
record content.'
type: string
solver:
description: Contains the domain solving configuration that should
be used to solve this challenge resource.
properties:
dns01:
description: Configures cert-manager to attempt to complete authorizations
by performing the DNS01 challenge flow.
properties:
acmeDNS:
description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns)
API to manage DNS01 challenge records.
properties:
accountSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
host:
type: string
required:
- accountSecretRef
- host
type: object
akamai:
description: Use the Akamai DNS zone management API to manage
DNS01 challenge records.
properties:
accessTokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
clientSecretSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
clientTokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
serviceConsumerDomain:
type: string
required:
- accessTokenSecretRef
- clientSecretSecretRef
- clientTokenSecretRef
- serviceConsumerDomain
type: object
azureDNS:
description: Use the Microsoft Azure DNS API to manage DNS01
challenge records.
properties:
clientID:
description: if both this and ClientSecret are left unset
MSI will be used
type: string
clientSecretSecretRef:
description: if both this and ClientID are left unset
MSI will be used
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
environment:
enum:
- AzurePublicCloud
- AzureChinaCloud
- AzureGermanCloud
- AzureUSGovernmentCloud
type: string
hostedZoneName:
type: string
resourceGroupName:
type: string
subscriptionID:
type: string
tenantID:
description: when specifying ClientID and ClientSecret
then this field is also needed
type: string
required:
- resourceGroupName
- subscriptionID
type: object
cloudDNS:
description: Use the Google Cloud DNS API to manage DNS01
challenge records.
properties:
hostedZoneName:
description: HostedZoneName is an optional field that
tells cert-manager in which Cloud DNS zone the challenge
record has to be created. If left empty cert-manager
will automatically choose a zone.
type: string
project:
type: string
serviceAccountSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- project
type: object
cloudflare:
description: Use the Cloudflare API to manage DNS01 challenge
records.
properties:
apiKeySecretRef:
description: 'API key to use to authenticate with Cloudflare.
Note: using an API token to authenticate is now the
recommended method as it allows greater control of permissions.'
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
apiTokenSecretRef:
description: API token used to authenticate with Cloudflare.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
email:
description: Email of the account, only required when
using API key based authentication.
type: string
type: object
cnameStrategy:
description: CNAMEStrategy configures how the DNS01 provider
should handle CNAME records when found in DNS zones.
enum:
- None
- Follow
type: string
digitalocean:
description: Use the DigitalOcean DNS API to manage DNS01
challenge records.
properties:
tokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- tokenSecretRef
type: object
rfc2136:
description: Use RFC2136 ("Dynamic Updates in the Domain Name
System") (https://datatracker.ietf.org/doc/rfc2136/) to
manage DNS01 challenge records.
properties:
nameserver:
description: The IP address or hostname of an authoritative
DNS server supporting RFC2136 in the form host:port.
If the host is an IPv6 address it must be enclosed in
square brackets (e.g [2001:db8::1]) ; port is optional.
This field is required.
type: string
tsigAlgorithm:
description: 'The TSIG Algorithm configured in the DNS
supporting RFC2136. Used only when ``tsigSecretSecretRef``
and ``tsigKeyName`` are defined. Supported values are
(case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``,
``HMACSHA256`` or ``HMACSHA512``.'
type: string
tsigKeyName:
description: The TSIG Key name configured in the DNS.
If ``tsigSecretSecretRef`` is defined, this field is
required.
type: string
tsigSecretSecretRef:
description: The name of the secret containing the TSIG
value. If ``tsigKeyName`` is defined, this field is
required.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- nameserver
type: object
route53:
description: Use the AWS Route53 API to manage DNS01 challenge
records.
properties:
accessKeyID:
description: 'The AccessKeyID is used for authentication.
If not set we fall-back to using env vars, shared credentials
file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
type: string
hostedZoneID:
description: If set, the provider will manage only this
zone in Route53 and will not do an lookup using the
route53:ListHostedZonesByName api call.
type: string
region:
description: Always set the region when using AccessKeyID
and SecretAccessKey
type: string
role:
description: Role is a Role ARN which the Route53 provider
will assume using either the explicit credentials AccessKeyID/SecretAccessKey
or the inferred credentials from environment variables,
shared credentials file or AWS Instance metadata
type: string
secretAccessKeySecretRef:
description: The SecretAccessKey is used for authentication.
If not set we fall-back to using env vars, shared credentials
file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- region
type: object
webhook:
description: Configure an external webhook based DNS01 challenge
solver to manage DNS01 challenge records.
properties:
config:
description: Additional configuration that should be passed
to the webhook apiserver when challenges are processed.
This can contain arbitrary JSON data. Secret values
should not be specified in this stanza. If secret values
are needed (e.g. credentials for a DNS service), you
should use a SecretKeySelector to reference a Secret
resource. For details on the schema of this field, consult
the webhook provider implementation's documentation.
x-kubernetes-preserve-unknown-fields: true
groupName:
description: The API group name that should be used when
POSTing ChallengePayload resources to the webhook apiserver.
