chore: Update manifests after change
This commit is contained in:
2
clusters/cl01tl/manifests/traefik/-.yml
Normal file
2
clusters/cl01tl/manifests/traefik/-.yml
Normal file
@@ -0,0 +1,2 @@
|
||||
---
|
||||
|
||||
@@ -0,0 +1,106 @@
|
||||
---
|
||||
# Source: traefik/charts/traefik/templates/rbac/clusterrole.yaml
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: traefik-traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
helm.sh/chart: traefik-37.4.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- nodes
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- traefik.io
|
||||
resources:
|
||||
- ingressroutes
|
||||
- ingressroutetcps
|
||||
- ingressrouteudps
|
||||
- middlewares
|
||||
- middlewaretcps
|
||||
- serverstransports
|
||||
- serverstransporttcps
|
||||
- tlsoptions
|
||||
- tlsstores
|
||||
- traefikservices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
- secrets
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
- backendtlspolicies
|
||||
- gatewayclasses
|
||||
- gateways
|
||||
- grpcroutes
|
||||
- httproutes
|
||||
- referencegrants
|
||||
- tcproutes
|
||||
- tlsroutes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
- backendtlspolicies/status
|
||||
- gatewayclasses/status
|
||||
- gateways/status
|
||||
- grpcroutes/status
|
||||
- httproutes/status
|
||||
- tcproutes/status
|
||||
- tlsroutes/status
|
||||
verbs:
|
||||
- update
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
# Source: traefik/charts/traefik/templates/rbac/clusterrolebinding.yaml
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: traefik-traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
helm.sh/chart: traefik-37.4.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: traefik-traefik
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
@@ -0,0 +1,348 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: accesscontrolpolicies.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: AccessControlPolicy
|
||||
listKind: AccessControlPolicyList
|
||||
plural: accesscontrolpolicies
|
||||
singular: accesscontrolpolicy
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: AccessControlPolicy defines an access control policy.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: AccessControlPolicySpec configures an access control policy.
|
||||
properties:
|
||||
apiKey:
|
||||
description: AccessControlPolicyAPIKey configure an APIKey control policy.
|
||||
properties:
|
||||
forwardHeaders:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: ForwardHeaders instructs the middleware to forward key metadata as header values upon successful authentication.
|
||||
type: object
|
||||
keySource:
|
||||
description: KeySource defines how to extract API keys from requests.
|
||||
properties:
|
||||
cookie:
|
||||
description: Cookie is the name of a cookie.
|
||||
type: string
|
||||
header:
|
||||
description: Header is the name of a header.
|
||||
type: string
|
||||
headerAuthScheme:
|
||||
description: |-
|
||||
HeaderAuthScheme sets an optional auth scheme when Header is set to "Authorization".
|
||||
If set, this scheme is removed from the token, and all requests not including it are dropped.
|
||||
type: string
|
||||
query:
|
||||
description: Query is the name of a query parameter.
|
||||
type: string
|
||||
type: object
|
||||
keys:
|
||||
description: Keys define the set of authorized keys to access a protected resource.
|
||||
items:
|
||||
description: AccessControlPolicyAPIKeyKey defines an API key.
|
||||
properties:
|
||||
id:
|
||||
description: ID is the unique identifier of the key.
|
||||
type: string
|
||||
metadata:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Metadata holds arbitrary metadata for this key, can be used by ForwardHeaders.
|
||||
type: object
|
||||
value:
|
||||
description: Value is the SHAKE-256 hash (using 64 bytes) of the API key.
|
||||
type: string
|
||||
required:
|
||||
- id
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- keySource
|
||||
type: object
|
||||
basicAuth:
|
||||
description: AccessControlPolicyBasicAuth holds the HTTP basic authentication configuration.
|
||||
properties:
|
||||
forwardUsernameHeader:
|
||||
type: string
|
||||
realm:
|
||||
type: string
|
||||
stripAuthorizationHeader:
|
||||
type: boolean
|
||||
users:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
jwt:
|
||||
description: AccessControlPolicyJWT configures a JWT access control policy.
|
||||
properties:
|
||||
claims:
|
||||
type: string
|
||||
forwardHeaders:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
jwksFile:
|
||||
type: string
|
||||
jwksUrl:
|
||||
type: string
|
||||
publicKey:
|
||||
type: string
|
||||
signingSecret:
|
||||
type: string
|
||||
signingSecretBase64Encoded:
|
||||
type: boolean
|
||||
stripAuthorizationHeader:
|
||||
type: boolean
|
||||
tokenQueryKey:
|
||||
type: string
|
||||
type: object
|
||||
oAuthIntro:
|
||||
description: AccessControlOAuthIntro configures an OAuth 2.0 Token Introspection access control policy.
|
||||
properties:
|
||||
claims:
|
||||
type: string
|
||||
clientConfig:
|
||||
description: AccessControlOAuthIntroClientConfig configures the OAuth 2.0 client for issuing token introspection requests.
|
||||
properties:
|
||||
headers:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Headers to set when sending requests to the Authorization Server.
|
||||
type: object
|
||||
maxRetries:
|
||||
default: 3
|
||||
description: MaxRetries defines the number of retries for introspection requests.
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
default: 5
|
||||
description: TimeoutSeconds configures the maximum amount of seconds to wait before giving up on requests.
|
||||
type: integer
|
||||
tls:
|
||||
description: TLS configures TLS communication with the Authorization Server.
|
||||
properties:
|
||||
ca:
|
||||
description: CA sets the CA bundle used to sign the Authorization Server certificate.
|
||||
type: string
|
||||
insecureSkipVerify:
|
||||
description: |-
|
||||
InsecureSkipVerify skips the Authorization Server certificate validation.
|
||||
For testing purposes only, do not use in production.
|
||||
type: boolean
|
||||
type: object
|
||||
tokenTypeHint:
|
||||
description: |-
|
||||
TokenTypeHint is a hint to pass to the Authorization Server.
|
||||
See https://tools.ietf.org/html/rfc7662#section-2.1 for more information.
|
||||
type: string
|
||||
url:
|
||||
description: URL of the Authorization Server.
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
forwardHeaders:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
tokenSource:
|
||||
description: |-
|
||||
TokenSource describes how to extract tokens from HTTP requests.
|
||||
If multiple sources are set, the order is the following: header > query > cookie.
|
||||
properties:
|
||||
cookie:
|
||||
description: Cookie is the name of a cookie.
|
||||
type: string
|
||||
header:
|
||||
description: Header is the name of a header.
|
||||
type: string
|
||||
headerAuthScheme:
|
||||
description: |-
|
||||
HeaderAuthScheme sets an optional auth scheme when Header is set to "Authorization".
|
||||
If set, this scheme is removed from the token, and all requests not including it are dropped.
|
||||
type: string
|
||||
query:
|
||||
description: Query is the name of a query parameter.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- clientConfig
|
||||
- tokenSource
|
||||
type: object
|
||||
oidc:
|
||||
description: AccessControlPolicyOIDC holds the OIDC authentication configuration.
|
||||
properties:
|
||||
authParams:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
claims:
|
||||
type: string
|
||||
clientId:
|
||||
type: string
|
||||
disableAuthRedirectionPaths:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
forwardHeaders:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
issuer:
|
||||
type: string
|
||||
logoutUrl:
|
||||
type: string
|
||||
redirectUrl:
|
||||
type: string
|
||||
scopes:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
secret:
|
||||
description: |-
|
||||
SecretReference represents a Secret Reference. It has enough information to retrieve secret
|
||||
in any namespace
|
||||
properties:
|
||||
name:
|
||||
description: name is unique within a namespace to reference a secret resource.
|
||||
type: string
|
||||
namespace:
|
||||
description: namespace defines the space within which the secret name must be unique.
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
session:
|
||||
description: Session holds session configuration.
|
||||
properties:
|
||||
domain:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
refresh:
|
||||
type: boolean
|
||||
sameSite:
|
||||
type: string
|
||||
secure:
|
||||
type: boolean
|
||||
type: object
|
||||
stateCookie:
|
||||
description: StateCookie holds state cookie configuration.
|
||||
properties:
|
||||
domain:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
sameSite:
|
||||
type: string
|
||||
secure:
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
oidcGoogle:
|
||||
description: AccessControlPolicyOIDCGoogle holds the Google OIDC authentication configuration.
|
||||
properties:
|
||||
authParams:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
clientId:
|
||||
type: string
|
||||
emails:
|
||||
description: Emails are the allowed emails to connect.
|
||||
items:
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
forwardHeaders:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
logoutUrl:
|
||||
type: string
|
||||
redirectUrl:
|
||||
type: string
|
||||
secret:
|
||||
description: |-
|
||||
SecretReference represents a Secret Reference. It has enough information to retrieve secret
|
||||
in any namespace
|
||||
properties:
|
||||
name:
|
||||
description: name is unique within a namespace to reference a secret resource.
|
||||
type: string
|
||||
namespace:
|
||||
description: namespace defines the space within which the secret name must be unique.
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
session:
|
||||
description: Session holds session configuration.
|
||||
properties:
|
||||
domain:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
refresh:
|
||||
type: boolean
|
||||
sameSite:
|
||||
type: string
|
||||
secure:
|
||||
type: boolean
|
||||
type: object
|
||||
stateCookie:
|
||||
description: StateCookie holds state cookie configuration.
|
||||
properties:
|
||||
domain:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
sameSite:
|
||||
type: string
|
||||
secure:
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
description: The current status of this access control policy.
|
||||
properties:
|
||||
specHash:
|
||||
type: string
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,338 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: aiservices.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: AIService
|
||||
listKind: AIServiceList
|
||||
plural: aiservices
|
||||
singular: aiservice
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: AIService is a Kubernetes-like Service to interact with a text-based LLM provider. It defines the parameters and credentials required to interact with various LLM providers.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: The desired behavior of this AIService.
|
||||
properties:
|
||||
anthropic:
|
||||
description: Anthropic configures Anthropic backend.
|
||||
properties:
|
||||
model:
|
||||
type: string
|
||||
params:
|
||||
description: Params holds the LLM hyperparameters.
|
||||
properties:
|
||||
frequencyPenalty:
|
||||
type: number
|
||||
maxTokens:
|
||||
type: integer
|
||||
presencePenalty:
|
||||
type: number
|
||||
temperature:
|
||||
type: number
|
||||
topP:
|
||||
type: number
|
||||
type: object
|
||||
token:
|
||||
description: SecretReference references a kubernetes secret.
|
||||
properties:
|
||||
secretName:
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
type: object
|
||||
azureOpenai:
|
||||
description: AzureOpenAI configures AzureOpenAI.
|
||||
properties:
|
||||
apiKeySecret:
|
||||
description: SecretReference references a kubernetes secret.
|
||||
properties:
|
||||
secretName:
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
baseUrl:
|
||||
type: string
|
||||
deploymentName:
|
||||
type: string
|
||||
model:
|
||||
type: string
|
||||
params:
|
||||
description: Params holds the LLM hyperparameters.
|
||||
properties:
|
||||
frequencyPenalty:
|
||||
type: number
|
||||
maxTokens:
|
||||
type: integer
|
||||
presencePenalty:
|
||||
type: number
|
||||
temperature:
|
||||
type: number
|
||||
topP:
|
||||
type: number
|
||||
type: object
|
||||
required:
|
||||
- baseUrl
|
||||
- deploymentName
|
||||
type: object
|
||||
bedrock:
|
||||
description: Bedrock configures Bedrock backend.
|
||||
properties:
|
||||
model:
|
||||
type: string
|
||||
params:
|
||||
description: Params holds the LLM hyperparameters.
|
||||
properties:
|
||||
frequencyPenalty:
|
||||
type: number
|
||||
maxTokens:
|
||||
type: integer
|
||||
presencePenalty:
|
||||
type: number
|
||||
temperature:
|
||||
type: number
|
||||
topP:
|
||||
type: number
|
||||
type: object
|
||||
region:
|
||||
type: string
|
||||
systemMessage:
|
||||
type: boolean
|
||||
type: object
|
||||
cohere:
|
||||
description: Cohere configures Cohere backend.
|
||||
properties:
|
||||
model:
|
||||
type: string
|
||||
params:
|
||||
description: Params holds the LLM hyperparameters.
|
||||
properties:
|
||||
frequencyPenalty:
|
||||
type: number
|
||||
maxTokens:
|
||||
type: integer
|
||||
presencePenalty:
|
||||
type: number
|
||||
temperature:
|
||||
type: number
|
||||
topP:
|
||||
type: number
|
||||
type: object
|
||||
token:
|
||||
description: SecretReference references a kubernetes secret.
|
||||
properties:
|
||||
secretName:
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
type: object
|
||||
deepSeek:
|
||||
description: DeepSeek configures DeepSeek.
|
||||
properties:
|
||||
baseUrl:
|
||||
type: string
|
||||
model:
|
||||
type: string
|
||||
params:
|
||||
description: Params holds the LLM hyperparameters.
|
||||
properties:
|
||||
frequencyPenalty:
|
||||
type: number
|
||||
maxTokens:
|
||||
type: integer
|
||||
presencePenalty:
|
||||
type: number
|
||||
temperature:
|
||||
type: number
|
||||
topP:
|
||||
type: number
|
||||
type: object
|
||||
token:
|
||||
description: SecretReference references a kubernetes secret.
|
||||
properties:
|
||||
secretName:
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
type: object
|
||||
gemini:
|
||||
description: Gemini configures Gemini backend.
|
||||
properties:
|
||||
apiKey:
|
||||
description: SecretReference references a kubernetes secret.
|
||||
properties:
|
||||
secretName:
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
model:
|
||||
type: string
|
||||
params:
|
||||
description: Params holds the LLM hyperparameters.
|
||||
properties:
|
||||
frequencyPenalty:
|
||||
type: number
|
||||
maxTokens:
|
||||
type: integer
|
||||
presencePenalty:
|
||||
type: number
|
||||
temperature:
|
||||
type: number
|
||||
topP:
|
||||
type: number
|
||||
type: object
|
||||
type: object
|
||||
mistral:
|
||||
description: Mistral configures Mistral AI backend.
|
||||
properties:
|
||||
apiKey:
|
||||
description: SecretReference references a kubernetes secret.
|
||||
properties:
|
||||
secretName:
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
model:
|
||||
type: string
|
||||
params:
|
||||
description: Params holds the LLM hyperparameters.
|
||||
properties:
|
||||
frequencyPenalty:
|
||||
type: number
|
||||
maxTokens:
|
||||
type: integer
|
||||
presencePenalty:
|
||||
type: number
|
||||
temperature:
|
||||
type: number
|
||||
topP:
|
||||
type: number
|
||||
type: object
|
||||
type: object
|
||||
ollama:
|
||||
description: Ollama configures Ollama backend.
|
||||
properties:
|
||||
baseUrl:
|
||||
type: string
|
||||
model:
|
||||
type: string
|
||||
params:
|
||||
description: Params holds the LLM hyperparameters.
|
||||
properties:
|
||||
frequencyPenalty:
|
||||
type: number
|
||||
maxTokens:
|
||||
type: integer
|
||||
presencePenalty:
|
||||
type: number
|
||||
temperature:
|
||||
type: number
|
||||
topP:
|
||||
type: number
|
||||
type: object
|
||||
required:
|
||||
- baseUrl
|
||||
type: object
|
||||
openai:
|
||||
description: OpenAI configures OpenAI.
|
||||
properties:
|
||||
baseUrl:
|
||||
type: string
|
||||
model:
|
||||
type: string
|
||||
params:
|
||||
description: Params holds the LLM hyperparameters.
|
||||
properties:
|
||||
frequencyPenalty:
|
||||
type: number
|
||||
maxTokens:
|
||||
type: integer
|
||||
presencePenalty:
|
||||
type: number
|
||||
temperature:
|
||||
type: number
|
||||
topP:
|
||||
type: number
|
||||
type: object
|
||||
token:
|
||||
description: SecretReference references a kubernetes secret.
|
||||
properties:
|
||||
secretName:
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
type: object
|
||||
qWen:
|
||||
description: QWen configures QWen.
|
||||
properties:
|
||||
baseUrl:
|
||||
type: string
|
||||
model:
|
||||
type: string
|
||||
params:
|
||||
description: Params holds the LLM hyperparameters.
|
||||
properties:
|
||||
frequencyPenalty:
|
||||
type: number
|
||||
maxTokens:
|
||||
type: integer
|
||||
presencePenalty:
|
||||
type: number
|
||||
temperature:
|
||||
type: number
|
||||
topP:
|
||||
type: number
|
||||
type: object
|
||||
token:
|
||||
description: SecretReference references a kubernetes secret.
|
||||
properties:
|
||||
secretName:
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,169 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: apiauths.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: APIAuth
|
||||
listKind: APIAuthList
|
||||
plural: apiauths
|
||||
singular: apiauth
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: APIAuth defines the authentication configuration for APIs.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: The desired behavior of this APIAuth.
|
||||
properties:
|
||||
apiKey:
|
||||
description: APIKey configures API key authentication.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
isDefault:
|
||||
description: |-
|
||||
IsDefault specifies if this APIAuth should be used as the default API authentication method for the namespace.
|
||||
Only one APIAuth per namespace should have isDefault set to true.
|
||||
type: boolean
|
||||
jwt:
|
||||
description: JWT configures JWT authentication.
|
||||
properties:
|
||||
appIdClaim:
|
||||
description: |-
|
||||
AppIDClaim is the name of the claim holding the identifier of the application.
|
||||
This field is sometimes named `client_id`.
|
||||
type: string
|
||||
forwardHeaders:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: ForwardHeaders specifies additional headers to forward with the request.
|
||||
type: object
|
||||
jwksFile:
|
||||
description: JWKSFile contains the JWKS file content for JWT verification.
|
||||
type: string
|
||||
jwksUrl:
|
||||
description: JWKSURL is the URL to fetch the JWKS for JWT verification.
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be a valid URL
|
||||
rule: isURL(self)
|
||||
publicKey:
|
||||
description: PublicKey is the PEM-encoded public key for JWT verification.
|
||||
type: string
|
||||
signingSecretName:
|
||||
description: |-
|
||||
SigningSecretName is the name of the Kubernetes Secret containing the signing secret.
|
||||
The secret must be of type Opaque and contain a key named 'value'.
|
||||
maxLength: 253
|
||||
type: string
|
||||
stripAuthorizationHeader:
|
||||
description: StripAuthorizationHeader determines whether to strip the Authorization header before forwarding the request.
|
||||
type: boolean
|
||||
tokenNameClaim:
|
||||
description: |-
|
||||
TokenNameClaim is the name of the claim holding the name of the token.
|
||||
This name, if provided, will be used in the metrics.
|
||||
type: string
|
||||
tokenQueryKey:
|
||||
description: TokenQueryKey specifies the query parameter name for the JWT token.
|
||||
type: string
|
||||
required:
|
||||
- appIdClaim
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: exactly one of signingSecretName, publicKey, jwksFile, or jwksUrl must be specified
|
||||
rule: '[has(self.signingSecretName), has(self.publicKey), has(self.jwksFile), has(self.jwksUrl)].filter(x, x).size() == 1'
|
||||
ldap:
|
||||
description: LDAP configures LDAP authentication.
|
||||
properties:
|
||||
attribute:
|
||||
default: cn
|
||||
description: |-
|
||||
Attribute is the LDAP object attribute used to form a bind DN when sending bind queries.
|
||||
The bind DN is formed as <Attribute>=<Username>,<BaseDN>.
|
||||
type: string
|
||||
baseDn:
|
||||
description: BaseDN is the base domain name that should be used for bind and search queries.
|
||||
type: string
|
||||
bindDn:
|
||||
description: |-
|
||||
BindDN is the domain name to bind to in order to authenticate to the LDAP server when running in search mode.
|
||||
If empty, an anonymous bind will be done.
|
||||
type: string
|
||||
bindPasswordSecretName:
|
||||
description: |-
|
||||
BindPasswordSecretName is the name of the Kubernetes Secret containing the password for the bind DN.
|
||||
The secret must contain a key named 'password'.
|
||||
maxLength: 253
|
||||
type: string
|
||||
certificateAuthority:
|
||||
description: |-
|
||||
CertificateAuthority is a PEM-encoded certificate to use to establish a connection with the LDAP server if the
|
||||
connection uses TLS but that the certificate was signed by a custom Certificate Authority.
|
||||
type: string
|
||||
insecureSkipVerify:
|
||||
description: InsecureSkipVerify controls whether the server's certificate chain and host name is verified.
|
||||
type: boolean
|
||||
searchFilter:
|
||||
description: |-
|
||||
SearchFilter is used to filter LDAP search queries.
|
||||
Example: (&(objectClass=inetOrgPerson)(gidNumber=500)(uid=%s))
|
||||
%s can be used as a placeholder for the username.
|
||||
type: string
|
||||
startTls:
|
||||
description: StartTLS instructs the middleware to issue a StartTLS request when initializing the connection with the LDAP server.
|
||||
type: boolean
|
||||
url:
|
||||
description: URL is the URL of the LDAP server, including the protocol (ldap or ldaps) and the port.
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be a valid LDAP URL
|
||||
rule: isURL(self) && (self.startsWith('ldap://') || self.startsWith('ldaps://'))
|
||||
required:
|
||||
- baseDn
|
||||
- url
|
||||
type: object
|
||||
required:
|
||||
- isDefault
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: exactly one authentication method must be specified
|
||||
rule: '[has(self.apiKey), has(self.jwt), has(self.ldap)].filter(x, x).size() == 1'
|
||||
status:
|
||||
description: The current status of this APIAuth.
|
||||
properties:
|
||||
hash:
|
||||
description: Hash is a hash representing the APIAuth.
|
||||
type: string
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,129 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: apibundles.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: APIBundle
|
||||
listKind: APIBundleList
|
||||
plural: apibundles
|
||||
singular: apibundle
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: APIBundle defines a set of APIs.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: The desired behavior of this APIBundle.
|
||||
properties:
|
||||
apiSelector:
|
||||
description: |-
|
||||
APISelector selects the APIs that will be accessible to the configured audience.
|
||||
Multiple APIBundles can select the same set of APIs.
|
||||
This field is optional and follows standard label selector semantics.
|
||||
An empty APISelector matches any API.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
apis:
|
||||
description: |-
|
||||
APIs defines a set of APIs that will be accessible to the configured audience.
|
||||
Multiple APIBundles can select the same APIs.
|
||||
When combined with APISelector, this set of APIs is appended to the matching APIs.
|
||||
items:
|
||||
description: APIReference references an API.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the API.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
maxItems: 100
|
||||
type: array
|
||||
x-kubernetes-validations:
|
||||
- message: duplicated apis
|
||||
rule: self.all(x, self.exists_one(y, x.name == y.name))
|
||||
title:
|
||||
description: Title is the human-readable name of the APIBundle that will be used on the portal.
|
||||
maxLength: 253
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: The current status of this APIBundle.
|
||||
properties:
|
||||
hash:
|
||||
description: Hash is a hash representing the APIBundle.
|
||||
type: string
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,181 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: apicatalogitems.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: APICatalogItem
|
||||
listKind: APICatalogItemList
|
||||
plural: apicatalogitems
|
||||
singular: apicatalogitem
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: APICatalogItem defines APIs that will be part of the API catalog on the portal.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: The desired behavior of this APICatalogItem.
|
||||
properties:
|
||||
apiBundles:
|
||||
description: |-
|
||||
APIBundles defines a set of APIBundle that will be visible to the configured audience.
|
||||
Multiple APICatalogItem can select the same APIBundles.
|
||||
items:
|
||||
description: APIBundleReference references an APIBundle.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the APIBundle.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
maxItems: 100
|
||||
type: array
|
||||
x-kubernetes-validations:
|
||||
- message: duplicated apiBundles
|
||||
rule: self.all(x, self.exists_one(y, x.name == y.name))
|
||||
apiPlan:
|
||||
description: |-
|
||||
APIPlan defines which APIPlan will be available.
|
||||
If multiple APICatalogItem specify the same API with different APIPlan, the API consumer will be able to pick
|
||||
a plan from this list.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the APIPlan.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
apiSelector:
|
||||
description: |-
|
||||
APISelector selects the APIs that will be visible to the configured audience.
|
||||
Multiple APICatalogItem can select the same set of APIs.
|
||||
This field is optional and follows standard label selector semantics.
|
||||
An empty APISelector matches any API.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
apis:
|
||||
description: |-
|
||||
APIs defines a set of APIs that will be visible to the configured audience.
|
||||
Multiple APICatalogItem can select the same APIs.
|
||||
When combined with APISelector, this set of APIs is appended to the matching APIs.
|
||||
items:
|
||||
description: APIReference references an API.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the API.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
maxItems: 100
|
||||
type: array
|
||||
x-kubernetes-validations:
|
||||
- message: duplicated apis
|
||||
rule: self.all(x, self.exists_one(y, x.name == y.name))
|
||||
everyone:
|
||||
description: Everyone indicates that all users will see these APIs.
|
||||
type: boolean
|
||||
groups:
|
||||
description: Groups are the consumer groups that will see the APIs.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
operationFilter:
|
||||
description: |-
|
||||
OperationFilter specifies the visible operations on APIs and APIVersions.
|
||||
If not set, all operations are available.
|
||||
An empty OperationFilter prohibits all operations.
|
||||
properties:
|
||||
include:
|
||||
description: Include defines the names of OperationSets that will be accessible.
|
||||
items:
|
||||
type: string
|
||||
maxItems: 100
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: groups and everyone are mutually exclusive
|
||||
rule: '(has(self.everyone) && has(self.groups)) ? !(self.everyone && self.groups.size() > 0) : true'
|
||||
status:
|
||||
description: The current status of this APICatalogItem.
|
||||
properties:
|
||||
hash:
|
||||
description: Hash is a hash representing the APICatalogItem.
|
||||
type: string
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,119 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: apiplans.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: APIPlan
|
||||
listKind: APIPlanList
|
||||
plural: apiplans
|
||||
singular: apiplan
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: APIPlan defines API Plan policy.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: The desired behavior of this APIPlan.
|
||||
properties:
|
||||
description:
|
||||
description: Description describes the plan.
|
||||
type: string
|
||||
quota:
|
||||
description: Quota defines the quota policy.
|
||||
properties:
|
||||
bucket:
|
||||
default: subscription
|
||||
description: Bucket defines the bucket strategy for the quota.
|
||||
enum:
|
||||
- subscription
|
||||
- application-api
|
||||
- application
|
||||
type: string
|
||||
limit:
|
||||
description: Limit is the maximum number of token in the bucket.
|
||||
type: integer
|
||||
x-kubernetes-validations:
|
||||
- message: must be a positive number
|
||||
rule: self >= 0
|
||||
period:
|
||||
description: Period is the unit of time for the Limit.
|
||||
format: duration
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be between 1s and 9999h
|
||||
rule: self >= duration('1s') && self <= duration('9999h')
|
||||
required:
|
||||
- limit
|
||||
type: object
|
||||
rateLimit:
|
||||
description: RateLimit defines the rate limit policy.
|
||||
properties:
|
||||
bucket:
|
||||
default: subscription
|
||||
description: Bucket defines the bucket strategy for the rate limit.
|
||||
enum:
|
||||
- subscription
|
||||
- application-api
|
||||
- application
|
||||
type: string
|
||||
limit:
|
||||
description: Limit is the maximum number of token in the bucket.
|
||||
type: integer
|
||||
x-kubernetes-validations:
|
||||
- message: must be a positive number
|
||||
rule: self >= 0
|
||||
period:
|
||||
description: Period is the unit of time for the Limit.
|
||||
format: duration
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be between 1s and 1h
|
||||
rule: self >= duration('1s') && self <= duration('1h')
|
||||
required:
|
||||
- limit
|
||||
type: object
|
||||
title:
|
||||
description: Title is the human-readable name of the plan.
|
||||
type: string
|
||||
required:
|
||||
- title
|
||||
type: object
|
||||
status:
|
||||
description: The current status of this APIPlan.
|
||||
properties:
|
||||
hash:
|
||||
description: Hash is a hash representing the APIPlan.
|
||||
type: string
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,210 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: apiportalauths.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: APIPortalAuth
|
||||
listKind: APIPortalAuthList
|
||||
plural: apiportalauths
|
||||
singular: apiportalauth
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: APIPortalAuth defines the authentication configuration for an APIPortal.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: The desired behavior of this APIPortalAuth.
|
||||
properties:
|
||||
ldap:
|
||||
description: LDAP configures the LDAP authentication.
|
||||
properties:
|
||||
attribute:
|
||||
default: cn
|
||||
description: |-
|
||||
Attribute is the LDAP object attribute used to form a bind DN when sending bind queries.
|
||||
The bind DN is formed as <Attribute>=<Username>,<BaseDN>.
|
||||
type: string
|
||||
attributes:
|
||||
description: Attributes configures LDAP attribute mappings for user attributes.
|
||||
properties:
|
||||
company:
|
||||
description: Company is the LDAP attribute for user company.
|
||||
type: string
|
||||
email:
|
||||
description: Email is the LDAP attribute for user email.
|
||||
type: string
|
||||
firstname:
|
||||
description: Firstname is the LDAP attribute for user first name.
|
||||
type: string
|
||||
lastname:
|
||||
description: Lastname is the LDAP attribute for user last name.
|
||||
type: string
|
||||
userId:
|
||||
description: UserID is the LDAP attribute for user ID mapping.
|
||||
type: string
|
||||
type: object
|
||||
baseDn:
|
||||
description: BaseDN is the base domain name that should be used for bind and search queries.
|
||||
type: string
|
||||
bindDn:
|
||||
description: |-
|
||||
BindDN is the domain name to bind to in order to authenticate to the LDAP server when running in search mode.
|
||||
If empty, an anonymous bind will be done.
|
||||
type: string
|
||||
bindPasswordSecretName:
|
||||
description: |-
|
||||
BindPasswordSecretName is the name of the Kubernetes Secret containing the password for the bind DN.
|
||||
The secret must contain a key named 'password'.
|
||||
maxLength: 253
|
||||
type: string
|
||||
certificateAuthority:
|
||||
description: |-
|
||||
CertificateAuthority is a PEM-encoded certificate to use to establish a connection with the LDAP server if the
|
||||
connection uses TLS but that the certificate was signed by a custom Certificate Authority.
|
||||
type: string
|
||||
groups:
|
||||
description: Groups configures group extraction.
|
||||
properties:
|
||||
memberOfAttribute:
|
||||
default: memberOf
|
||||
description: MemberOfAttribute is the LDAP attribute containing group memberships (e.g., "memberOf").
|
||||
type: string
|
||||
type: object
|
||||
insecureSkipVerify:
|
||||
description: InsecureSkipVerify controls whether the server's certificate chain and host name is verified.
|
||||
type: boolean
|
||||
searchFilter:
|
||||
description: |-
|
||||
SearchFilter is used to filter LDAP search queries.
|
||||
Example: (&(objectClass=inetOrgPerson)(gidNumber=500)(uid=%s))
|
||||
%s can be used as a placeholder for the username.
|
||||
type: string
|
||||
startTls:
|
||||
description: StartTLS instructs the middleware to issue a StartTLS request when initializing the connection with the LDAP server.
|
||||
type: boolean
|
||||
syncedAttributes:
|
||||
description: SyncedAttributes are the user attributes to synchronize with Hub platform.
|
||||
items:
|
||||
enum:
|
||||
- groups
|
||||
- userId
|
||||
- firstname
|
||||
- lastname
|
||||
- email
|
||||
- company
|
||||
type: string
|
||||
maxItems: 6
|
||||
type: array
|
||||
url:
|
||||
description: URL is the URL of the LDAP server, including the protocol (ldap or ldaps) and the port.
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be a valid LDAP URL
|
||||
rule: isURL(self) && (self.startsWith('ldap://') || self.startsWith('ldaps://'))
|
||||
required:
|
||||
- baseDn
|
||||
- url
|
||||
type: object
|
||||
oidc:
|
||||
description: OIDC configures the OIDC authentication.
|
||||
properties:
|
||||
claims:
|
||||
description: Claims configures JWT claim mappings for user attributes.
|
||||
properties:
|
||||
company:
|
||||
description: Company is the JWT claim for user company.
|
||||
type: string
|
||||
email:
|
||||
description: Email is the JWT claim for user email.
|
||||
type: string
|
||||
firstname:
|
||||
description: Firstname is the JWT claim for user first name.
|
||||
type: string
|
||||
groups:
|
||||
description: Groups is the JWT claim for user groups. This field is required for authorization.
|
||||
type: string
|
||||
lastname:
|
||||
description: Lastname is the JWT claim for user last name.
|
||||
type: string
|
||||
userId:
|
||||
description: UserID is the JWT claim for user ID mapping.
|
||||
type: string
|
||||
required:
|
||||
- groups
|
||||
type: object
|
||||
issuerUrl:
|
||||
description: IssuerURL is the OIDC provider issuer URL.