This should be the same as the GroupName specified in
the webhook provider implementation.
type: string
solverName:
description: The name of the solver to use, as defined
in the webhook provider implementation. This will typically
be the name of the provider, e.g. 'cloudflare'.
type: string
required:
- groupName
- solverName
type: object
type: object
http01:
description: Configures cert-manager to attempt to complete authorizations
by performing the HTTP01 challenge flow. It is not possible
to obtain certificates for wildcard domain names (e.g. `*.example.com`)
using the HTTP01 challenge mechanism.
properties:
ingress:
description: The ingress based HTTP01 challenge solver will
solve challenges by creating or modifying Ingress resources
in order to route requests for '/.well-known/acme-challenge/XYZ'
to 'challenge solver' pods that are provisioned by cert-manager
for each Challenge to be completed.
properties:
class:
description: The ingress class to use when creating Ingress
resources to solve ACME challenges that use this challenge
solver. Only one of 'class' or 'name' may be specified.
type: string
ingressTemplate:
description: Optional ingress template used to configure
the ACME challenge solver ingress used for HTTP01 challenges
properties:
metadata:
description: ObjectMeta overrides for the ingress
used to solve HTTP01 challenges. Only the 'labels'
and 'annotations' fields may be set. If labels or
annotations overlap with in-built values, the values
here will override the in-built values.
properties:
annotations:
additionalProperties:
type: string
description: Annotations that should be added
to the created ACME HTTP01 solver ingress.
type: object
labels:
additionalProperties:
type: string
description: Labels that should be added to the
created ACME HTTP01 solver ingress.
type: object
type: object
type: object
name:
description: The name of the ingress resource that should
have ACME challenge solving routes inserted into it
in order to solve HTTP01 challenges. This is typically
used in conjunction with ingress controllers like ingress-gce,
which maintains a 1:1 mapping between external IPs and
ingress resources.
type: string
podTemplate:
description: Optional pod template used to configure the
ACME challenge solver pods used for HTTP01 challenges
properties:
metadata:
description: ObjectMeta overrides for the pod used
to solve HTTP01 challenges. Only the 'labels' and
'annotations' fields may be set. If labels or annotations
overlap with in-built values, the values here will
override the in-built values.
properties:
annotations:
additionalProperties:
type: string
description: Annotations that should be added
to the create ACME HTTP01 solver pods.
type: object
labels:
additionalProperties:
type: string
description: Labels that should be added to the
created ACME HTTP01 solver pods.
type: object
type: object
spec:
description: PodSpec defines overrides for the HTTP01
challenge solver pod. Only the 'priorityClassName',
'nodeSelector', 'affinity', 'serviceAccountName'
and 'tolerations' fields are supported currently.
All other fields will be ignored.
properties:
affinity:
description: If specified, the pod's scheduling
constraints
properties:
nodeAffinity:
description: Describes node affinity scheduling
rules for the pod.
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the affinity expressions specified by
this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node matches the corresponding
matchExpressions; the node(s) with the
highest sum are the most preferred.
items:
description: An empty preferred scheduling
term matches all objects with implicit
weight 0 (i.e. it's a no-op). A null
preferred scheduling term matches
no objects (i.e. is also a no-op).
properties:
preference:
description: A node selector term,
associated with the corresponding
weight.
properties:
matchExpressions:
description: A list of node
selector requirements by node's
labels.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchFields:
description: A list of node
selector requirements by node's
fields.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
type: object
weight:
description: Weight associated with
matching the corresponding nodeSelectorTerm,
in the range 1-100.
format: int32
type: integer
required:
- preference
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to an update),
the system may or may not try to eventually
evict the pod from its node.
properties:
nodeSelectorTerms:
description: Required. A list of node
selector terms. The terms are ORed.
items:
description: A null or empty node
selector term matches no objects.
The requirements of them are ANDed.
The TopologySelectorTerm type
implements a subset of the NodeSelectorTerm.
properties:
matchExpressions:
description: A list of node
selector requirements by node's
labels.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchFields:
description: A list of node
selector requirements by node's
fields.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
type: object
type: array
required:
- nodeSelectorTerms
type: object
type: object
podAffinity:
description: Describes pod affinity scheduling
rules (e.g. co-locate this pod in the same
node, zone, etc. as some other pod(s)).
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the affinity expressions specified by
this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node has pods which matches the
corresponding podAffinityTerm; the node(s)
with the highest sum are the most preferred.
items:
description: The weights of all of the
matched WeightedPodAffinityTerm fields
are added per-node to find the most
preferred node(s)
properties:
podAffinityTerm:
description: Required. A pod affinity
term, associated with the corresponding
weight.
properties:
labelSelector:
description: A label query over
a set of resources, in this
case pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values,
a key, and an operator
that relates the key
and values.
properties:
key:
description: key is
the label key that
the selector applies
to.
type: string
operator:
description: operator
represents a key's
relationship to
a set of values.
Valid operators
are In, NotIn, Exists
and DoesNotExist.
type: string
values:
description: values
is an array of string
values. If the operator
is In or NotIn,
the values array
must be non-empty.