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be a valid URL
|
||||
rule: isURL(self)
|
||||
scopes:
|
||||
description: Scopes is a list of OAuth2 scopes.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
secretName:
|
||||
description: SecretName is the name of the Kubernetes Secret containing clientId and clientSecret keys.
|
||||
maxLength: 253
|
||||
type: string
|
||||
syncedAttributes:
|
||||
description: SyncedAttributes are the user attributes to synchronize with Hub platform.
|
||||
items:
|
||||
enum:
|
||||
- groups
|
||||
- userId
|
||||
- firstname
|
||||
- lastname
|
||||
- email
|
||||
- company
|
||||
type: string
|
||||
maxItems: 6
|
||||
type: array
|
||||
required:
|
||||
- claims
|
||||
- issuerUrl
|
||||
- secretName
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: exactly one of oidc or ldap must be specified
|
||||
rule: '[has(self.oidc), has(self.ldap)].filter(x, x).size() == 1'
|
||||
status:
|
||||
description: The current status of this APIPortalAuth.
|
||||
properties:
|
||||
hash:
|
||||
description: Hash is a hash representing the APIPortalAuth.
|
||||
type: string
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,134 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: apiportals.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: APIPortal
|
||||
listKind: APIPortalList
|
||||
plural: apiportals
|
||||
singular: apiportal
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: APIPortal defines a developer portal for accessing the documentation of APIs.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: The desired behavior of this APIPortal.
|
||||
properties:
|
||||
auth:
|
||||
description: Auth references the APIPortalAuth resource for authentication configuration.
|
||||
properties:
|
||||
name:
|
||||
description: Name is the name of the APIPortalAuth resource.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
description:
|
||||
description: Description of the APIPortal.
|
||||
type: string
|
||||
title:
|
||||
description: Title is the public facing name of the APIPortal.
|
||||
type: string
|
||||
trustedUrls:
|
||||
description: TrustedURLs are the urls that are trusted by the OAuth 2.0 authorization server.
|
||||
items:
|
||||
type: string
|
||||
maxItems: 1
|
||||
minItems: 1
|
||||
type: array
|
||||
x-kubernetes-validations:
|
||||
- message: must be a valid URLs
|
||||
rule: self.all(x, isURL(x))
|
||||
ui:
|
||||
description: UI holds the UI customization options.
|
||||
properties:
|
||||
logoUrl:
|
||||
description: LogoURL is the public URL of the logo.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- trustedUrls
|
||||
type: object
|
||||
status:
|
||||
description: The current status of this APIPortal.
|
||||
properties:
|
||||
hash:
|
||||
description: Hash is a hash representing the APIPortal.
|
||||
type: string
|
||||
oidc:
|
||||
description: OIDC is the OIDC configuration for accessing the exposed APIPortal WebUI.
|
||||
properties:
|
||||
clientId:
|
||||
description: ClientID is the OIDC ClientID for accessing the exposed APIPortal WebUI.
|
||||
type: string
|
||||
companyClaim:
|
||||
description: CompanyClaim is the name of the JWT claim containing the user company.
|
||||
type: string
|
||||
emailClaim:
|
||||
description: EmailClaim is the name of the JWT claim containing the user email.
|
||||
type: string
|
||||
firstnameClaim:
|
||||
description: FirstnameClaim is the name of the JWT claim containing the user firstname.
|
||||
type: string
|
||||
generic:
|
||||
description: Generic indicates whether or not the APIPortal authentication relies on Generic OIDC.
|
||||
type: boolean
|
||||
groupsClaim:
|
||||
description: GroupsClaim is the name of the JWT claim containing the user groups.
|
||||
type: string
|
||||
issuer:
|
||||
description: Issuer is the OIDC issuer for accessing the exposed APIPortal WebUI.
|
||||
type: string
|
||||
lastnameClaim:
|
||||
description: LastnameClaim is the name of the JWT claim containing the user lastname.
|
||||
type: string
|
||||
scopes:
|
||||
description: Scopes is the OIDC scopes for getting user attributes during the authentication to the exposed APIPortal WebUI.
|
||||
type: string
|
||||
secretName:
|
||||
description: SecretName is the name of the secret containing the OIDC ClientSecret for accessing the exposed APIPortal WebUI.
|
||||
type: string
|
||||
syncedAttributes:
|
||||
description: SyncedAttributes configure the user attributes to sync.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
userIdClaim:
|
||||
description: UserIDClaim is the name of the JWT claim containing the user ID.
|
||||
type: string
|
||||
type: object
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,164 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: apiratelimits.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: APIRateLimit
|
||||
listKind: APIRateLimitList
|
||||
plural: apiratelimits
|
||||
singular: apiratelimit
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: APIRateLimit defines how group of consumers are rate limited on a set of APIs.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: The desired behavior of this APIRateLimit.
|
||||
properties:
|
||||
apiSelector:
|
||||
description: |-
|
||||
APISelector selects the APIs that will be rate limited.
|
||||
Multiple APIRateLimits can select the same set of APIs.
|
||||
This field is optional and follows standard label selector semantics.
|
||||
An empty APISelector matches any API.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
apis:
|
||||
description: |-
|
||||
APIs defines a set of APIs that will be rate limited.
|
||||
Multiple APIRateLimits can select the same APIs.
|
||||
When combined with APISelector, this set of APIs is appended to the matching APIs.
|
||||
items:
|
||||
description: APIReference references an API.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the API.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
maxItems: 100
|
||||
type: array
|
||||
x-kubernetes-validations:
|
||||
- message: duplicated apis
|
||||
rule: self.all(x, self.exists_one(y, x.name == y.name))
|
||||
everyone:
|
||||
description: |-
|
||||
Everyone indicates that all users will, by default, be rate limited with this configuration.
|
||||
If an APIRateLimit explicitly target a group, the default rate limit will be ignored.
|
||||
type: boolean
|
||||
groups:
|
||||
description: |-
|
||||
Groups are the consumer groups that will be rate limited.
|
||||
Multiple APIRateLimits can target the same set of consumer groups, the most restrictive one applies.
|
||||
When a consumer belongs to multiple groups, the least restrictive APIRateLimit applies.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
limit:
|
||||
description: Limit is the maximum number of token in the bucket.
|
||||
type: integer
|
||||
x-kubernetes-validations:
|
||||
- message: must be a positive number
|
||||
rule: self >= 0
|
||||
period:
|
||||
description: Period is the unit of time for the Limit.
|
||||
format: duration
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be between 1s and 1h
|
||||
rule: self >= duration('1s') && self <= duration('1h')
|
||||
strategy:
|
||||
description: |-
|
||||
Strategy defines how the bucket state will be synchronized between the different Traefik Hub instances.
|
||||
It can be, either "local" or "distributed".
|
||||
enum:
|
||||
- local
|
||||
- distributed
|
||||
type: string
|
||||
required:
|
||||
- limit
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: groups and everyone are mutually exclusive
|
||||
rule: '(has(self.everyone) && has(self.groups)) ? !(self.everyone && self.groups.size() > 0) : true'
|
||||
status:
|
||||
description: The current status of this APIRateLimit.
|
||||
properties:
|
||||
hash:
|
||||
description: Hash is a hash representing the APIRateLimit.
|
||||
type: string
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,231 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: apis.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: API
|
||||
listKind: APIList
|
||||
plural: apis
|
||||
singular: api
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
API defines an HTTP interface that is exposed to external clients. It specifies the supported versions
|
||||
and provides instructions for accessing its documentation. Once instantiated, an API object is associated
|
||||
with an Ingress, IngressRoute, or HTTPRoute resource, enabling the exposure of the described API to the outside world.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: APISpec describes the API.
|
||||
properties:
|
||||
cors:
|
||||
description: Cors defines the Cross-Origin Resource Sharing configuration.
|
||||
properties:
|
||||
addVaryHeader:
|
||||
description: AddVaryHeader defines whether the Vary header is automatically added/updated when the AllowOriginsList is set.
|
||||
type: boolean
|
||||
allowCredentials:
|
||||
description: AllowCredentials defines whether the request can include user credentials.
|
||||
type: boolean
|
||||
allowHeadersList:
|
||||
description: AllowHeadersList defines the Access-Control-Request-Headers values sent in preflight response.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
allowMethodsList:
|
||||
description: AllowMethodsList defines the Access-Control-Request-Method values sent in preflight response.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
allowOriginListRegex:
|
||||
description: AllowOriginListRegex is a list of allowable origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
allowOriginsList:
|
||||
description: AllowOriginsList is a list of allowable origins. Can also be a wildcard origin "*".
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
exposeHeadersList:
|
||||
description: ExposeHeadersList defines the Access-Control-Expose-Headers values sent in preflight response.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
maxAge:
|
||||
description: MaxAge defines the time that a preflight request may be cached.
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
description:
|
||||
description: Description explains what the API does.
|
||||
type: string
|
||||
openApiSpec:
|
||||
description: OpenAPISpec defines the API contract as an OpenAPI specification.
|
||||
properties:
|
||||
operationSets:
|
||||
description: OperationSets defines the sets of operations to be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.
|
||||
items:
|
||||
description: |-
|
||||
OperationSet gives a name to a set of matching OpenAPI operations.
|
||||
This set of operations can then be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.
|
||||
properties:
|
||||
matchers:
|
||||
description: Matchers defines a list of alternative rules for matching OpenAPI operations.
|
||||
items:
|
||||
description: OperationMatcher defines criteria for matching an OpenAPI operation.
|
||||
minProperties: 1
|
||||
properties:
|
||||
methods:
|
||||
description: Methods specifies the HTTP methods to be included for selection.
|
||||
items:
|
||||
type: string
|
||||
maxItems: 10
|
||||
type: array
|
||||
path:
|
||||
description: Path specifies the exact path of the operations to select.
|
||||
maxLength: 255
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must start with a '/'
|
||||
rule: self.startsWith('/')
|
||||
- message: cannot contains '../'
|
||||
rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")'
|
||||
pathPrefix:
|
||||
description: PathPrefix specifies the path prefix of the operations to select.
|
||||
maxLength: 255
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must start with a '/'
|
||||
rule: self.startsWith('/')
|
||||
- message: cannot contains '../'
|
||||
rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")'
|
||||
pathRegex:
|
||||
description: PathRegex specifies a regular expression pattern for matching operations based on their paths.
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: path, pathPrefix and pathRegex are mutually exclusive
|
||||
rule: '[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, x).size() <= 1'
|
||||
maxItems: 100
|
||||
minItems: 1
|
||||
type: array
|
||||
name:
|
||||
description: Name is the name of the OperationSet to reference in APICatalogItems or ManagedSubscriptions.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- matchers
|
||||
- name
|
||||
type: object
|
||||
maxItems: 100
|
||||
type: array
|
||||
override:
|
||||
description: Override holds data used to override OpenAPI specification.
|
||||
properties:
|
||||
servers:
|
||||
items:
|
||||
properties:
|
||||
url:
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be a valid URL
|
||||
rule: isURL(self)
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
maxItems: 100
|
||||
minItems: 1
|
||||
type: array
|
||||
required:
|
||||
- servers
|
||||
type: object
|
||||
path:
|
||||
description: |-
|
||||
Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained.
|
||||
The Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached.
|
||||
It's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services.
|
||||
The Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.
|
||||
maxLength: 255
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must start with a '/'
|
||||
rule: self.startsWith('/')
|
||||
- message: cannot contains '../'
|
||||
rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")'
|
||||
url:
|
||||
description: |-
|
||||
URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification.
|
||||
The URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be a valid URL
|
||||
rule: isURL(self)
|
||||
validateRequestMethodAndPath:
|
||||
description: |-
|
||||
ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.
|
||||
This option overrides the default behavior configured in the static configuration.
|
||||
type: boolean
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: path or url must be defined
|
||||
rule: has(self.path) || has(self.url)
|
||||
title:
|
||||
description: Title is the human-readable name of the API that will be used on the portal.
|
||||
maxLength: 253
|
||||
type: string
|
||||
versions:
|
||||
description: Versions are the different APIVersions available.
|
||||
items:
|
||||
description: APIVersionRef references an APIVersion.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the APIVersion.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
maxItems: 100
|
||||
minItems: 1
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
description: The current status of this API.
|
||||
properties:
|
||||
hash:
|
||||
description: Hash is a hash representing the API.
|
||||
type: string
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,231 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: apiversions.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: APIVersion
|
||||
listKind: APIVersionList
|
||||
plural: apiversions
|
||||
singular: apiversion
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.title
|
||||
name: Title
|
||||
type: string
|
||||
- jsonPath: .spec.release
|
||||
name: Release
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: APIVersion defines a version of an API.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: The desired behavior of this APIVersion.
|
||||
properties:
|
||||
cors:
|
||||
description: Cors defines the Cross-Origin Resource Sharing configuration.
|
||||
properties:
|
||||
addVaryHeader:
|
||||
description: AddVaryHeader defines whether the Vary header is automatically added/updated when the AllowOriginsList is set.
|
||||
type: boolean
|
||||
allowCredentials:
|
||||
description: AllowCredentials defines whether the request can include user credentials.
|
||||
type: boolean
|
||||
allowHeadersList:
|
||||
description: AllowHeadersList defines the Access-Control-Request-Headers values sent in preflight response.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
allowMethodsList:
|
||||
description: AllowMethodsList defines the Access-Control-Request-Method values sent in preflight response.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
allowOriginListRegex:
|
||||
description: AllowOriginListRegex is a list of allowable origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
allowOriginsList:
|
||||
description: AllowOriginsList is a list of allowable origins. Can also be a wildcard origin "*".
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
exposeHeadersList:
|
||||
description: ExposeHeadersList defines the Access-Control-Expose-Headers values sent in preflight response.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
maxAge:
|
||||
description: MaxAge defines the time that a preflight request may be cached.
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
description:
|
||||
description: Description explains what the APIVersion does.
|
||||
type: string
|
||||
openApiSpec:
|
||||
description: OpenAPISpec defines the API contract as an OpenAPI specification.
|
||||
properties:
|
||||
operationSets:
|
||||
description: OperationSets defines the sets of operations to be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.
|
||||
items:
|
||||
description: |-
|
||||
OperationSet gives a name to a set of matching OpenAPI operations.
|
||||
This set of operations can then be referenced for granular filtering in APICatalogItems or ManagedSubscriptions.
|
||||
properties:
|
||||
matchers:
|
||||
description: Matchers defines a list of alternative rules for matching OpenAPI operations.
|
||||
items:
|
||||
description: OperationMatcher defines criteria for matching an OpenAPI operation.
|
||||
minProperties: 1
|
||||
properties:
|
||||
methods:
|
||||
description: Methods specifies the HTTP methods to be included for selection.
|
||||
items:
|
||||
type: string
|
||||
maxItems: 10
|
||||
type: array
|
||||
path:
|
||||
description: Path specifies the exact path of the operations to select.
|
||||
maxLength: 255
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must start with a '/'
|
||||
rule: self.startsWith('/')
|
||||
- message: cannot contains '../'
|
||||
rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")'
|
||||
pathPrefix:
|
||||
description: PathPrefix specifies the path prefix of the operations to select.
|
||||
maxLength: 255
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must start with a '/'
|
||||
rule: self.startsWith('/')
|
||||
- message: cannot contains '../'
|
||||
rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")'
|
||||
pathRegex:
|
||||
description: PathRegex specifies a regular expression pattern for matching operations based on their paths.