If the operator
is Exists or DoesNotExist,
the values array
must be empty. This
array is replaced
during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels
is a map of {key,value}
pairs. A single {key,value}
in the matchLabels map
is equivalent to an element
of matchExpressions, whose
key field is "key", the
operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should
be co-located (affinity) or
not co-located (anti-affinity)
with the pods matching the
labelSelector in the specified
namespaces, where co-located
is defined as running on a
node whose value of the label
with key topologyKey matches
that of any node on which
any of the selected pods is
running. Empty topologyKey
is not allowed.
type: string
required:
- topologyKey
type: object
weight:
description: weight associated with
matching the corresponding podAffinityTerm,
in the range 1-100.
format: int32
type: integer
required:
- podAffinityTerm
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to a pod label
update), the system may or may not try
to eventually evict the pod from its
node. When there are multiple elements,
the lists of nodes corresponding to
each podAffinityTerm are intersected,
i.e. all terms must be satisfied.
items:
description: Defines a set of pods (namely
those matching the labelSelector relative
to the given namespace(s)) that this
pod should be co-located (affinity)
or not co-located (anti-affinity)
with, where co-located is defined
as running on a node whose value of
the label with key <topologyKey> matches
that of any node on which a pod of
the set of pods is running
properties:
labelSelector:
description: A label query over
a set of resources, in this case
pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: key is the
label key that the selector
applies to.
type: string
operator:
description: operator
represents a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists and
DoesNotExist.
type: string
values:
description: values is
an array of string values.
If the operator is In
or NotIn, the values
array must be non-empty.
If the operator is Exists
or DoesNotExist, the
values array must be
empty. This array is
replaced during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels is
a map of {key,value} pairs.
A single {key,value} in the
matchLabels map is equivalent
to an element of matchExpressions,
whose key field is "key",
the operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should be
co-located (affinity) or not co-located
(anti-affinity) with the pods
matching the labelSelector in
the specified namespaces, where
co-located is defined as running
on a node whose value of the label
with key topologyKey matches that
of any node on which any of the
selected pods is running. Empty
topologyKey is not allowed.
type: string
required:
- topologyKey
type: object
type: array
type: object
podAntiAffinity:
description: Describes pod anti-affinity scheduling
rules (e.g. avoid putting this pod in the
same node, zone, etc. as some other pod(s)).
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the anti-affinity expressions specified
by this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling anti-affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node has pods which matches the
corresponding podAffinityTerm; the node(s)
with the highest sum are the most preferred.
items:
description: The weights of all of the
matched WeightedPodAffinityTerm fields
are added per-node to find the most
preferred node(s)
properties:
podAffinityTerm:
description: Required. A pod affinity
term, associated with the corresponding
weight.
properties:
labelSelector:
description: A label query over
a set of resources, in this
case pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values,
a key, and an operator
that relates the key
and values.
properties:
key:
description: key is
the label key that
the selector applies
to.
type: string
operator:
description: operator
represents a key's
relationship to
a set of values.
Valid operators
are In, NotIn, Exists
and DoesNotExist.
type: string
values:
description: values
is an array of string
values. If the operator
is In or NotIn,
the values array
must be non-empty.
If the operator
is Exists or DoesNotExist,
the values array
must be empty. This
array is replaced
during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels
is a map of {key,value}
pairs. A single {key,value}
in the matchLabels map
is equivalent to an element
of matchExpressions, whose
key field is "key", the
operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should
be co-located (affinity) or
not co-located (anti-affinity)
with the pods matching the
labelSelector in the specified
namespaces, where co-located
is defined as running on a
node whose value of the label
with key topologyKey matches
that of any node on which
any of the selected pods is
running. Empty topologyKey
is not allowed.
type: string
required:
- topologyKey
type: object
weight:
description: weight associated with
matching the corresponding podAffinityTerm,
in the range 1-100.
format: int32
type: integer
required:
- podAffinityTerm
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the anti-affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the anti-affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to a pod label
update), the system may or may not try
to eventually evict the pod from its
node. When there are multiple elements,
the lists of nodes corresponding to
each podAffinityTerm are intersected,
i.e. all terms must be satisfied.
items:
description: Defines a set of pods (namely
those matching the labelSelector relative
to the given namespace(s)) that this
pod should be co-located (affinity)
or not co-located (anti-affinity)
with, where co-located is defined
as running on a node whose value of
the label with key <topologyKey> matches
that of any node on which a pod of
the set of pods is running
properties:
labelSelector:
description: A label query over
a set of resources, in this case
pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: key is the
label key that the selector
applies to.
type: string
operator:
description: operator
represents a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists and
DoesNotExist.
type: string
values:
description: values is
an array of string values.
If the operator is In
or NotIn, the values
array must be non-empty.
If the operator is Exists
or DoesNotExist, the
values array must be
empty. This array is
replaced during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels is
a map of {key,value} pairs.
A single {key,value} in the
matchLabels map is equivalent
to an element of matchExpressions,
whose key field is "key",
the operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should be
co-located (affinity) or not co-located
(anti-affinity) with the pods
matching the labelSelector in
the specified namespaces, where
co-located is defined as running
on a node whose value of the label
with key topologyKey matches that
of any node on which any of the
selected pods is running. Empty
topologyKey is not allowed.
type: string
required:
- topologyKey
type: object
type: array
type: object
type: object
nodeSelector:
additionalProperties:
type: string
description: 'NodeSelector is a selector which
must be true for the pod to fit on a node. Selector
which must match a node''s labels for the pod
to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
priorityClassName:
description: If specified, the pod's priorityClassName.
type: string
serviceAccountName:
description: If specified, the pod's service account
type: string
tolerations:
description: If specified, the pod's tolerations.
items:
description: The pod this Toleration is attached
to tolerates any taint that matches the triple
<key,value,effect> using the matching operator
<operator>.
properties:
effect:
description: Effect indicates the taint
effect to match. Empty means match all
taint effects. When specified, allowed
values are NoSchedule, PreferNoSchedule
and NoExecute.
type: string
key:
description: Key is the taint key that the
toleration applies to. Empty means match
all taint keys. If the key is empty, operator
must be Exists; this combination means
to match all values and all keys.
type: string
operator:
description: Operator represents a key's
relationship to the value. Valid operators
are Exists and Equal. Defaults to Equal.
Exists is equivalent to wildcard for value,
so that a pod can tolerate all taints
of a particular category.
type: string
tolerationSeconds:
description: TolerationSeconds represents
the period of time the toleration (which
must be of effect NoExecute, otherwise
this field is ignored) tolerates the taint.
By default, it is not set, which means
tolerate the taint forever (do not evict).
Zero and negative values will be treated
as 0 (evict immediately) by the system.
format: int64
type: integer
value:
description: Value is the taint value the
toleration matches to. If the operator
is Exists, the value should be empty,
otherwise just a regular string.
type: string
type: object
type: array
type: object
type: object
serviceType:
description: Optional service type for Kubernetes solver
service
type: string
type: object
type: object
selector:
description: Selector selects a set of DNSNames on the Certificate
resource that should be solved using this challenge solver.
If not specified, the solver will be treated as the 'default'
solver with the lowest priority, i.e. if any other solver has
a more specific match, it will be used instead.
properties:
dnsNames:
description: List of DNSNames that this solver will be used
to solve. If specified and a match is found, a dnsNames
selector will take precedence over a dnsZones selector.
If multiple solvers match with the same dnsNames value,
the solver with the most matching labels in matchLabels
will be selected. If neither has more matches, the solver
defined earlier in the list will be selected.
items:
type: string
type: array
dnsZones:
description: List of DNSZones that this solver will be used
to solve. The most specific DNS zone match specified here
will take precedence over other DNS zone matches, so a solver
specifying sys.example.com will be selected over one specifying
example.com for the domain www.sys.example.com. If multiple
solvers match with the same dnsZones value, the solver with
the most matching labels in matchLabels will be selected.
If neither has more matches, the solver defined earlier
in the list will be selected.
items:
type: string
type: array
matchLabels:
additionalProperties:
type: string
description: A label selector that is used to refine the set
of certificate's that this challenge solver will apply to.
type: object
type: object
type: object
token:
description: The ACME challenge token for this challenge. This is
the raw value returned from the ACME server.
type: string
type:
description: The type of ACME challenge this resource represents.
One of "HTTP-01" or "DNS-01".
enum:
- HTTP-01
- DNS-01
type: string
url:
description: The URL of the ACME Challenge resource for this challenge.
This can be used to lookup details about the status of this challenge.
type: string
wildcard:
description: wildcard will be true if this challenge is for a wildcard
identifier, for example '*.example.com'.
type: boolean
required:
- authorizationURL
- dnsName
- issuerRef
- key
- solver
- token
- type
- url
type: object
status:
properties:
presented:
description: presented will be set to true if the challenge values
for this challenge are currently 'presented'. This *does not* imply
the self check is passing. Only that the values have been 'submitted'
for the appropriate challenge mechanism (i.e. the DNS01 TXT record
has been presented, or the HTTP01 configuration has been configured).
type: boolean
processing:
description: Used to denote whether this challenge should be processed
or not. This field will only be set to true by the 'scheduling'
component. It will only be set to false by the 'challenges' controller,
after the challenge has reached a final state or timed out. If this
field is set to false, the challenge controller will not take any
more action.
type: boolean
reason:
description: Contains human readable information on why the Challenge
is in the current state.
type: string
state:
description: Contains the current 'state' of the challenge. If not
set, the state of the challenge is unknown.
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
type: string
type: object
required:
- metadata
- spec
type: object
served: true
storage: false
subresources:
status: {}
- additionalPrinterColumns:
- jsonPath: .status.state
name: State
type: string
- jsonPath: .spec.dnsName
name: Domain
type: string
- jsonPath: .status.reason
name: Reason
priority: 1
type: string
- description: CreationTimestamp is a timestamp representing the server time when
this object was created. It is not guaranteed to be set in happens-before
order across separate operations. Clients may not set this value. It is represented
in RFC3339 form and is in UTC.
jsonPath: .metadata.creationTimestamp
name: Age
type: date
name: v1
schema:
openAPIV3Schema:
description: Challenge is a type to represent a Challenge request with an
ACME server
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
properties:
authorizationURL:
description: The URL to the ACME Authorization resource that this
challenge is a part of.
type: string
dnsName:
description: dnsName is the identifier that this challenge is for,
e.g. example.com. If the requested DNSName is a 'wildcard', this
field MUST be set to the non-wildcard domain, e.g. for `*.example.com`,
it must be `example.com`.
type: string
issuerRef:
description: References a properly configured ACME-type Issuer which
should be used to create this Challenge. If the Issuer does not
exist, processing will be retried. If the Issuer is not an 'ACME'
Issuer, an error will be returned and the Challenge will be marked
as failed.