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: path, pathPrefix and pathRegex are mutually exclusive
|
||||
rule: '[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, x).size() <= 1'
|
||||
maxItems: 100
|
||||
minItems: 1
|
||||
type: array
|
||||
name:
|
||||
description: Name is the name of the OperationSet to reference in APICatalogItems or ManagedSubscriptions.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- matchers
|
||||
- name
|
||||
type: object
|
||||
maxItems: 100
|
||||
type: array
|
||||
override:
|
||||
description: Override holds data used to override OpenAPI specification.
|
||||
properties:
|
||||
servers:
|
||||
items:
|
||||
properties:
|
||||
url:
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be a valid URL
|
||||
rule: isURL(self)
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
maxItems: 100
|
||||
minItems: 1
|
||||
type: array
|
||||
required:
|
||||
- servers
|
||||
type: object
|
||||
path:
|
||||
description: |-
|
||||
Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained.
|
||||
The Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached.
|
||||
It's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services.
|
||||
The Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.
|
||||
maxLength: 255
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must start with a '/'
|
||||
rule: self.startsWith('/')
|
||||
- message: cannot contains '../'
|
||||
rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")'
|
||||
url:
|
||||
description: |-
|
||||
URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification.
|
||||
The URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be a valid URL
|
||||
rule: isURL(self)
|
||||
validateRequestMethodAndPath:
|
||||
description: |-
|
||||
ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.
|
||||
This option overrides the default behavior configured in the static configuration.
|
||||
type: boolean
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: path or url must be defined
|
||||
rule: has(self.path) || has(self.url)
|
||||
release:
|
||||
description: |-
|
||||
Release is the version number of the API.
|
||||
This value must follow the SemVer format: https://semver.org/
|
||||
maxLength: 100
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: must be a valid semver version
|
||||
rule: self.matches(r"""^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$""")
|
||||
title:
|
||||
description: Title is the public facing name of the APIVersion.
|
||||
type: string
|
||||
required:
|
||||
- release
|
||||
type: object
|
||||
status:
|
||||
description: The current status of this APIVersion.
|
||||
properties:
|
||||
hash:
|
||||
description: Hash is a hash representing the APIVersion.
|
||||
type: string
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,517 @@
|
||||
---
|
||||
#
|
||||
# config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml
|
||||
#
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
|
||||
gateway.networking.k8s.io/bundle-version: v1.4.0
|
||||
gateway.networking.k8s.io/channel: standard
|
||||
name: gatewayclasses.gateway.networking.k8s.io
|
||||
spec:
|
||||
group: gateway.networking.k8s.io
|
||||
names:
|
||||
categories:
|
||||
- gateway-api
|
||||
kind: GatewayClass
|
||||
listKind: GatewayClassList
|
||||
plural: gatewayclasses
|
||||
shortNames:
|
||||
- gc
|
||||
singular: gatewayclass
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.controllerName
|
||||
name: Controller
|
||||
type: string
|
||||
- jsonPath: .status.conditions[?(@.type=="Accepted")].status
|
||||
name: Accepted
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
- jsonPath: .spec.description
|
||||
name: Description
|
||||
priority: 1
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
GatewayClass describes a class of Gateways available to the user for creating
|
||||
Gateway resources.
|
||||
|
||||
It is recommended that this resource be used as a template for Gateways. This
|
||||
means that a Gateway is based on the state of the GatewayClass at the time it
|
||||
was created and changes to the GatewayClass or associated parameters are not
|
||||
propagated down to existing Gateways. This recommendation is intended to
|
||||
limit the blast radius of changes to GatewayClass or associated parameters.
|
||||
If implementations choose to propagate GatewayClass changes to existing
|
||||
Gateways, that MUST be clearly documented by the implementation.
|
||||
|
||||
Whenever one or more Gateways are using a GatewayClass, implementations SHOULD
|
||||
add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the
|
||||
associated GatewayClass. This ensures that a GatewayClass associated with a
|
||||
Gateway is not deleted while in use.
|
||||
|
||||
GatewayClass is a Cluster level resource.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec defines the desired state of GatewayClass.
|
||||
properties:
|
||||
controllerName:
|
||||
description: |-
|
||||
ControllerName is the name of the controller that is managing Gateways of
|
||||
this class. The value of this field MUST be a domain prefixed path.
|
||||
|
||||
Example: "example.net/gateway-controller".
|
||||
|
||||
This field is not mutable and cannot be empty.
|
||||
|
||||
Support: Core
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: Value is immutable
|
||||
rule: self == oldSelf
|
||||
description:
|
||||
description: Description helps describe a GatewayClass with more details.
|
||||
maxLength: 64
|
||||
type: string
|
||||
parametersRef:
|
||||
description: |-
|
||||
ParametersRef is a reference to a resource that contains the configuration
|
||||
parameters corresponding to the GatewayClass. This is optional if the
|
||||
controller does not require any additional configuration.
|
||||
|
||||
ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,
|
||||
or an implementation-specific custom resource. The resource can be
|
||||
cluster-scoped or namespace-scoped.
|
||||
|
||||
If the referent cannot be found, refers to an unsupported kind, or when
|
||||
the data within that resource is malformed, the GatewayClass SHOULD be
|
||||
rejected with the "Accepted" status condition set to "False" and an
|
||||
"InvalidParameters" reason.
|
||||
|
||||
A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,
|
||||
the merging behavior is implementation specific.
|
||||
It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
|
||||
|
||||
Support: Implementation-specific
|
||||
properties:
|
||||
group:
|
||||
description: Group is the group of the referent.
|
||||
maxLength: 253
|
||||
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is kind of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the referent.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace is the namespace of the referent.
|
||||
This field is required when referring to a Namespace-scoped resource and
|
||||
MUST be unset when referring to a Cluster-scoped resource.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- controllerName
|
||||
type: object
|
||||
status:
|
||||
default:
|
||||
conditions:
|
||||
- lastTransitionTime: "1970-01-01T00:00:00Z"
|
||||
message: Waiting for controller
|
||||
reason: Pending
|
||||
status: Unknown
|
||||
type: Accepted
|
||||
description: |-
|
||||
Status defines the current state of GatewayClass.
|
||||
|
||||
Implementations MUST populate status on all GatewayClass resources which
|
||||
specify their controller name.
|
||||
properties:
|
||||
conditions:
|
||||
default:
|
||||
- lastTransitionTime: "1970-01-01T00:00:00Z"
|
||||
message: Waiting for controller
|
||||
reason: Pending
|
||||
status: Unknown
|
||||
type: Accepted
|
||||
description: |-
|
||||
Conditions is the current status from the controller for
|
||||
this GatewayClass.
|
||||
|
||||
Controllers should prefer to publish conditions using values
|
||||
of GatewayClassConditionType for the type of each Condition.
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
maxItems: 8
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- type
|
||||
x-kubernetes-list-type: map
|
||||
supportedFeatures:
|
||||
description: |-
|
||||
SupportedFeatures is the set of features the GatewayClass support.
|
||||
It MUST be sorted in ascending alphabetical order by the Name key.
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
FeatureName is used to describe distinct features that are covered by
|
||||
conformance tests.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
maxItems: 64
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.controllerName
|
||||
name: Controller
|
||||
type: string
|
||||
- jsonPath: .status.conditions[?(@.type=="Accepted")].status
|
||||
name: Accepted
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
- jsonPath: .spec.description
|
||||
name: Description
|
||||
priority: 1
|
||||
type: string
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
GatewayClass describes a class of Gateways available to the user for creating
|
||||
Gateway resources.
|
||||
|
||||
It is recommended that this resource be used as a template for Gateways. This
|
||||
means that a Gateway is based on the state of the GatewayClass at the time it
|
||||
was created and changes to the GatewayClass or associated parameters are not
|
||||
propagated down to existing Gateways. This recommendation is intended to
|
||||
limit the blast radius of changes to GatewayClass or associated parameters.
|
||||
If implementations choose to propagate GatewayClass changes to existing
|
||||
Gateways, that MUST be clearly documented by the implementation.
|
||||
|
||||
Whenever one or more Gateways are using a GatewayClass, implementations SHOULD
|
||||
add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the
|
||||
associated GatewayClass. This ensures that a GatewayClass associated with a
|
||||
Gateway is not deleted while in use.
|
||||
|
||||
GatewayClass is a Cluster level resource.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec defines the desired state of GatewayClass.
|
||||
properties:
|
||||
controllerName:
|
||||
description: |-
|
||||
ControllerName is the name of the controller that is managing Gateways of
|
||||
this class. The value of this field MUST be a domain prefixed path.
|
||||
|
||||
Example: "example.net/gateway-controller".
|
||||
|
||||
This field is not mutable and cannot be empty.
|
||||
|
||||
Support: Core
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: Value is immutable
|
||||
rule: self == oldSelf
|
||||
description:
|
||||
description: Description helps describe a GatewayClass with more details.
|
||||
maxLength: 64
|
||||
type: string
|
||||
parametersRef:
|
||||
description: |-
|
||||
ParametersRef is a reference to a resource that contains the configuration
|
||||
parameters corresponding to the GatewayClass. This is optional if the
|
||||
controller does not require any additional configuration.
|
||||
|
||||
ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,
|
||||
or an implementation-specific custom resource. The resource can be
|
||||
cluster-scoped or namespace-scoped.
|
||||
|
||||
If the referent cannot be found, refers to an unsupported kind, or when
|
||||
the data within that resource is malformed, the GatewayClass SHOULD be
|
||||
rejected with the "Accepted" status condition set to "False" and an
|
||||
"InvalidParameters" reason.
|
||||
|
||||
A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,
|
||||
the merging behavior is implementation specific.
|
||||
It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
|
||||
|
||||
Support: Implementation-specific
|
||||
properties:
|
||||
group:
|
||||
description: Group is the group of the referent.
|
||||
maxLength: 253
|
||||
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is kind of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the referent.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace is the namespace of the referent.
|
||||
This field is required when referring to a Namespace-scoped resource and
|
||||
MUST be unset when referring to a Cluster-scoped resource.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- controllerName
|
||||
type: object
|
||||
status:
|
||||
default:
|
||||
conditions:
|
||||
- lastTransitionTime: "1970-01-01T00:00:00Z"
|
||||
message: Waiting for controller
|
||||
reason: Pending
|
||||
status: Unknown
|
||||
type: Accepted
|
||||
description: |-
|
||||
Status defines the current state of GatewayClass.
|
||||
|
||||
Implementations MUST populate status on all GatewayClass resources which
|
||||
specify their controller name.
|
||||
properties:
|
||||
conditions:
|
||||
default:
|
||||
- lastTransitionTime: "1970-01-01T00:00:00Z"
|
||||
message: Waiting for controller
|
||||
reason: Pending
|
||||
status: Unknown
|
||||
type: Accepted
|
||||
description: |-
|
||||
Conditions is the current status from the controller for
|
||||
this GatewayClass.
|
||||
|
||||
Controllers should prefer to publish conditions using values
|
||||
of GatewayClassConditionType for the type of each Condition.
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
maxItems: 8
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- type
|
||||
x-kubernetes-list-type: map
|
||||
supportedFeatures:
|
||||
description: |-
|
||||
SupportedFeatures is the set of features the GatewayClass support.
|
||||
It MUST be sorted in ascending alphabetical order by the Name key.
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
FeatureName is used to describe distinct features that are covered by
|
||||
conformance tests.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
maxItems: 64
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,433 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.1
|
||||
name: ingressroutes.traefik.io
|
||||
spec:
|
||||
group: traefik.io
|
||||
names:
|
||||
kind: IngressRoute
|
||||
listKind: IngressRouteList
|
||||
plural: ingressroutes
|
||||
singular: ingressroute
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: IngressRoute is the CRD implementation of a Traefik HTTP Router.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: IngressRouteSpec defines the desired state of IngressRoute.
|
||||
properties:
|
||||
entryPoints:
|
||||
description: |-
|
||||
EntryPoints defines the list of entry point names to bind to.
|
||||
Entry points have to be configured in the static configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
|
||||
Default: all.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
parentRefs:
|
||||
description: |-
|
||||
ParentRefs defines references to parent IngressRoute resources for multi-layer routing.
|
||||
When set, this IngressRoute's routers will be children of the referenced parent IngressRoute's routers.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/routing/routers/#parentrefs
|
||||
items:
|
||||
description: IngressRouteRef is a reference to an IngressRoute resource.
|
||||
properties:
|
||||
name:
|
||||
description: Name defines the name of the referenced IngressRoute resource.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced IngressRoute resource.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
routes:
|
||||
description: Routes defines the list of routes.
|
||||
items:
|
||||
description: Route holds the HTTP route configuration.
|
||||
properties:
|
||||
kind:
|
||||
description: |-
|
||||
Kind defines the kind of the route.
|
||||
Rule is the only supported kind.
|
||||
If not defined, defaults to Rule.
|
||||
enum:
|
||||
- Rule
|
||||
type: string
|
||||
match:
|
||||
description: |-
|
||||
Match defines the router's rule.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/
|
||||
type: string
|
||||
middlewares:
|
||||
description: |-
|
||||
Middlewares defines the list of references to Middleware resources.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/middleware/
|
||||
items:
|
||||
description: MiddlewareRef is a reference to a Middleware resource.
|
||||
properties:
|
||||
name:
|
||||
description: Name defines the name of the referenced Middleware resource.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced Middleware resource.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
observability:
|
||||
description: |-
|
||||
Observability defines the observability configuration for a router.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/observability/
|
||||
properties:
|
||||
accessLogs:
|
||||
description: AccessLogs enables access logs for this router.
|
||||
type: boolean
|
||||
metrics:
|
||||
description: Metrics enables metrics for this router.
|
||||
type: boolean
|
||||
traceVerbosity:
|
||||
default: minimal
|
||||
description: TraceVerbosity defines the verbosity level of the tracing for this router.
|
||||
enum:
|
||||
- minimal
|
||||
- detailed
|
||||
type: string
|
||||
tracing:
|
||||
description: Tracing enables tracing for this router.
|
||||
type: boolean
|
||||
type: object
|
||||
priority:
|
||||
description: |-
|
||||
Priority defines the router's priority.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#priority
|
||||
maximum: 9223372036854775000
|
||||
type: integer
|
||||
services:
|
||||
description: |-
|
||||
Services defines the list of Service.
|
||||
It can contain any combination of TraefikService and/or reference to a Kubernetes Service.
|
||||
items:
|
||||
description: Service defines an upstream HTTP service to proxy traffic to.
|
||||
properties:
|
||||
healthCheck:
|
||||
description: Healthcheck defines health checks for ExternalName services.
|
||||
properties:
|
||||
followRedirects:
|
||||
description: |-
|
||||
FollowRedirects defines whether redirects should be followed during the health check calls.
|
||||
Default: true
|
||||
type: boolean
|
||||
headers:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Headers defines custom headers to be sent to the health check endpoint.
|
||||
type: object
|
||||
hostname:
|
||||
description: Hostname defines the value of hostname in the Host header of the health check request.
|
||||
type: string
|
||||
interval:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Interval defines the frequency of the health check calls for healthy targets.
|
||||
Default: 30s
|
||||
x-kubernetes-int-or-string: true
|
||||
method:
|
||||
description: Method defines the healthcheck method.
|
||||
type: string
|
||||
mode:
|
||||
description: |-
|
||||
Mode defines the health check mode.
|
||||
If defined to grpc, will use the gRPC health check protocol to probe the server.
|
||||
Default: http
|
||||
type: string
|
||||
path:
|
||||
description: Path defines the server URL path for the health check endpoint.
|
||||
type: string
|
||||
port:
|
||||
description: Port defines the server URL port for the health check endpoint.
|
||||
type: integer
|
||||
scheme:
|
||||
description: Scheme replaces the server URL scheme for the health check endpoint.
|
||||
type: string
|
||||
status:
|
||||
description: Status defines the expected HTTP status code of the response to the health check request.
|
||||
type: integer
|
||||
timeout:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
|
||||
Default: 5s
|
||||
x-kubernetes-int-or-string: true
|
||||
unhealthyInterval:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
|
||||
When UnhealthyInterval is not defined, it defaults to the Interval value.
|
||||
Default: 30s
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
kind:
|
||||
description: Kind defines the kind of the Service.
|
||||
enum:
|
||||
- Service
|
||||
- TraefikService
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name defines the name of the referenced Kubernetes Service or TraefikService.
|
||||
The differentiation between the two is specified in the Kind field.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.
|
||||
type: string
|
||||
nativeLB:
|
||||
description: |-
|
||||
NativeLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
|
||||
The Kubernetes Service itself does load-balance to the pods.
|
||||
By default, NativeLB is false.
|
||||
type: boolean
|
||||
nodePortLB:
|
||||
description: |-
|
||||
NodePortLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
|
||||
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
|
||||
By default, NodePortLB is false.
|
||||
type: boolean
|
||||
passHostHeader:
|
||||
description: |-
|
||||
PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
|
||||
By default, passHostHeader is true.
|
||||
type: boolean
|
||||
passiveHealthCheck:
|
||||
description: PassiveHealthCheck defines passive health checks for ExternalName services.
|
||||
properties:
|
||||
failureWindow:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.
|
||||
x-kubernetes-int-or-string: true
|
||||
maxFailedAttempts:
|
||||
description: MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.
|
||||
type: integer
|
||||
type: object
|
||||
port:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Port defines the port of a Kubernetes Service.
|
||||
This can be a reference to a named port.
|
||||
x-kubernetes-int-or-string: true
|
||||
responseForwarding:
|
||||
description: ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.
|
||||
properties:
|
||||
flushInterval:
|
||||
description: |-
|
||||
FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
|
||||
A negative value means to flush immediately after each write to the client.
|
||||
This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
|
||||
for such responses, writes are flushed to the client immediately.
|
||||
Default: 100ms
|
||||
type: string
|
||||
type: object
|
||||
scheme:
|
||||
description: |-
|
||||
Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
|
||||
It defaults to https when Kubernetes Service port is 443, http otherwise.
|
||||
type: string
|
||||
serversTransport:
|
||||
description: |-
|
||||
ServersTransport defines the name of ServersTransport resource to use.
|
||||
It allows to configure the transport between Traefik and your servers.
|
||||
Can only be used on a Kubernetes Service.
|
||||
type: string
|
||||
sticky:
|
||||
description: |-
|
||||
Sticky defines the sticky sessions configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
|
||||
properties:
|
||||
cookie:
|
||||
description: Cookie defines the sticky cookie configuration.
|
||||
properties:
|
||||
domain:
|
||||
description: |-
|
||||
Domain defines the host to which the cookie will be sent.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value
|
||||
type: string
|
||||
httpOnly:
|
||||
description: HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.
|
||||
type: boolean
|
||||
maxAge:
|
||||
description: |-
|
||||
MaxAge defines the number of seconds until the cookie expires.
|
||||
When set to a negative number, the cookie expires immediately.
|
||||
When set to zero, the cookie never expires.
|
||||
type: integer
|
||||
name:
|
||||
description: Name defines the Cookie name.
|
||||
type: string
|
||||
path:
|
||||
description: |-
|
||||
Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
|
||||
When not provided the cookie will be sent on every request to the domain.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
|
||||
type: string
|
||||
sameSite:
|
||||
description: |-
|
||||
SameSite defines the same site policy.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
|
||||
enum:
|
||||
- none
|
||||
- lax
|
||||
- strict
|
||||
type: string
|
||||
secure:
|
||||
description: Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
strategy:
|
||||
description: |-
|
||||
Strategy defines the load balancing strategy between the servers.
|
||||
Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
|
||||
RoundRobin value is deprecated and supported for backward compatibility.
|
||||
enum:
|
||||
- wrr
|
||||
- p2c
|
||||
- hrw
|
||||
- leasttime
|
||||
- RoundRobin
|
||||
type: string
|
||||
weight:
|
||||
description: |-
|
||||
Weight defines the weight and should only be specified when Name references a TraefikService object
|
||||
(and to be precise, one that embeds a Weighted Round Robin).
|
||||
minimum: 0
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
syntax:
|
||||
description: |-
|
||||
Syntax defines the router's rule syntax.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax
|
||||
Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
|
||||
type: string
|
||||
required:
|
||||
- match
|
||||
type: object
|
||||
type: array
|
||||
tls:
|
||||
description: |-
|
||||
TLS defines the TLS configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/routing/router/#tls
|
||||
properties:
|
||||
certResolver:
|
||||
description: |-
|
||||
CertResolver defines the name of the certificate resolver to use.
|
||||
Cert resolvers have to be configured in the static configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/
|
||||
type: string
|
||||
domains:
|
||||
description: |-
|
||||
Domains defines the list of domains that will be used to issue certificates.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#domains
|
||||
items:
|
||||
description: Domain holds a domain name with SANs.
|
||||
properties:
|
||||
main:
|
||||
description: Main defines the main domain name.
|
||||
type: string
|
||||
sans:
|
||||
description: SANs defines the subject alternative domain names.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
type: array
|
||||
options:
|
||||
description: |-
|
||||
Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
|
||||
If not defined, the `default` TLSOption is used.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-options/
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name defines the name of the referenced TLSOption.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace defines the namespace of the referenced TLSOption.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsoption/
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
secretName:
|
||||
description: SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.
|
||||
type: string
|
||||
store:
|
||||
description: |-
|
||||
Store defines the reference to the TLSStore, that will be used to store certificates.
|
||||
Please note that only `default` TLSStore can be used.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name defines the name of the referenced TLSStore.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace defines the namespace of the referenced TLSStore.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/tlsstore/
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- routes
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,239 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.1
|
||||
name: ingressroutetcps.traefik.io
|
||||
spec:
|
||||
group: traefik.io
|
||||
names:
|
||||
kind: IngressRouteTCP
|
||||
listKind: IngressRouteTCPList
|
||||
plural: ingressroutetcps
|
||||
singular: ingressroutetcp
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP.
|
||||
properties:
|
||||
entryPoints:
|
||||
description: |-
|
||||
EntryPoints defines the list of entry point names to bind to.
|
||||
Entry points have to be configured in the static configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
|
||||
Default: all.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
routes:
|
||||
description: Routes defines the list of routes.
|
||||
items:
|
||||
description: RouteTCP holds the TCP route configuration.
|
||||
properties:
|
||||
match:
|
||||
description: |-
|
||||
Match defines the router's rule.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/
|
||||
type: string
|
||||
middlewares:
|
||||
description: Middlewares defines the list of references to MiddlewareTCP resources.
|
||||
items:
|
||||
description: ObjectReference is a generic reference to a Traefik resource.
|
||||
properties:
|
||||
name:
|
||||
description: Name defines the name of the referenced Traefik resource.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced Traefik resource.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
priority:
|
||||
description: |-
|
||||
Priority defines the router's priority.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#priority
|
||||
maximum: 9223372036854775000
|
||||
type: integer
|
||||
services:
|
||||
description: Services defines the list of TCP services.
|
||||
items:
|
||||
description: ServiceTCP defines an upstream TCP service to proxy traffic to.
|
||||
properties:
|
||||
name:
|
||||
description: Name defines the name of the referenced Kubernetes Service.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced Kubernetes Service.
|
||||
type: string
|
||||
nativeLB:
|
||||
description: |-
|
||||
NativeLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
|
||||
The Kubernetes Service itself does load-balance to the pods.
|
||||
By default, NativeLB is false.
|
||||
type: boolean
|
||||
nodePortLB:
|
||||
description: |-
|
||||
NodePortLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
|
||||
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
|
||||
By default, NodePortLB is false.
|
||||
type: boolean
|
||||
port:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Port defines the port of a Kubernetes Service.
|
||||
This can be a reference to a named port.
|
||||
x-kubernetes-int-or-string: true
|
||||
proxyProtocol:
|
||||
description: |-
|
||||
ProxyProtocol defines the PROXY protocol configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/service/#proxy-protocol
|
||||
Deprecated: ProxyProtocol will not be supported in future APIVersions, please use ServersTransport to configure ProxyProtocol instead.
|
||||
properties:
|
||||
version:
|
||||
description: Version defines the PROXY Protocol version to use.
|
||||
maximum: 2
|
||||
minimum: 1
|
||||
type: integer
|
||||
type: object
|
||||
serversTransport:
|
||||
description: |-
|
||||
ServersTransport defines the name of ServersTransportTCP resource to use.
|
||||
It allows to configure the transport between Traefik and your servers.
|
||||
Can only be used on a Kubernetes Service.
|
||||
type: string
|
||||
terminationDelay:
|
||||
description: |-
|
||||
TerminationDelay defines the deadline that the proxy sets, after one of its connected peers indicates
|
||||
it has closed the writing capability of its connection, to close the reading capability as well,
|
||||
hence fully terminating the connection.
|
||||
It is a duration in milliseconds, defaulting to 100.
|
||||
A negative value means an infinite deadline (i.e. the reading capability is never closed).
|
||||
Deprecated: TerminationDelay will not be supported in future APIVersions, please use ServersTransport to configure the TerminationDelay instead.
|
||||
type: integer
|
||||
tls:
|
||||
description: TLS determines whether to use TLS when dialing with the backend.
|
||||
type: boolean
|
||||
weight:
|
||||
description: Weight defines the weight used when balancing requests between multiple Kubernetes Service.
|
||||
minimum: 0
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
- port
|
||||
type: object
|
||||
type: array
|
||||
syntax:
|
||||
description: |-
|
||||
Syntax defines the router's rule syntax.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax
|
||||
Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
|
||||
enum:
|
||||
- v3
|
||||
- v2
|
||||
type: string
|
||||
required:
|
||||
- match
|
||||
type: object
|
||||
type: array
|
||||
tls:
|
||||
description: |-
|
||||
TLS defines the TLS configuration on a layer 4 / TCP Route.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/routing/router/#tls
|
||||
properties:
|
||||
certResolver:
|
||||
description: |-
|
||||
CertResolver defines the name of the certificate resolver to use.
|
||||
Cert resolvers have to be configured in the static configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/tls/certificate-resolvers/acme/
|
||||
type: string
|
||||
domains:
|
||||
description: |-
|
||||
Domains defines the list of domains that will be used to issue certificates.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#domains
|
||||
items:
|
||||
description: Domain holds a domain name with SANs.
|
||||
properties:
|
||||
main:
|
||||
description: Main defines the main domain name.
|
||||
type: string
|
||||
sans:
|
||||
description: SANs defines the subject alternative domain names.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
type: array
|
||||
options:
|
||||
description: |-
|
||||
Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
|
||||
If not defined, the `default` TLSOption is used.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/tls/#tls-options
|
||||
properties:
|
||||
name:
|
||||
description: Name defines the name of the referenced Traefik resource.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced Traefik resource.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
passthrough:
|
||||
description: Passthrough defines whether a TLS router will terminate the TLS connection.
|
||||
type: boolean
|
||||
secretName:
|
||||
description: SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.
|
||||
type: string
|
||||
store:
|
||||
description: |-
|
||||
Store defines the reference to the TLSStore, that will be used to store certificates.
|
||||
Please note that only `default` TLSStore can be used.
|
||||
properties:
|
||||
name:
|
||||
description: Name defines the name of the referenced Traefik resource.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced Traefik resource.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- routes
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,108 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.1
|
||||
name: ingressrouteudps.traefik.io
|
||||
spec:
|
||||
group: traefik.io
|
||||
names:
|
||||
kind: IngressRouteUDP
|
||||
listKind: IngressRouteUDPList
|
||||
plural: ingressrouteudps
|
||||
singular: ingressrouteudp
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.
|
||||
properties:
|
||||
entryPoints:
|
||||
description: |-
|
||||
EntryPoints defines the list of entry point names to bind to.
|
||||
Entry points have to be configured in the static configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/
|
||||
Default: all.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
routes:
|
||||
description: Routes defines the list of routes.
|
||||
items:
|
||||
description: RouteUDP holds the UDP route configuration.
|
||||
properties:
|
||||
services:
|
||||
description: Services defines the list of UDP services.
|
||||
items:
|
||||
description: ServiceUDP defines an upstream UDP service to proxy traffic to.
|
||||
properties:
|
||||
name:
|
||||
description: Name defines the name of the referenced Kubernetes Service.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced Kubernetes Service.
|
||||
type: string
|
||||
nativeLB:
|
||||
description: |-
|
||||
NativeLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
|
||||
The Kubernetes Service itself does load-balance to the pods.
|
||||
By default, NativeLB is false.
|
||||
type: boolean
|
||||
nodePortLB:
|
||||
description: |-
|
||||
NodePortLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
|
||||
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
|
||||
By default, NodePortLB is false.
|
||||
type: boolean
|
||||
port:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Port defines the port of a Kubernetes Service.
|
||||
This can be a reference to a named port.
|
||||
x-kubernetes-int-or-string: true
|
||||
weight:
|
||||
description: Weight defines the weight used when balancing requests between multiple Kubernetes Service.
|
||||
minimum: 0
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
- port
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- routes
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,103 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: managedapplications.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: ManagedApplication
|
||||
listKind: ManagedApplicationList
|
||||
plural: managedapplications
|
||||
singular: managedapplication
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ManagedApplication represents a managed application.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ManagedApplicationSpec describes the ManagedApplication.
|
||||
properties:
|
||||
apiKeys:
|
||||
description: APIKeys references the API keys used to authenticate the application when calling APIs.
|
||||
items:
|
||||
properties:
|
||||
secretName:
|
||||
description: SecretName references the name of the secret containing the API key.
|
||||
maxLength: 253
|
||||
type: string
|
||||
suspended:
|
||||
type: boolean
|
||||
title:
|
||||
type: string
|
||||
value:
|
||||
description: Value is the API key value.
|
||||
maxLength: 4096
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: secretName and value are mutually exclusive
|
||||
rule: '[has(self.secretName), has(self.value)].filter(x, x).size() <= 1'
|
||||
maxItems: 100
|
||||
type: array
|
||||
appId:
|
||||
description: |-
|
||||
AppID is the identifier of the ManagedApplication.
|
||||
It should be unique.
|
||||
maxLength: 253
|
||||
type: string
|
||||
notes:
|
||||
description: Notes contains notes about application.
|
||||
type: string
|
||||
owner:
|
||||
description: |-
|
||||
Owner represents the owner of the ManagedApplication.
|
||||
It should be:
|
||||
- `sub` when using OIDC
|
||||
- `externalID` when using external IDP
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- appId
|
||||
- owner
|
||||
type: object
|
||||
status:
|
||||
description: The current status of this ManagedApplication.
|
||||
properties:
|
||||
apiKeyVersions:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
hash:
|
||||
description: Hash is a hash representing the ManagedApplication.
|
||||
type: string
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,221 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.1
|
||||
name: managedsubscriptions.hub.traefik.io
|
||||
spec:
|
||||
group: hub.traefik.io
|
||||
names:
|
||||
kind: ManagedSubscription
|
||||
listKind: ManagedSubscriptionList
|
||||
plural: managedsubscriptions
|
||||
singular: managedsubscription
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
ManagedSubscription defines a Subscription managed by the API manager as the result of a pre-negotiation with its
|
||||
API consumers. This subscription grant consuming access to a set of APIs to a set of Applications.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: The desired behavior of this ManagedSubscription.
|
||||
properties:
|
||||
apiBundles:
|
||||
description: |-
|
||||
APIBundles defines a set of APIBundle that will be accessible.
|
||||
Multiple ManagedSubscriptions can select the same APIBundles.
|
||||
items:
|
||||
description: APIBundleReference references an APIBundle.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the APIBundle.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
maxItems: 100
|
||||
type: array
|
||||
x-kubernetes-validations:
|
||||
- message: duplicated apiBundles
|
||||
rule: self.all(x, self.exists_one(y, x.name == y.name))
|
||||
apiPlan:
|
||||
description: APIPlan defines which APIPlan will be used.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the APIPlan.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
apiSelector:
|
||||
description: |-
|
||||
APISelector selects the APIs that will be accessible.
|
||||
Multiple ManagedSubscriptions can select the same set of APIs.
|
||||
This field is optional and follows standard label selector semantics.
|
||||
An empty APISelector matches any API.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
apis:
|
||||
description: |-
|
||||
APIs defines a set of APIs that will be accessible.
|
||||
Multiple ManagedSubscriptions can select the same APIs.
|
||||
When combined with APISelector, this set of APIs is appended to the matching APIs.
|
||||
items:
|
||||
description: APIReference references an API.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the API.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
maxItems: 100
|
||||
type: array
|
||||
x-kubernetes-validations:
|
||||
- message: duplicated apis
|
||||
rule: self.all(x, self.exists_one(y, x.name == y.name))
|
||||
applications:
|
||||
description: |-
|
||||
Applications references the Applications that will gain access to the specified APIs.
|
||||
Multiple ManagedSubscriptions can select the same AppID.
|
||||
Deprecated: Use ManagedApplications instead.
|
||||
items:
|
||||
description: ApplicationReference references an Application.
|
||||
properties:
|
||||
appId:
|
||||
description: |-
|
||||
AppID is the public identifier of the application.
|
||||
In the case of OIDC, it corresponds to the clientId.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- appId
|
||||
type: object
|
||||
maxItems: 100
|
||||
type: array
|
||||
claims:
|
||||
description: Claims specifies an expression that validate claims in order to authorize the request.
|
||||
type: string
|
||||
managedApplications:
|
||||
description: |-
|
||||
ManagedApplications references the ManagedApplications that will gain access to the specified APIs.
|
||||
Multiple ManagedSubscriptions can select the same ManagedApplication.
|
||||
items:
|
||||
description: ManagedApplicationReference references a ManagedApplication.
|
||||
properties:
|
||||
name:
|
||||
description: Name is the name of the ManagedApplication.
|
||||
maxLength: 253
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
maxItems: 100
|
||||
type: array
|
||||
x-kubernetes-validations:
|
||||
- message: duplicated managed applications
|
||||
rule: self.all(x, self.exists_one(y, x.name == y.name))
|
||||
operationFilter:
|
||||
description: |-
|
||||
OperationFilter specifies the allowed operations on APIs and APIVersions.
|
||||
If not set, all operations are available.
|
||||
An empty OperationFilter prohibits all operations.
|
||||
properties:
|
||||
include:
|
||||
description: Include defines the names of OperationSets that will be accessible.
|
||||
items:
|
||||
type: string
|
||||
maxItems: 100
|
||||
type: array
|
||||
type: object
|
||||
weight:
|
||||
description: |-
|
||||
Weight specifies the evaluation order of the APIPlan.
|
||||
When multiple ManagedSubscriptions targets the same API and Application with different APIPlan,
|
||||
the APIPlan with the highest weight will be enforced. If weights are equal, alphabetical order is used.
|
||||
type: integer
|
||||
x-kubernetes-validations:
|
||||
- message: must be a positive number
|
||||
rule: self >= 0
|
||||
required:
|
||||
- apiPlan
|
||||
type: object
|
||||
status:
|
||||
description: The current status of this ManagedSubscription.
|
||||
properties:
|
||||
hash:
|
||||
description: Hash is a hash representing the ManagedSubscription.
|
||||
type: string
|
||||
syncedAt:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,86 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.1
|
||||
name: middlewaretcps.traefik.io
|
||||
spec:
|
||||
group: traefik.io
|
||||
names:
|
||||
kind: MiddlewareTCP
|
||||
listKind: MiddlewareTCPList
|
||||
plural: middlewaretcps
|
||||
singular: middlewaretcp
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/overview/
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.
|
||||
properties:
|
||||
inFlightConn:
|
||||
description: InFlightConn defines the InFlightConn middleware configuration.
|
||||
properties:
|
||||
amount:
|
||||
description: |-
|
||||
Amount defines the maximum amount of allowed simultaneous connections.
|
||||
The middleware closes the connection if there are already amount connections opened.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
type: object
|
||||
ipAllowList:
|
||||
description: |-
|
||||
IPAllowList defines the IPAllowList middleware configuration.
|
||||
This middleware accepts/refuses connections based on the client IP.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipallowlist/
|
||||
properties:
|
||||
sourceRange:
|
||||
description: SourceRange defines the allowed IPs (or ranges of allowed IPs by using CIDR notation).