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
required:
- name
type: object
key:
description: 'The ACME challenge key for this challenge For HTTP01
challenges, this is the value that must be responded with to complete
the HTTP01 challenge in the format: `<private key JWK thumbprint>.<key
from acme server for challenge>`. For DNS01 challenges, this is
the base64 encoded SHA256 sum of the `<private key JWK thumbprint>.<key
from acme server for challenge>` text that must be set as the TXT
record content.'
type: string
solver:
description: Contains the domain solving configuration that should
be used to solve this challenge resource.
properties:
dns01:
description: Configures cert-manager to attempt to complete authorizations
by performing the DNS01 challenge flow.
properties:
acmeDNS:
description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns)
API to manage DNS01 challenge records.
properties:
accountSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
host:
type: string
required:
- accountSecretRef
- host
type: object
akamai:
description: Use the Akamai DNS zone management API to manage
DNS01 challenge records.
properties:
accessTokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
clientSecretSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
clientTokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
serviceConsumerDomain:
type: string
required:
- accessTokenSecretRef
- clientSecretSecretRef
- clientTokenSecretRef
- serviceConsumerDomain
type: object
azureDNS:
description: Use the Microsoft Azure DNS API to manage DNS01
challenge records.
properties:
clientID:
description: if both this and ClientSecret are left unset
MSI will be used
type: string
clientSecretSecretRef:
description: if both this and ClientID are left unset
MSI will be used
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
environment:
enum:
- AzurePublicCloud
- AzureChinaCloud
- AzureGermanCloud
- AzureUSGovernmentCloud
type: string
hostedZoneName:
type: string
resourceGroupName:
type: string
subscriptionID:
type: string
tenantID:
description: when specifying ClientID and ClientSecret
then this field is also needed
type: string
required:
- resourceGroupName
- subscriptionID
type: object
cloudDNS:
description: Use the Google Cloud DNS API to manage DNS01
challenge records.
properties:
hostedZoneName:
description: HostedZoneName is an optional field that
tells cert-manager in which Cloud DNS zone the challenge
record has to be created. If left empty cert-manager
will automatically choose a zone.
type: string
project:
type: string
serviceAccountSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- project
type: object
cloudflare:
description: Use the Cloudflare API to manage DNS01 challenge
records.
properties:
apiKeySecretRef:
description: 'API key to use to authenticate with Cloudflare.
Note: using an API token to authenticate is now the
recommended method as it allows greater control of permissions.'
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
apiTokenSecretRef:
description: API token used to authenticate with Cloudflare.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
email:
description: Email of the account, only required when
using API key based authentication.
type: string
type: object
cnameStrategy:
description: CNAMEStrategy configures how the DNS01 provider
should handle CNAME records when found in DNS zones.
enum:
- None
- Follow
type: string
digitalocean:
description: Use the DigitalOcean DNS API to manage DNS01
challenge records.
properties:
tokenSecretRef:
description: A reference to a specific 'key' within a
Secret resource. In some instances, `key` is a required
field.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- tokenSecretRef
type: object
rfc2136:
description: Use RFC2136 ("Dynamic Updates in the Domain Name
System") (https://datatracker.ietf.org/doc/rfc2136/) to
manage DNS01 challenge records.
properties:
nameserver:
description: The IP address or hostname of an authoritative
DNS server supporting RFC2136 in the form host:port.
If the host is an IPv6 address it must be enclosed in
square brackets (e.g [2001:db8::1]) ; port is optional.
This field is required.
type: string
tsigAlgorithm:
description: 'The TSIG Algorithm configured in the DNS
supporting RFC2136. Used only when ``tsigSecretSecretRef``
and ``tsigKeyName`` are defined. Supported values are
(case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``,
``HMACSHA256`` or ``HMACSHA512``.'
type: string
tsigKeyName:
description: The TSIG Key name configured in the DNS.
If ``tsigSecretSecretRef`` is defined, this field is
required.
type: string
tsigSecretSecretRef:
description: The name of the secret containing the TSIG
value. If ``tsigKeyName`` is defined, this field is
required.
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- nameserver
type: object
route53:
description: Use the AWS Route53 API to manage DNS01 challenge
records.
properties:
accessKeyID:
description: 'The AccessKeyID is used for authentication.
If not set we fall-back to using env vars, shared credentials
file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
type: string
hostedZoneID:
description: If set, the provider will manage only this
zone in Route53 and will not do an lookup using the
route53:ListHostedZonesByName api call.
type: string
region:
description: Always set the region when using AccessKeyID
and SecretAccessKey
type: string
role:
description: Role is a Role ARN which the Route53 provider
will assume using either the explicit credentials AccessKeyID/SecretAccessKey
or the inferred credentials from environment variables,
shared credentials file or AWS Instance metadata
type: string
secretAccessKeySecretRef:
description: The SecretAccessKey is used for authentication.
If not set we fall-back to using env vars, shared credentials
file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
properties:
key:
description: The key of the entry in the Secret resource's
`data` field to be used. Some instances of this
field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
required:
- name
type: object
required:
- region
type: object
webhook:
description: Configure an external webhook based DNS01 challenge
solver to manage DNS01 challenge records.
properties:
config:
description: Additional configuration that should be passed
to the webhook apiserver when challenges are processed.
This can contain arbitrary JSON data. Secret values
should not be specified in this stanza. If secret values
are needed (e.g. credentials for a DNS service), you
should use a SecretKeySelector to reference a Secret
resource. For details on the schema of this field, consult
the webhook provider implementation's documentation.
x-kubernetes-preserve-unknown-fields: true
groupName:
description: The API group name that should be used when
POSTing ChallengePayload resources to the webhook apiserver.