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
ipWhiteList:
|
||||
description: |-
|
||||
IPWhiteList defines the IPWhiteList middleware configuration.
|
||||
This middleware accepts/refuses connections based on the client IP.
|
||||
Deprecated: please use IPAllowList instead.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/middlewares/ipwhitelist/
|
||||
properties:
|
||||
sourceRange:
|
||||
description: SourceRange defines the allowed IPs (or ranges of allowed IPs by using CIDR notation).
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,193 @@
|
||||
---
|
||||
#
|
||||
# config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml
|
||||
#
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
|
||||
gateway.networking.k8s.io/bundle-version: v1.4.0
|
||||
gateway.networking.k8s.io/channel: standard
|
||||
name: referencegrants.gateway.networking.k8s.io
|
||||
spec:
|
||||
group: gateway.networking.k8s.io
|
||||
names:
|
||||
categories:
|
||||
- gateway-api
|
||||
kind: ReferenceGrant
|
||||
listKind: ReferenceGrantList
|
||||
plural: referencegrants
|
||||
shortNames:
|
||||
- refgrant
|
||||
singular: referencegrant
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
ReferenceGrant identifies kinds of resources in other namespaces that are
|
||||
trusted to reference the specified kinds of resources in the same namespace
|
||||
as the policy.
|
||||
|
||||
Each ReferenceGrant can be used to represent a unique trust relationship.
|
||||
Additional Reference Grants can be used to add to the set of trusted
|
||||
sources of inbound references for the namespace they are defined within.
|
||||
|
||||
All cross-namespace references in Gateway API (with the exception of cross-namespace
|
||||
Gateway-route attachment) require a ReferenceGrant.
|
||||
|
||||
ReferenceGrant is a form of runtime verification allowing users to assert
|
||||
which cross-namespace object references are permitted. Implementations that
|
||||
support ReferenceGrant MUST NOT permit cross-namespace references which have
|
||||
no grant, and MUST respond to the removal of a grant by revoking the access
|
||||
that the grant allowed.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec defines the desired state of ReferenceGrant.
|
||||
properties:
|
||||
from:
|
||||
description: |-
|
||||
From describes the trusted namespaces and kinds that can reference the
|
||||
resources described in "To". Each entry in this list MUST be considered
|
||||
to be an additional place that references can be valid from, or to put
|
||||
this another way, entries MUST be combined using OR.
|
||||
|
||||
Support: Core
|
||||
items:
|
||||
description: ReferenceGrantFrom describes trusted namespaces and kinds.
|
||||
properties:
|
||||
group:
|
||||
description: |-
|
||||
Group is the group of the referent.
|
||||
When empty, the Kubernetes core API group is inferred.
|
||||
|
||||
Support: Core
|
||||
maxLength: 253
|
||||
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is the kind of the referent. Although implementations may support
|
||||
additional resources, the following types are part of the "Core"
|
||||
support level for this field.
|
||||
|
||||
When used to permit a SecretObjectReference:
|
||||
|
||||
* Gateway
|
||||
|
||||
When used to permit a BackendObjectReference:
|
||||
|
||||
* GRPCRoute
|
||||
* HTTPRoute
|
||||
* TCPRoute
|
||||
* TLSRoute
|
||||
* UDPRoute
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace is the namespace of the referent.
|
||||
|
||||
Support: Core
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- namespace
|
||||
type: object
|
||||
maxItems: 16
|
||||
minItems: 1
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
to:
|
||||
description: |-
|
||||
To describes the resources that may be referenced by the resources
|
||||
described in "From". Each entry in this list MUST be considered to be an
|
||||
additional place that references can be valid to, or to put this another
|
||||
way, entries MUST be combined using OR.
|
||||
|
||||
Support: Core
|
||||
items:
|
||||
description: |-
|
||||
ReferenceGrantTo describes what Kinds are allowed as targets of the
|
||||
references.
|
||||
properties:
|
||||
group:
|
||||
description: |-
|
||||
Group is the group of the referent.
|
||||
When empty, the Kubernetes core API group is inferred.
|
||||
|
||||
Support: Core
|
||||
maxLength: 253
|
||||
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is the kind of the referent. Although implementations may support
|
||||
additional resources, the following types are part of the "Core"
|
||||
support level for this field:
|
||||
|
||||
* Secret when used to permit a SecretObjectReference
|
||||
* Service when used to permit a BackendObjectReference
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the referent. When unspecified, this policy
|
||||
refers to all resources of the specified Group and Kind in the local
|
||||
namespace.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
type: object
|
||||
maxItems: 16
|
||||
minItems: 1
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- from
|
||||
- to
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
@@ -0,0 +1,153 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.1
|
||||
name: serverstransports.traefik.io
|
||||
spec:
|
||||
group: traefik.io
|
||||
names:
|
||||
kind: ServersTransport
|
||||
listKind: ServersTransportList
|
||||
plural: serverstransports
|
||||
singular: serverstransport
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
ServersTransport is the CRD implementation of a ServersTransport.
|
||||
If no serversTransport is specified, the default@internal will be used.
|
||||
The default@internal serversTransport is created from the static configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/serverstransport/
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ServersTransportSpec defines the desired state of a ServersTransport.
|
||||
properties:
|
||||
certificatesSecrets:
|
||||
description: CertificatesSecrets defines a list of secret storing client certificates for mTLS.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
disableHTTP2:
|
||||
description: DisableHTTP2 disables HTTP/2 for connections with backend servers.
|
||||
type: boolean
|
||||
forwardingTimeouts:
|
||||
description: ForwardingTimeouts defines the timeouts for requests forwarded to the backend servers.
|
||||
properties:
|
||||
dialTimeout:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: DialTimeout is the amount of time to wait until a connection to a backend server can be established.
|
||||
pattern: ^([0-9]+(ns|us|µs|ms|s|m|h)?)+$
|
||||
x-kubernetes-int-or-string: true
|
||||
idleConnTimeout:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: IdleConnTimeout is the maximum period for which an idle HTTP keep-alive connection will remain open before closing itself.
|
||||
pattern: ^([0-9]+(ns|us|µs|ms|s|m|h)?)+$
|
||||
x-kubernetes-int-or-string: true
|
||||
pingTimeout:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: PingTimeout is the timeout after which the HTTP/2 connection will be closed if a response to ping is not received.
|
||||
pattern: ^([0-9]+(ns|us|µs|ms|s|m|h)?)+$
|
||||
x-kubernetes-int-or-string: true
|
||||
readIdleTimeout:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: ReadIdleTimeout is the timeout after which a health check using ping frame will be carried out if no frame is received on the HTTP/2 connection.
|
||||
pattern: ^([0-9]+(ns|us|µs|ms|s|m|h)?)+$
|
||||
x-kubernetes-int-or-string: true
|
||||
responseHeaderTimeout:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: ResponseHeaderTimeout is the amount of time to wait for a server's response headers after fully writing the request (including its body, if any).
|
||||
pattern: ^([0-9]+(ns|us|µs|ms|s|m|h)?)+$
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
insecureSkipVerify:
|
||||
description: InsecureSkipVerify disables SSL certificate verification.
|
||||
type: boolean
|
||||
maxIdleConnsPerHost:
|
||||
description: MaxIdleConnsPerHost controls the maximum idle (keep-alive) to keep per-host.
|
||||
minimum: -1
|
||||
type: integer
|
||||
peerCertURI:
|
||||
description: PeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification.
|
||||
type: string
|
||||
rootCAs:
|
||||
description: RootCAs defines a list of CA certificate Secrets or ConfigMaps used to validate server certificates.
|
||||
items:
|
||||
description: |-
|
||||
RootCA defines a reference to a Secret or a ConfigMap that holds a CA certificate.
|
||||
If both a Secret and a ConfigMap reference are defined, the Secret reference takes precedence.
|
||||
properties:
|
||||
configMap:
|
||||
description: |-
|
||||
ConfigMap defines the name of a ConfigMap that holds a CA certificate.
|
||||
The referenced ConfigMap must contain a certificate under either a tls.ca or a ca.crt key.
|
||||
type: string
|
||||
secret:
|
||||
description: |-
|
||||
Secret defines the name of a Secret that holds a CA certificate.
|
||||
The referenced Secret must contain a certificate under either a tls.ca or a ca.crt key.
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: RootCA cannot have both Secret and ConfigMap defined.
|
||||
rule: '!has(self.secret) || !has(self.configMap)'
|
||||
type: array
|
||||
rootCAsSecrets:
|
||||
description: |-
|
||||
RootCAsSecrets defines a list of CA secret used to validate self-signed certificate.
|
||||
Deprecated: RootCAsSecrets is deprecated, please use the RootCAs option instead.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
serverName:
|
||||
description: ServerName defines the server name used to contact the server.
|
||||
type: string
|
||||
spiffe:
|
||||
description: Spiffe defines the SPIFFE configuration.
|
||||
properties:
|
||||
ids:
|
||||
description: IDs defines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
trustDomain:
|
||||
description: TrustDomain defines the allowed SPIFFE trust domain.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,143 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.1
|
||||
name: serverstransporttcps.traefik.io
|
||||
spec:
|
||||
group: traefik.io
|
||||
names:
|
||||
kind: ServersTransportTCP
|
||||
listKind: ServersTransportTCPList
|
||||
plural: serverstransporttcps
|
||||
singular: serverstransporttcp
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
ServersTransportTCP is the CRD implementation of a TCPServersTransport.
|
||||
If no tcpServersTransport is specified, a default one named default@internal will be used.
|
||||
The default@internal tcpServersTransport can be configured in the static configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/tcp/serverstransport/
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ServersTransportTCPSpec defines the desired state of a ServersTransportTCP.
|
||||
properties:
|
||||
dialKeepAlive:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: DialKeepAlive is the interval between keep-alive probes for an active network connection. If zero, keep-alive probes are sent with a default value (currently 15 seconds), if supported by the protocol and operating system. Network protocols or operating systems that do not support keep-alives ignore this field. If negative, keep-alive probes are disabled.
|
||||
pattern: ^([0-9]+(ns|us|µs|ms|s|m|h)?)+$
|
||||
x-kubernetes-int-or-string: true
|
||||
dialTimeout:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: DialTimeout is the amount of time to wait until a connection to a backend server can be established.
|
||||
pattern: ^([0-9]+(ns|us|µs|ms|s|m|h)?)+$
|
||||
x-kubernetes-int-or-string: true
|
||||
proxyProtocol:
|
||||
description: ProxyProtocol holds the PROXY Protocol configuration.
|
||||
properties:
|
||||
version:
|
||||
description: Version defines the PROXY Protocol version to use.
|
||||
maximum: 2
|
||||
minimum: 1
|
||||
type: integer
|
||||
type: object
|
||||
terminationDelay:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: TerminationDelay defines the delay to wait before fully terminating the connection, after one connected peer has closed its writing capability.
|
||||
pattern: ^([0-9]+(ns|us|µs|ms|s|m|h)?)+$
|
||||
x-kubernetes-int-or-string: true
|
||||
tls:
|
||||
description: TLS defines the TLS configuration
|
||||
properties:
|
||||
certificatesSecrets:
|
||||
description: CertificatesSecrets defines a list of secret storing client certificates for mTLS.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
insecureSkipVerify:
|
||||
description: InsecureSkipVerify disables TLS certificate verification.
|
||||
type: boolean
|
||||
peerCertURI:
|
||||
description: |-
|
||||
MaxIdleConnsPerHost controls the maximum idle (keep-alive) to keep per-host.
|
||||
PeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification.
|
||||
type: string
|
||||
rootCAs:
|
||||
description: RootCAs defines a list of CA certificate Secrets or ConfigMaps used to validate server certificates.
|
||||
items:
|
||||
description: |-
|
||||
RootCA defines a reference to a Secret or a ConfigMap that holds a CA certificate.
|
||||
If both a Secret and a ConfigMap reference are defined, the Secret reference takes precedence.
|
||||
properties:
|
||||
configMap:
|
||||
description: |-
|
||||
ConfigMap defines the name of a ConfigMap that holds a CA certificate.
|
||||
The referenced ConfigMap must contain a certificate under either a tls.ca or a ca.crt key.
|
||||
type: string
|
||||
secret:
|
||||
description: |-
|
||||
Secret defines the name of a Secret that holds a CA certificate.
|
||||
The referenced Secret must contain a certificate under either a tls.ca or a ca.crt key.
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: RootCA cannot have both Secret and ConfigMap defined.
|
||||
rule: '!has(self.secret) || !has(self.configMap)'
|
||||
type: array
|
||||
rootCAsSecrets:
|
||||
description: |-
|
||||
RootCAsSecrets defines a list of CA secret used to validate self-signed certificate.
|
||||
Deprecated: RootCAsSecrets is deprecated, please use the RootCAs option instead.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
serverName:
|
||||
description: ServerName defines the server name used to contact the server.
|
||||
type: string
|
||||
spiffe:
|
||||
description: Spiffe defines the SPIFFE configuration.
|
||||
properties:
|
||||
ids:
|
||||
description: IDs defines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
trustDomain:
|
||||
description: TrustDomain defines the allowed SPIFFE trust domain.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,113 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.1
|
||||
name: tlsoptions.traefik.io
|
||||
spec:
|
||||
group: traefik.io
|
||||
names:
|
||||
kind: TLSOption
|
||||
listKind: TLSOptionList
|
||||
plural: tlsoptions
|
||||
singular: tlsoption
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: TLSOptionSpec defines the desired state of a TLSOption.
|
||||
properties:
|
||||
alpnProtocols:
|
||||
description: |-
|
||||
ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
cipherSuites:
|
||||
description: |-
|
||||
CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
clientAuth:
|
||||
description: ClientAuth defines the server's policy for TLS Client Authentication.
|
||||
properties:
|
||||
clientAuthType:
|
||||
description: ClientAuthType defines the client authentication type to apply.
|
||||
enum:
|
||||
- NoClientCert
|
||||
- RequestClientCert
|
||||
- RequireAnyClientCert
|
||||
- VerifyClientCertIfGiven
|
||||
- RequireAndVerifyClientCert
|
||||
type: string
|
||||
secretNames:
|
||||
description: SecretNames defines the names of the referenced Kubernetes Secret storing certificate details.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
curvePreferences:
|
||||
description: |-
|
||||
CurvePreferences defines the preferred elliptic curves.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
disableSessionTickets:
|
||||
description: DisableSessionTickets disables TLS session resumption via session tickets.
|
||||
type: boolean
|
||||
maxVersion:
|
||||
description: |-
|
||||
MaxVersion defines the maximum TLS version that Traefik will accept.
|
||||
Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
|
||||
Default: None.
|
||||
type: string
|
||||
minVersion:
|
||||
description: |-
|
||||
MinVersion defines the minimum TLS version that Traefik will accept.
|
||||
Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
|
||||
Default: VersionTLS10.
|
||||
type: string
|
||||
preferServerCipherSuites:
|
||||
description: |-
|
||||
PreferServerCipherSuites defines whether the server chooses a cipher suite among his own instead of among the client's.
|
||||
It is enabled automatically when minVersion or maxVersion is set.
|
||||
Deprecated: https://github.com/golang/go/issues/45430
|
||||
type: boolean
|
||||
sniStrict:
|
||||
description: SniStrict defines whether Traefik allows connections from clients connections that do not specify a server_name extension.
|
||||
type: boolean
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,92 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.1
|
||||
name: tlsstores.traefik.io
|
||||
spec:
|
||||
group: traefik.io
|
||||
names:
|
||||
kind: TLSStore
|
||||
listKind: TLSStoreList
|
||||
plural: tlsstores
|
||||
singular: tlsstore
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
TLSStore is the CRD implementation of a Traefik TLS Store.
|
||||
For the time being, only the TLSStore named default is supported.
|
||||
This means that you cannot have two stores that are named default in different Kubernetes namespaces.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: TLSStoreSpec defines the desired state of a TLSStore.
|
||||
properties:
|
||||
certificates:
|
||||
description: Certificates is a list of secret names, each secret holding a key/certificate pair to add to the store.
|
||||
items:
|
||||
description: Certificate holds a secret name for the TLSStore resource.
|
||||
properties:
|
||||
secretName:
|
||||
description: SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
type: array
|
||||
defaultCertificate:
|
||||
description: DefaultCertificate defines the default certificate configuration.
|
||||
properties:
|
||||
secretName:
|
||||
description: SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
defaultGeneratedCert:
|
||||
description: DefaultGeneratedCert defines the default generated certificate configuration.
|
||||
properties:
|
||||
domain:
|
||||
description: Domain is the domain definition for the DefaultCertificate.
|
||||
properties:
|
||||
main:
|
||||
description: Main defines the main domain name.
|
||||
type: string
|
||||
sans:
|
||||
description: SANs defines the subject alternative domain names.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
resolver:
|
||||
description: Resolver is the name of the resolver that will be used to issue the DefaultCertificate.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,968 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.1
|
||||
name: traefikservices.traefik.io
|
||||
spec:
|
||||
group: traefik.io
|
||||
names:
|
||||
kind: TraefikService
|
||||
listKind: TraefikServiceList
|
||||
plural: traefikservices
|
||||
singular: traefikservice
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
TraefikService is the CRD implementation of a Traefik Service.
|
||||
TraefikService object allows to:
|
||||
- Apply weight to Services on load-balancing
|
||||
- Mirror traffic on services
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: TraefikServiceSpec defines the desired state of a TraefikService.
|
||||
properties:
|
||||
highestRandomWeight:
|
||||
description: HighestRandomWeight defines the highest random weight service configuration.
|
||||
properties:
|
||||
services:
|
||||
description: Services defines the list of Kubernetes Service and/or TraefikService to load-balance, with weight.
|
||||
items:
|
||||
description: Service defines an upstream HTTP service to proxy traffic to.
|
||||
properties:
|
||||
healthCheck:
|
||||
description: Healthcheck defines health checks for ExternalName services.
|
||||
properties:
|
||||
followRedirects:
|
||||
description: |-
|
||||
FollowRedirects defines whether redirects should be followed during the health check calls.
|
||||
Default: true
|
||||
type: boolean
|
||||
headers:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Headers defines custom headers to be sent to the health check endpoint.
|
||||
type: object
|
||||
hostname:
|
||||
description: Hostname defines the value of hostname in the Host header of the health check request.
|
||||
type: string
|
||||
interval:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Interval defines the frequency of the health check calls for healthy targets.
|
||||
Default: 30s
|
||||
x-kubernetes-int-or-string: true
|
||||
method:
|
||||
description: Method defines the healthcheck method.
|
||||
type: string
|
||||
mode:
|
||||
description: |-
|
||||
Mode defines the health check mode.
|
||||
If defined to grpc, will use the gRPC health check protocol to probe the server.
|
||||
Default: http
|
||||
type: string
|
||||
path:
|
||||
description: Path defines the server URL path for the health check endpoint.
|
||||
type: string
|
||||
port:
|
||||
description: Port defines the server URL port for the health check endpoint.
|
||||
type: integer
|
||||
scheme:
|
||||
description: Scheme replaces the server URL scheme for the health check endpoint.
|
||||
type: string
|
||||
status:
|
||||
description: Status defines the expected HTTP status code of the response to the health check request.
|
||||
type: integer
|
||||
timeout:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
|
||||
Default: 5s
|
||||
x-kubernetes-int-or-string: true
|
||||
unhealthyInterval:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
|
||||
When UnhealthyInterval is not defined, it defaults to the Interval value.
|
||||
Default: 30s
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
kind:
|
||||
description: Kind defines the kind of the Service.
|
||||
enum:
|
||||
- Service
|
||||
- TraefikService
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name defines the name of the referenced Kubernetes Service or TraefikService.
|
||||
The differentiation between the two is specified in the Kind field.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.
|
||||
type: string
|
||||
nativeLB:
|
||||
description: |-
|
||||
NativeLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
|
||||
The Kubernetes Service itself does load-balance to the pods.
|
||||
By default, NativeLB is false.
|
||||
type: boolean
|
||||
nodePortLB:
|
||||
description: |-
|
||||
NodePortLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
|
||||
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
|
||||
By default, NodePortLB is false.
|
||||
type: boolean
|
||||
passHostHeader:
|
||||
description: |-
|
||||
PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
|
||||
By default, passHostHeader is true.
|
||||
type: boolean
|
||||
passiveHealthCheck:
|
||||
description: PassiveHealthCheck defines passive health checks for ExternalName services.
|
||||
properties:
|
||||
failureWindow:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.
|
||||
x-kubernetes-int-or-string: true
|
||||
maxFailedAttempts:
|
||||
description: MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.
|
||||
type: integer
|
||||
type: object
|
||||
port:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Port defines the port of a Kubernetes Service.
|
||||
This can be a reference to a named port.
|
||||
x-kubernetes-int-or-string: true
|
||||
responseForwarding:
|
||||
description: ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.
|
||||
properties:
|
||||
flushInterval:
|
||||
description: |-
|
||||
FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
|
||||
A negative value means to flush immediately after each write to the client.
|
||||
This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
|
||||
for such responses, writes are flushed to the client immediately.
|
||||
Default: 100ms
|
||||
type: string
|
||||
type: object
|
||||
scheme:
|
||||
description: |-
|
||||
Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
|
||||
It defaults to https when Kubernetes Service port is 443, http otherwise.
|
||||
type: string
|
||||
serversTransport:
|
||||
description: |-
|
||||
ServersTransport defines the name of ServersTransport resource to use.
|
||||
It allows to configure the transport between Traefik and your servers.
|
||||
Can only be used on a Kubernetes Service.
|
||||
type: string
|
||||
sticky:
|
||||
description: |-
|
||||
Sticky defines the sticky sessions configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
|
||||
properties:
|
||||
cookie:
|
||||
description: Cookie defines the sticky cookie configuration.
|
||||
properties:
|
||||
domain:
|
||||
description: |-
|
||||
Domain defines the host to which the cookie will be sent.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value
|
||||
type: string
|
||||
httpOnly:
|
||||
description: HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.
|
||||
type: boolean
|
||||
maxAge:
|
||||
description: |-
|
||||
MaxAge defines the number of seconds until the cookie expires.
|
||||
When set to a negative number, the cookie expires immediately.
|
||||
When set to zero, the cookie never expires.
|
||||
type: integer
|
||||
name:
|
||||
description: Name defines the Cookie name.
|
||||
type: string
|
||||
path:
|
||||
description: |-
|
||||
Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
|
||||
When not provided the cookie will be sent on every request to the domain.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
|
||||
type: string
|
||||
sameSite:
|
||||
description: |-
|
||||
SameSite defines the same site policy.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
|
||||
enum:
|
||||
- none
|
||||
- lax
|
||||
- strict
|
||||
type: string
|
||||
secure:
|
||||
description: Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
strategy:
|
||||
description: |-
|
||||
Strategy defines the load balancing strategy between the servers.
|
||||
Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
|
||||
RoundRobin value is deprecated and supported for backward compatibility.
|
||||
enum:
|
||||
- wrr
|
||||
- p2c
|
||||
- hrw
|
||||
- leasttime
|
||||
- RoundRobin
|
||||
type: string
|
||||
weight:
|
||||
description: |-
|
||||
Weight defines the weight and should only be specified when Name references a TraefikService object
|
||||
(and to be precise, one that embeds a Weighted Round Robin).
|
||||
minimum: 0
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
mirroring:
|
||||
description: Mirroring defines the Mirroring service configuration.
|
||||
properties:
|
||||
healthCheck:
|
||||
description: Healthcheck defines health checks for ExternalName services.
|
||||
properties:
|
||||
followRedirects:
|
||||
description: |-
|
||||
FollowRedirects defines whether redirects should be followed during the health check calls.
|
||||
Default: true
|
||||
type: boolean
|
||||
headers:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Headers defines custom headers to be sent to the health check endpoint.
|
||||
type: object
|
||||
hostname:
|
||||
description: Hostname defines the value of hostname in the Host header of the health check request.
|
||||
type: string
|
||||
interval:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Interval defines the frequency of the health check calls for healthy targets.
|
||||
Default: 30s
|
||||
x-kubernetes-int-or-string: true
|
||||
method:
|
||||
description: Method defines the healthcheck method.
|
||||
type: string
|
||||
mode:
|
||||
description: |-
|
||||
Mode defines the health check mode.
|
||||
If defined to grpc, will use the gRPC health check protocol to probe the server.
|
||||
Default: http
|
||||
type: string
|
||||
path:
|
||||
description: Path defines the server URL path for the health check endpoint.
|
||||
type: string
|
||||
port:
|
||||
description: Port defines the server URL port for the health check endpoint.
|
||||
type: integer
|
||||
scheme:
|
||||
description: Scheme replaces the server URL scheme for the health check endpoint.
|
||||
type: string
|
||||
status:
|
||||
description: Status defines the expected HTTP status code of the response to the health check request.
|
||||
type: integer
|
||||
timeout:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
|
||||
Default: 5s
|
||||
x-kubernetes-int-or-string: true
|
||||
unhealthyInterval:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
|
||||
When UnhealthyInterval is not defined, it defaults to the Interval value.
|
||||
Default: 30s
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
kind:
|
||||
description: Kind defines the kind of the Service.
|
||||
enum:
|
||||
- Service
|
||||
- TraefikService
|
||||
type: string
|
||||
maxBodySize:
|
||||
description: |-
|
||||
MaxBodySize defines the maximum size allowed for the body of the request.
|
||||
If the body is larger, the request is not mirrored.
|
||||
Default value is -1, which means unlimited size.
|
||||
format: int64
|
||||
type: integer
|
||||
mirrorBody:
|
||||
description: |-
|
||||
MirrorBody defines whether the body of the request should be mirrored.
|
||||
Default value is true.
|
||||
type: boolean
|
||||
mirrors:
|
||||
description: Mirrors defines the list of mirrors where Traefik will duplicate the traffic.
|
||||
items:
|
||||
description: MirrorService holds the mirror configuration.
|
||||
properties:
|
||||
healthCheck:
|
||||
description: Healthcheck defines health checks for ExternalName services.
|
||||
properties:
|
||||
followRedirects:
|
||||
description: |-
|
||||
FollowRedirects defines whether redirects should be followed during the health check calls.
|
||||
Default: true
|
||||
type: boolean
|
||||
headers:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Headers defines custom headers to be sent to the health check endpoint.
|
||||
type: object
|
||||
hostname:
|
||||
description: Hostname defines the value of hostname in the Host header of the health check request.
|
||||
type: string
|
||||
interval:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Interval defines the frequency of the health check calls for healthy targets.
|
||||
Default: 30s
|
||||
x-kubernetes-int-or-string: true
|
||||
method:
|
||||
description: Method defines the healthcheck method.
|
||||
type: string
|
||||
mode:
|
||||
description: |-
|
||||
Mode defines the health check mode.
|
||||
If defined to grpc, will use the gRPC health check protocol to probe the server.
|
||||
Default: http
|
||||
type: string
|
||||
path:
|
||||
description: Path defines the server URL path for the health check endpoint.
|
||||
type: string
|
||||
port:
|
||||
description: Port defines the server URL port for the health check endpoint.
|
||||
type: integer
|
||||
scheme:
|
||||
description: Scheme replaces the server URL scheme for the health check endpoint.
|
||||
type: string
|
||||
status:
|
||||
description: Status defines the expected HTTP status code of the response to the health check request.
|
||||
type: integer
|
||||
timeout:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
|
||||
Default: 5s
|
||||
x-kubernetes-int-or-string: true
|
||||
unhealthyInterval:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
|
||||
When UnhealthyInterval is not defined, it defaults to the Interval value.
|
||||
Default: 30s
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
kind:
|
||||
description: Kind defines the kind of the Service.
|
||||
enum:
|
||||
- Service
|
||||
- TraefikService
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name defines the name of the referenced Kubernetes Service or TraefikService.
|
||||
The differentiation between the two is specified in the Kind field.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.
|
||||
type: string
|
||||
nativeLB:
|
||||
description: |-
|
||||
NativeLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
|
||||
The Kubernetes Service itself does load-balance to the pods.
|
||||
By default, NativeLB is false.
|
||||
type: boolean
|
||||
nodePortLB:
|
||||
description: |-
|
||||
NodePortLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
|
||||
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
|
||||
By default, NodePortLB is false.
|
||||
type: boolean
|
||||
passHostHeader:
|
||||
description: |-
|
||||
PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
|
||||
By default, passHostHeader is true.
|
||||
type: boolean
|
||||
passiveHealthCheck:
|
||||
description: PassiveHealthCheck defines passive health checks for ExternalName services.
|
||||
properties:
|
||||
failureWindow:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.
|
||||
x-kubernetes-int-or-string: true
|
||||
maxFailedAttempts:
|
||||
description: MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.
|
||||
type: integer
|
||||
type: object
|
||||
percent:
|
||||
description: |-
|
||||
Percent defines the part of the traffic to mirror.
|
||||
Supported values: 0 to 100.
|
||||
type: integer
|
||||
port:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Port defines the port of a Kubernetes Service.
|
||||
This can be a reference to a named port.
|
||||
x-kubernetes-int-or-string: true
|
||||
responseForwarding:
|
||||
description: ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.
|
||||
properties:
|
||||
flushInterval:
|
||||
description: |-
|
||||
FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
|
||||
A negative value means to flush immediately after each write to the client.
|
||||
This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
|
||||
for such responses, writes are flushed to the client immediately.
|
||||
Default: 100ms
|
||||
type: string
|
||||
type: object
|
||||
scheme:
|
||||
description: |-
|
||||
Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
|
||||
It defaults to https when Kubernetes Service port is 443, http otherwise.
|
||||
type: string
|
||||
serversTransport:
|
||||
description: |-
|
||||
ServersTransport defines the name of ServersTransport resource to use.
|
||||
It allows to configure the transport between Traefik and your servers.
|
||||
Can only be used on a Kubernetes Service.
|
||||
type: string
|
||||
sticky:
|
||||
description: |-
|
||||
Sticky defines the sticky sessions configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
|
||||
properties:
|
||||
cookie:
|
||||
description: Cookie defines the sticky cookie configuration.
|
||||
properties:
|
||||
domain:
|
||||
description: |-
|
||||
Domain defines the host to which the cookie will be sent.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value
|
||||
type: string
|
||||
httpOnly:
|
||||
description: HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.
|
||||
type: boolean
|
||||
maxAge:
|
||||
description: |-
|
||||
MaxAge defines the number of seconds until the cookie expires.
|
||||
When set to a negative number, the cookie expires immediately.
|
||||
When set to zero, the cookie never expires.
|
||||
type: integer
|
||||
name:
|
||||
description: Name defines the Cookie name.
|
||||
type: string
|
||||
path:
|
||||
description: |-
|
||||
Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
|
||||
When not provided the cookie will be sent on every request to the domain.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
|
||||
type: string
|
||||
sameSite:
|
||||
description: |-
|
||||
SameSite defines the same site policy.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
|
||||
enum:
|
||||
- none
|
||||
- lax
|
||||
- strict
|
||||
type: string
|
||||
secure:
|
||||
description: Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
strategy:
|
||||
description: |-
|
||||
Strategy defines the load balancing strategy between the servers.
|
||||
Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
|
||||
RoundRobin value is deprecated and supported for backward compatibility.
|
||||
enum:
|
||||
- wrr
|
||||
- p2c
|
||||
- hrw
|
||||
- leasttime
|
||||
- RoundRobin
|
||||
type: string
|
||||
weight:
|
||||
description: |-
|
||||
Weight defines the weight and should only be specified when Name references a TraefikService object
|
||||
(and to be precise, one that embeds a Weighted Round Robin).
|
||||
minimum: 0
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: |-
|
||||
Name defines the name of the referenced Kubernetes Service or TraefikService.
|
||||
The differentiation between the two is specified in the Kind field.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.
|
||||
type: string
|
||||
nativeLB:
|
||||
description: |-
|
||||
NativeLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
|
||||
The Kubernetes Service itself does load-balance to the pods.
|
||||
By default, NativeLB is false.
|
||||
type: boolean
|
||||
nodePortLB:
|
||||
description: |-
|
||||
NodePortLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
|
||||
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
|
||||
By default, NodePortLB is false.
|
||||
type: boolean
|
||||
passHostHeader:
|
||||
description: |-
|
||||
PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
|
||||
By default, passHostHeader is true.
|
||||
type: boolean
|
||||
passiveHealthCheck:
|
||||
description: PassiveHealthCheck defines passive health checks for ExternalName services.
|
||||
properties:
|
||||
failureWindow:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.
|
||||
x-kubernetes-int-or-string: true
|
||||
maxFailedAttempts:
|
||||
description: MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.
|
||||
type: integer
|
||||
type: object
|
||||
port:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Port defines the port of a Kubernetes Service.
|
||||
This can be a reference to a named port.
|
||||
x-kubernetes-int-or-string: true
|
||||
responseForwarding:
|
||||
description: ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.
|
||||
properties:
|
||||
flushInterval:
|
||||
description: |-
|
||||
FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
|
||||
A negative value means to flush immediately after each write to the client.
|
||||
This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
|
||||
for such responses, writes are flushed to the client immediately.
|
||||
Default: 100ms
|
||||
type: string
|
||||
type: object
|
||||
scheme:
|
||||
description: |-
|
||||
Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
|
||||
It defaults to https when Kubernetes Service port is 443, http otherwise.
|
||||
type: string
|
||||
serversTransport:
|
||||
description: |-
|
||||
ServersTransport defines the name of ServersTransport resource to use.
|
||||
It allows to configure the transport between Traefik and your servers.
|
||||
Can only be used on a Kubernetes Service.
|
||||
type: string
|
||||
sticky:
|
||||
description: |-
|
||||
Sticky defines the sticky sessions configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
|
||||
properties:
|
||||
cookie:
|
||||
description: Cookie defines the sticky cookie configuration.
|
||||
properties:
|
||||
domain:
|
||||
description: |-
|
||||
Domain defines the host to which the cookie will be sent.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value
|
||||
type: string
|
||||
httpOnly:
|
||||
description: HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.