This should be the same as the GroupName specified in
the webhook provider implementation.
type: string
solverName:
description: The name of the solver to use, as defined
in the webhook provider implementation. This will typically
be the name of the provider, e.g. 'cloudflare'.
type: string
required:
- groupName
- solverName
type: object
type: object
http01:
description: Configures cert-manager to attempt to complete authorizations
by performing the HTTP01 challenge flow. It is not possible
to obtain certificates for wildcard domain names (e.g. `*.example.com`)
using the HTTP01 challenge mechanism.
properties:
ingress:
description: The ingress based HTTP01 challenge solver will
solve challenges by creating or modifying Ingress resources
in order to route requests for '/.well-known/acme-challenge/XYZ'
to 'challenge solver' pods that are provisioned by cert-manager
for each Challenge to be completed.
properties:
class:
description: The ingress class to use when creating Ingress
resources to solve ACME challenges that use this challenge
solver. Only one of 'class' or 'name' may be specified.
type: string
ingressTemplate:
description: Optional ingress template used to configure
the ACME challenge solver ingress used for HTTP01 challenges
properties:
metadata:
description: ObjectMeta overrides for the ingress
used to solve HTTP01 challenges. Only the 'labels'
and 'annotations' fields may be set. If labels or
annotations overlap with in-built values, the values
here will override the in-built values.
properties:
annotations:
additionalProperties:
type: string
description: Annotations that should be added
to the created ACME HTTP01 solver ingress.
type: object
labels:
additionalProperties:
type: string
description: Labels that should be added to the
created ACME HTTP01 solver ingress.
type: object
type: object
type: object
name:
description: The name of the ingress resource that should
have ACME challenge solving routes inserted into it
in order to solve HTTP01 challenges. This is typically
used in conjunction with ingress controllers like ingress-gce,
which maintains a 1:1 mapping between external IPs and
ingress resources.
type: string
podTemplate:
description: Optional pod template used to configure the
ACME challenge solver pods used for HTTP01 challenges
properties:
metadata:
description: ObjectMeta overrides for the pod used
to solve HTTP01 challenges. Only the 'labels' and
'annotations' fields may be set. If labels or annotations
overlap with in-built values, the values here will
override the in-built values.
properties:
annotations:
additionalProperties:
type: string
description: Annotations that should be added
to the create ACME HTTP01 solver pods.
type: object
labels:
additionalProperties:
type: string
description: Labels that should be added to the
created ACME HTTP01 solver pods.
type: object
type: object
spec:
description: PodSpec defines overrides for the HTTP01
challenge solver pod. Only the 'priorityClassName',
'nodeSelector', 'affinity', 'serviceAccountName'
and 'tolerations' fields are supported currently.
All other fields will be ignored.
properties:
affinity:
description: If specified, the pod's scheduling
constraints
properties:
nodeAffinity:
description: Describes node affinity scheduling
rules for the pod.
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the affinity expressions specified by
this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node matches the corresponding
matchExpressions; the node(s) with the
highest sum are the most preferred.
items:
description: An empty preferred scheduling
term matches all objects with implicit
weight 0 (i.e. it's a no-op). A null
preferred scheduling term matches
no objects (i.e. is also a no-op).
properties:
preference:
description: A node selector term,
associated with the corresponding
weight.
properties:
matchExpressions:
description: A list of node
selector requirements by node's
labels.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchFields:
description: A list of node
selector requirements by node's
fields.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
type: object
weight:
description: Weight associated with
matching the corresponding nodeSelectorTerm,
in the range 1-100.
format: int32
type: integer
required:
- preference
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to an update),
the system may or may not try to eventually
evict the pod from its node.
properties:
nodeSelectorTerms:
description: Required. A list of node
selector terms. The terms are ORed.
items:
description: A null or empty node
selector term matches no objects.
The requirements of them are ANDed.
The TopologySelectorTerm type
implements a subset of the NodeSelectorTerm.
properties:
matchExpressions:
description: A list of node
selector requirements by node's
labels.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchFields:
description: A list of node
selector requirements by node's
fields.
items:
description: A node selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: The label
key that the selector
applies to.
type: string
operator:
description: Represents
a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists, DoesNotExist.
Gt, and Lt.
type: string
values:
description: An array
of string values. If
the operator is In or
NotIn, the values array
must be non-empty. If
the operator is Exists
or DoesNotExist, the
values array must be
empty. If the operator
is Gt or Lt, the values
array must have a single
element, which will
be interpreted as an
integer. This array
is replaced during a
strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
type: object
type: array
required:
- nodeSelectorTerms
type: object
type: object
podAffinity:
description: Describes pod affinity scheduling
rules (e.g. co-locate this pod in the same
node, zone, etc. as some other pod(s)).
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the affinity expressions specified by
this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node has pods which matches the
corresponding podAffinityTerm; the node(s)
with the highest sum are the most preferred.
items:
description: The weights of all of the
matched WeightedPodAffinityTerm fields
are added per-node to find the most
preferred node(s)
properties:
podAffinityTerm:
description: Required. A pod affinity
term, associated with the corresponding
weight.
properties:
labelSelector:
description: A label query over
a set of resources, in this
case pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values,
a key, and an operator
that relates the key
and values.
properties:
key:
description: key is
the label key that
the selector applies
to.
type: string
operator:
description: operator
represents a key's
relationship to
a set of values.
Valid operators
are In, NotIn, Exists
and DoesNotExist.
type: string
values:
description: values
is an array of string
values. If the operator
is In or NotIn,
the values array
must be non-empty.
If the operator
is Exists or DoesNotExist,
the values array
must be empty. This
array is replaced
during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels
is a map of {key,value}
pairs. A single {key,value}
in the matchLabels map
is equivalent to an element
of matchExpressions, whose
key field is "key", the
operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should
be co-located (affinity) or
not co-located (anti-affinity)
with the pods matching the
labelSelector in the specified
namespaces, where co-located
is defined as running on a
node whose value of the label
with key topologyKey matches
that of any node on which
any of the selected pods is
running. Empty topologyKey
is not allowed.
type: string
required:
- topologyKey
type: object
weight:
description: weight associated with
matching the corresponding podAffinityTerm,
in the range 1-100.
format: int32
type: integer
required:
- podAffinityTerm
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to a pod label
update), the system may or may not try
to eventually evict the pod from its
node. When there are multiple elements,
the lists of nodes corresponding to
each podAffinityTerm are intersected,
i.e. all terms must be satisfied.
items:
description: Defines a set of pods (namely
those matching the labelSelector relative
to the given namespace(s)) that this
pod should be co-located (affinity)
or not co-located (anti-affinity)
with, where co-located is defined
as running on a node whose value of
the label with key <topologyKey> matches
that of any node on which a pod of
the set of pods is running
properties:
labelSelector:
description: A label query over
a set of resources, in this case
pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: key is the
label key that the selector
applies to.
type: string
operator:
description: operator
represents a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists and
DoesNotExist.
type: string
values:
description: values is
an array of string values.
If the operator is In
or NotIn, the values
array must be non-empty.
If the operator is Exists
or DoesNotExist, the
values array must be
empty. This array is
replaced during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels is
a map of {key,value} pairs.
A single {key,value} in the
matchLabels map is equivalent
to an element of matchExpressions,
whose key field is "key",
the operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should be
co-located (affinity) or not co-located
(anti-affinity) with the pods
matching the labelSelector in
the specified namespaces, where
co-located is defined as running
on a node whose value of the label
with key topologyKey matches that
of any node on which any of the
selected pods is running. Empty
topologyKey is not allowed.
type: string
required:
- topologyKey
type: object
type: array
type: object
podAntiAffinity:
description: Describes pod anti-affinity scheduling
rules (e.g. avoid putting this pod in the
same node, zone, etc. as some other pod(s)).
properties:
preferredDuringSchedulingIgnoredDuringExecution:
description: The scheduler will prefer
to schedule pods to nodes that satisfy
the anti-affinity expressions specified
by this field, but it may choose a node
that violates one or more of the expressions.
The node that is most preferred is the
one with the greatest sum of weights,
i.e. for each node that meets all of
the scheduling requirements (resource
request, requiredDuringScheduling anti-affinity
expressions, etc.), compute a sum by
iterating through the elements of this
field and adding "weight" to the sum
if the node has pods which matches the
corresponding podAffinityTerm; the node(s)
with the highest sum are the most preferred.
items:
description: The weights of all of the
matched WeightedPodAffinityTerm fields
are added per-node to find the most
preferred node(s)
properties:
podAffinityTerm:
description: Required. A pod affinity
term, associated with the corresponding
weight.
properties:
labelSelector:
description: A label query over
a set of resources, in this
case pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values,
a key, and an operator
that relates the key
and values.
properties:
key:
description: key is
the label key that
the selector applies
to.
type: string
operator:
description: operator
represents a key's
relationship to
a set of values.
Valid operators
are In, NotIn, Exists
and DoesNotExist.
type: string
values:
description: values
is an array of string
values. If the operator
is In or NotIn,
the values array
must be non-empty.
If the operator
is Exists or DoesNotExist,
the values array
must be empty. This
array is replaced
during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels
is a map of {key,value}
pairs. A single {key,value}
in the matchLabels map
is equivalent to an element
of matchExpressions, whose
key field is "key", the
operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should
be co-located (affinity) or
not co-located (anti-affinity)
with the pods matching the
labelSelector in the specified
namespaces, where co-located
is defined as running on a
node whose value of the label
with key topologyKey matches
that of any node on which
any of the selected pods is
running. Empty topologyKey
is not allowed.
type: string
required:
- topologyKey
type: object
weight:
description: weight associated with
matching the corresponding podAffinityTerm,
in the range 1-100.
format: int32
type: integer
required:
- podAffinityTerm
- weight
type: object
type: array
requiredDuringSchedulingIgnoredDuringExecution:
description: If the anti-affinity requirements
specified by this field are not met
at scheduling time, the pod will not
be scheduled onto the node. If the anti-affinity
requirements specified by this field
cease to be met at some point during
pod execution (e.g. due to a pod label
update), the system may or may not try
to eventually evict the pod from its
node. When there are multiple elements,
the lists of nodes corresponding to
each podAffinityTerm are intersected,
i.e. all terms must be satisfied.
items:
description: Defines a set of pods (namely
those matching the labelSelector relative
to the given namespace(s)) that this
pod should be co-located (affinity)
or not co-located (anti-affinity)
with, where co-located is defined
as running on a node whose value of
the label with key <topologyKey> matches
that of any node on which a pod of
the set of pods is running
properties:
labelSelector:
description: A label query over
a set of resources, in this case
pods.
properties:
matchExpressions:
description: matchExpressions
is a list of label selector
requirements. The requirements
are ANDed.
items:
description: A label selector
requirement is a selector
that contains values, a
key, and an operator that
relates the key and values.
properties:
key:
description: key is the
label key that the selector
applies to.
type: string
operator:
description: operator
represents a key's relationship
to a set of values.