|
||||
type: boolean
|
||||
maxAge:
|
||||
description: |-
|
||||
MaxAge defines the number of seconds until the cookie expires.
|
||||
When set to a negative number, the cookie expires immediately.
|
||||
When set to zero, the cookie never expires.
|
||||
type: integer
|
||||
name:
|
||||
description: Name defines the Cookie name.
|
||||
type: string
|
||||
path:
|
||||
description: |-
|
||||
Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
|
||||
When not provided the cookie will be sent on every request to the domain.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
|
||||
type: string
|
||||
sameSite:
|
||||
description: |-
|
||||
SameSite defines the same site policy.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
|
||||
enum:
|
||||
- none
|
||||
- lax
|
||||
- strict
|
||||
type: string
|
||||
secure:
|
||||
description: Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
strategy:
|
||||
description: |-
|
||||
Strategy defines the load balancing strategy between the servers.
|
||||
Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
|
||||
RoundRobin value is deprecated and supported for backward compatibility.
|
||||
enum:
|
||||
- wrr
|
||||
- p2c
|
||||
- hrw
|
||||
- leasttime
|
||||
- RoundRobin
|
||||
type: string
|
||||
weight:
|
||||
description: |-
|
||||
Weight defines the weight and should only be specified when Name references a TraefikService object
|
||||
(and to be precise, one that embeds a Weighted Round Robin).
|
||||
minimum: 0
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
weighted:
|
||||
description: Weighted defines the Weighted Round Robin configuration.
|
||||
properties:
|
||||
services:
|
||||
description: Services defines the list of Kubernetes Service and/or TraefikService to load-balance, with weight.
|
||||
items:
|
||||
description: Service defines an upstream HTTP service to proxy traffic to.
|
||||
properties:
|
||||
healthCheck:
|
||||
description: Healthcheck defines health checks for ExternalName services.
|
||||
properties:
|
||||
followRedirects:
|
||||
description: |-
|
||||
FollowRedirects defines whether redirects should be followed during the health check calls.
|
||||
Default: true
|
||||
type: boolean
|
||||
headers:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Headers defines custom headers to be sent to the health check endpoint.
|
||||
type: object
|
||||
hostname:
|
||||
description: Hostname defines the value of hostname in the Host header of the health check request.
|
||||
type: string
|
||||
interval:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Interval defines the frequency of the health check calls for healthy targets.
|
||||
Default: 30s
|
||||
x-kubernetes-int-or-string: true
|
||||
method:
|
||||
description: Method defines the healthcheck method.
|
||||
type: string
|
||||
mode:
|
||||
description: |-
|
||||
Mode defines the health check mode.
|
||||
If defined to grpc, will use the gRPC health check protocol to probe the server.
|
||||
Default: http
|
||||
type: string
|
||||
path:
|
||||
description: Path defines the server URL path for the health check endpoint.
|
||||
type: string
|
||||
port:
|
||||
description: Port defines the server URL port for the health check endpoint.
|
||||
type: integer
|
||||
scheme:
|
||||
description: Scheme replaces the server URL scheme for the health check endpoint.
|
||||
type: string
|
||||
status:
|
||||
description: Status defines the expected HTTP status code of the response to the health check request.
|
||||
type: integer
|
||||
timeout:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
|
||||
Default: 5s
|
||||
x-kubernetes-int-or-string: true
|
||||
unhealthyInterval:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
|
||||
When UnhealthyInterval is not defined, it defaults to the Interval value.
|
||||
Default: 30s
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
kind:
|
||||
description: Kind defines the kind of the Service.
|
||||
enum:
|
||||
- Service
|
||||
- TraefikService
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name defines the name of the referenced Kubernetes Service or TraefikService.
|
||||
The differentiation between the two is specified in the Kind field.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.
|
||||
type: string
|
||||
nativeLB:
|
||||
description: |-
|
||||
NativeLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
|
||||
The Kubernetes Service itself does load-balance to the pods.
|
||||
By default, NativeLB is false.
|
||||
type: boolean
|
||||
nodePortLB:
|
||||
description: |-
|
||||
NodePortLB controls, when creating the load-balancer,
|
||||
whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
|
||||
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
|
||||
By default, NodePortLB is false.
|
||||
type: boolean
|
||||
passHostHeader:
|
||||
description: |-
|
||||
PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
|
||||
By default, passHostHeader is true.
|
||||
type: boolean
|
||||
passiveHealthCheck:
|
||||
description: PassiveHealthCheck defines passive health checks for ExternalName services.
|
||||
properties:
|
||||
failureWindow:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.
|
||||
x-kubernetes-int-or-string: true
|
||||
maxFailedAttempts:
|
||||
description: MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.
|
||||
type: integer
|
||||
type: object
|
||||
port:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: |-
|
||||
Port defines the port of a Kubernetes Service.
|
||||
This can be a reference to a named port.
|
||||
x-kubernetes-int-or-string: true
|
||||
responseForwarding:
|
||||
description: ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.
|
||||
properties:
|
||||
flushInterval:
|
||||
description: |-
|
||||
FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
|
||||
A negative value means to flush immediately after each write to the client.
|
||||
This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
|
||||
for such responses, writes are flushed to the client immediately.
|
||||
Default: 100ms
|
||||
type: string
|
||||
type: object
|
||||
scheme:
|
||||
description: |-
|
||||
Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
|
||||
It defaults to https when Kubernetes Service port is 443, http otherwise.
|
||||
type: string
|
||||
serversTransport:
|
||||
description: |-
|
||||
ServersTransport defines the name of ServersTransport resource to use.
|
||||
It allows to configure the transport between Traefik and your servers.
|
||||
Can only be used on a Kubernetes Service.
|
||||
type: string
|
||||
sticky:
|
||||
description: |-
|
||||
Sticky defines the sticky sessions configuration.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
|
||||
properties:
|
||||
cookie:
|
||||
description: Cookie defines the sticky cookie configuration.
|
||||
properties:
|
||||
domain:
|
||||
description: |-
|
||||
Domain defines the host to which the cookie will be sent.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value
|
||||
type: string
|
||||
httpOnly:
|
||||
description: HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.
|
||||
type: boolean
|
||||
maxAge:
|
||||
description: |-
|
||||
MaxAge defines the number of seconds until the cookie expires.
|
||||
When set to a negative number, the cookie expires immediately.
|
||||
When set to zero, the cookie never expires.
|
||||
type: integer
|
||||
name:
|
||||
description: Name defines the Cookie name.
|
||||
type: string
|
||||
path:
|
||||
description: |-
|
||||
Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
|
||||
When not provided the cookie will be sent on every request to the domain.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
|
||||
type: string
|
||||
sameSite:
|
||||
description: |-
|
||||
SameSite defines the same site policy.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
|
||||
enum:
|
||||
- none
|
||||
- lax
|
||||
- strict
|
||||
type: string
|
||||
secure:
|
||||
description: Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
strategy:
|
||||
description: |-
|
||||
Strategy defines the load balancing strategy between the servers.
|
||||
Supported values are: wrr (Weighed round-robin), p2c (Power of two choices), hrw (Highest Random Weight), and leasttime (Least-Time).
|
||||
RoundRobin value is deprecated and supported for backward compatibility.
|
||||
enum:
|
||||
- wrr
|
||||
- p2c
|
||||
- hrw
|
||||
- leasttime
|
||||
- RoundRobin
|
||||
type: string
|
||||
weight:
|
||||
description: |-
|
||||
Weight defines the weight and should only be specified when Name references a TraefikService object
|
||||
(and to be precise, one that embeds a Weighted Round Robin).
|
||||
minimum: 0
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
sticky:
|
||||
description: |-
|
||||
Sticky defines whether sticky sessions are enabled.
|
||||
More info: https://doc.traefik.io/traefik/v3.6/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing
|
||||
properties:
|
||||
cookie:
|
||||
description: Cookie defines the sticky cookie configuration.
|
||||
properties:
|
||||
domain:
|
||||
description: |-
|
||||
Domain defines the host to which the cookie will be sent.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#domaindomain-value
|
||||
type: string
|
||||
httpOnly:
|
||||
description: HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.
|
||||
type: boolean
|
||||
maxAge:
|
||||
description: |-
|
||||
MaxAge defines the number of seconds until the cookie expires.
|
||||
When set to a negative number, the cookie expires immediately.
|
||||
When set to zero, the cookie never expires.
|
||||
type: integer
|
||||
name:
|
||||
description: Name defines the Cookie name.
|
||||
type: string
|
||||
path:
|
||||
description: |-
|
||||
Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
|
||||
When not provided the cookie will be sent on every request to the domain.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
|
||||
type: string
|
||||
sameSite:
|
||||
description: |-
|
||||
SameSite defines the same site policy.
|
||||
More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
|
||||
enum:
|
||||
- none
|
||||
- lax
|
||||
- strict
|
||||
type: string
|
||||
secure:
|
||||
description: Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).
|
||||
type: boolean
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
140
clusters/cl01tl/manifests/traefik/DaemonSet-traefik.yml
Normal file
140
clusters/cl01tl/manifests/traefik/DaemonSet-traefik.yml
Normal file
@@ -0,0 +1,140 @@
|
||||
---
|
||||
# Source: traefik/charts/traefik/templates/daemonset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
helm.sh/chart: traefik-37.4.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 0
|
||||
maxSurge: 1
|
||||
minReadySeconds: 0
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
helm.sh/chart: traefik-37.4.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
serviceAccountName: traefik
|
||||
automountServiceAccountToken: true
|
||||
terminationGracePeriodSeconds: 60
|
||||
hostNetwork: false
|
||||
containers:
|
||||
- image: docker.io/traefik:v3.6.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: traefik
|
||||
resources:
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
failureThreshold: 1
|
||||
initialDelaySeconds: 2
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 2
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 2
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 2
|
||||
lifecycle:
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 9100
|
||||
protocol: TCP
|
||||
- name: ssh
|
||||
containerPort: 22
|
||||
protocol: TCP
|
||||
- name: traefik
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
- name: web
|
||||
containerPort: 8000
|
||||
protocol: TCP
|
||||
- name: websecure
|
||||
containerPort: 8443
|
||||
protocol: TCP
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
args:
|
||||
- "--entryPoints.metrics.address=:9100/tcp"
|
||||
- "--entryPoints.ssh.address=:22/tcp"
|
||||
- "--entryPoints.traefik.address=:8080/tcp"
|
||||
- "--entryPoints.web.address=:8000/tcp"
|
||||
- "--entryPoints.websecure.address=:8443/tcp"
|
||||
- "--api.dashboard=true"
|
||||
- "--ping=true"
|
||||
- "--metrics.prometheus=true"
|
||||
- "--metrics.prometheus.entrypoint=metrics"
|
||||
- "--providers.kubernetescrd"
|
||||
- "--providers.kubernetescrd.allowCrossNamespace=true"
|
||||
- "--providers.kubernetescrd.allowEmptyServices=true"
|
||||
- "--providers.kubernetesgateway"
|
||||
- "--providers.kubernetesgateway.statusaddress.ip=10.232.1.21"
|
||||
- "--providers.kubernetesgateway.statusaddress.service.name=traefik"
|
||||
- "--providers.kubernetesgateway.statusaddress.service.namespace=traefik"
|
||||
- "--providers.kubernetesgateway.experimentalchannel=true"
|
||||
- "--entryPoints.ssh.http.tls=true"
|
||||
- "--entryPoints.ssh.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/16,192.168.0.0/16,fc00::/7"
|
||||
- "--entryPoints.ssh.proxyProtocol.trustedIPs=10.0.0.0/8,172.16.0.0/16,192.168.0.0/16,fc00::/7"
|
||||
- "--entryPoints.web.http.redirections.entryPoint.to=:443"
|
||||
- "--entryPoints.web.http.redirections.entryPoint.scheme=https"
|
||||
- "--entryPoints.web.http.redirections.entryPoint.permanent=true"
|
||||
- "--entryPoints.web.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/16,192.168.0.0/16,fc00::/7"
|
||||
- "--entryPoints.web.proxyProtocol.trustedIPs=10.0.0.0/8,172.16.0.0/16,192.168.0.0/16,fc00::/7"
|
||||
- "--entryPoints.websecure.http.tls=true"
|
||||
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/16,192.168.0.0/16,fc00::/7"
|
||||
- "--entryPoints.websecure.proxyProtocol.trustedIPs=10.0.0.0/8,172.16.0.0/16,192.168.0.0/16,fc00::/7"
|
||||
- "--log.level=INFO"
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: USER
|
||||
value: traefik
|
||||
volumes:
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
securityContext:
|
||||
runAsGroup: 65532
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
@@ -0,0 +1,44 @@
|
||||
---
|
||||
# Source: traefik/charts/traefik/templates/gateway.yaml
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
helm.sh/chart: traefik-37.4.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-issuer
|
||||
spec:
|
||||
gatewayClassName: traefik
|
||||
listeners:
|
||||
- name: ssh
|
||||
port: 22
|
||||
protocol: TCP
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: All
|
||||
- name: web
|
||||
port: 8000
|
||||
protocol: HTTP
|
||||
hostname: '*.alexlebens.net'
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: All
|
||||
- name: websecure
|
||||
port: 8443
|
||||
protocol: HTTPS
|
||||
hostname: '*.alexlebens.net'
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: All
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: websecure-gateway-cert
|
||||
namespace: traefik
|
||||
13
clusters/cl01tl/manifests/traefik/GatewayClass-traefik.yml
Normal file
13
clusters/cl01tl/manifests/traefik/GatewayClass-traefik.yml
Normal file
@@ -0,0 +1,13 @@
|
||||
---
|
||||
# Source: traefik/charts/traefik/templates/gatewayclass.yaml
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: GatewayClass
|
||||
metadata:
|
||||
name: traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
helm.sh/chart: traefik-37.4.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
controllerName: traefik.io/gateway-controller
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
# Source: traefik/charts/traefik/templates/ingressroute.yaml
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: traefik-dashboard
|
||||
namespace: traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
helm.sh/chart: traefik-37.4.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: (Host(`traefik-cl01tl.alexlebens.net`) && (PathPrefix(`/api/`) || PathPrefix(`/dashboard/`)))
|
||||
kind: Rule
|
||||
services:
|
||||
- kind: TraefikService
|
||||
name: api@internal
|
||||
13
clusters/cl01tl/manifests/traefik/Namespace-traefik.yml
Normal file
13
clusters/cl01tl/manifests/traefik/Namespace-traefik.yml
Normal file
@@ -0,0 +1,13 @@
|
||||
---
|
||||
# Source: traefik/templates/namespace.yaml
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik
|
||||
app.kubernetes.io/part-of: traefik
|
||||
pod-security.kubernetes.io/audit: privileged
|
||||
pod-security.kubernetes.io/enforce: privileged
|
||||
pod-security.kubernetes.io/warn: privileged
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
# Source: traefik/charts/traefik/templates/service-metrics.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik-metrics
|
||||
namespace: traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
app.kubernetes.io/component: metrics
|
||||
helm.sh/chart: traefik-37.4.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
ports:
|
||||
- port: 9100
|
||||
name: metrics
|
||||
targetPort: metrics
|
||||
protocol: TCP
|
||||
33
clusters/cl01tl/manifests/traefik/Service-traefik.yml
Normal file
33
clusters/cl01tl/manifests/traefik/Service-traefik.yml
Normal file
@@ -0,0 +1,33 @@
|
||||
---
|
||||
# Source: traefik/charts/traefik/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
helm.sh/chart: traefik-37.4.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
externalIPs:
|
||||
- 10.232.1.21
|
||||
ports:
|
||||
- port: 22
|
||||
name: ssh
|
||||
targetPort: ssh
|
||||
protocol: TCP
|
||||
- port: 80
|
||||
name: web
|
||||
targetPort: web
|
||||
protocol: TCP
|
||||
- port: 443
|
||||
name: websecure
|
||||
targetPort: websecure
|
||||
protocol: TCP
|
||||
14
clusters/cl01tl/manifests/traefik/ServiceAccount-traefik.yml
Normal file
14
clusters/cl01tl/manifests/traefik/ServiceAccount-traefik.yml
Normal file
@@ -0,0 +1,14 @@
|
||||
---
|
||||
# Source: traefik/charts/traefik/templates/rbac/serviceaccount.yaml
|
||||
kind: ServiceAccount
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
helm.sh/chart: traefik-37.4.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
automountServiceAccountToken: false
|
||||
26
clusters/cl01tl/manifests/traefik/ServiceMonitor-traefik.yml
Normal file
26
clusters/cl01tl/manifests/traefik/ServiceMonitor-traefik.yml
Normal file
@@ -0,0 +1,26 @@
|
||||
---
|
||||
# Source: traefik/charts/traefik/templates/servicemonitor.yaml
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
labels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
app.kubernetes.io/component: metrics
|
||||
helm.sh/chart: traefik-37.4.0
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
jobLabel: traefik
|
||||
endpoints:
|
||||