Valid operators are
In, NotIn, Exists and
DoesNotExist.
type: string
values:
description: values is
an array of string values.
If the operator is In
or NotIn, the values
array must be non-empty.
If the operator is Exists
or DoesNotExist, the
values array must be
empty. This array is
replaced during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels is
a map of {key,value} pairs.
A single {key,value} in the
matchLabels map is equivalent
to an element of matchExpressions,
whose key field is "key",
the operator is "In", and
the values array contains
only "value". The requirements
are ANDed.
type: object
type: object
namespaces:
description: namespaces specifies
which namespaces the labelSelector
applies to (matches against);
null or empty list means "this
pod's namespace"
items:
type: string
type: array
topologyKey:
description: This pod should be
co-located (affinity) or not co-located
(anti-affinity) with the pods
matching the labelSelector in
the specified namespaces, where
co-located is defined as running
on a node whose value of the label
with key topologyKey matches that
of any node on which any of the
selected pods is running. Empty
topologyKey is not allowed.
type: string
required:
- topologyKey
type: object
type: array
type: object
type: object
nodeSelector:
additionalProperties:
type: string
description: 'NodeSelector is a selector which
must be true for the pod to fit on a node. Selector
which must match a node''s labels for the pod
to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
type: object
priorityClassName:
description: If specified, the pod's priorityClassName.
type: string
serviceAccountName:
description: If specified, the pod's service account
type: string
tolerations:
description: If specified, the pod's tolerations.
items:
description: The pod this Toleration is attached
to tolerates any taint that matches the triple
<key,value,effect> using the matching operator
<operator>.
properties:
effect:
description: Effect indicates the taint
effect to match. Empty means match all
taint effects. When specified, allowed
values are NoSchedule, PreferNoSchedule
and NoExecute.
type: string
key:
description: Key is the taint key that the
toleration applies to. Empty means match
all taint keys. If the key is empty, operator
must be Exists; this combination means
to match all values and all keys.
type: string
operator:
description: Operator represents a key's
relationship to the value. Valid operators
are Exists and Equal. Defaults to Equal.
Exists is equivalent to wildcard for value,
so that a pod can tolerate all taints
of a particular category.
type: string
tolerationSeconds:
description: TolerationSeconds represents
the period of time the toleration (which
must be of effect NoExecute, otherwise
this field is ignored) tolerates the taint.
By default, it is not set, which means
tolerate the taint forever (do not evict).
Zero and negative values will be treated
as 0 (evict immediately) by the system.
format: int64
type: integer
value:
description: Value is the taint value the
toleration matches to. If the operator
is Exists, the value should be empty,
otherwise just a regular string.
type: string
type: object
type: array
type: object
type: object
serviceType:
description: Optional service type for Kubernetes solver
service
type: string
type: object
type: object
selector:
description: Selector selects a set of DNSNames on the Certificate
resource that should be solved using this challenge solver.
If not specified, the solver will be treated as the 'default'
solver with the lowest priority, i.e. if any other solver has
a more specific match, it will be used instead.
properties:
dnsNames:
description: List of DNSNames that this solver will be used
to solve. If specified and a match is found, a dnsNames
selector will take precedence over a dnsZones selector.
If multiple solvers match with the same dnsNames value,
the solver with the most matching labels in matchLabels
will be selected. If neither has more matches, the solver
defined earlier in the list will be selected.
items:
type: string
type: array
dnsZones:
description: List of DNSZones that this solver will be used
to solve. The most specific DNS zone match specified here
will take precedence over other DNS zone matches, so a solver
specifying sys.example.com will be selected over one specifying
example.com for the domain www.sys.example.com. If multiple
solvers match with the same dnsZones value, the solver with
the most matching labels in matchLabels will be selected.
If neither has more matches, the solver defined earlier
in the list will be selected.
items:
type: string
type: array
matchLabels:
additionalProperties:
type: string
description: A label selector that is used to refine the set
of certificate's that this challenge solver will apply to.
type: object
type: object
type: object
token:
description: The ACME challenge token for this challenge. This is
the raw value returned from the ACME server.
type: string
type:
description: The type of ACME challenge this resource represents.
One of "HTTP-01" or "DNS-01".
enum:
- HTTP-01
- DNS-01
type: string
url:
description: The URL of the ACME Challenge resource for this challenge.
This can be used to lookup details about the status of this challenge.
type: string
wildcard:
description: wildcard will be true if this challenge is for a wildcard
identifier, for example '*.example.com'.
type: boolean
required:
- authorizationURL
- dnsName
- issuerRef
- key
- solver
- token
- type
- url
type: object
status:
properties:
presented:
description: presented will be set to true if the challenge values
for this challenge are currently 'presented'. This *does not* imply
the self check is passing. Only that the values have been 'submitted'
for the appropriate challenge mechanism (i.e. the DNS01 TXT record
has been presented, or the HTTP01 configuration has been configured).
type: boolean
processing:
description: Used to denote whether this challenge should be processed
or not. This field will only be set to true by the 'scheduling'
component. It will only be set to false by the 'challenges' controller,
after the challenge has reached a final state or timed out. If this
field is set to false, the challenge controller will not take any
more action.
type: boolean
reason:
description: Contains human readable information on why the Challenge
is in the current state.
type: string
state:
description: Contains the current 'state' of the challenge. If not
set, the state of the challenge is unknown.
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
type: string
type: object
required:
- metadata
- spec
type: object
served: true
storage: true
subresources:
status: {}
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []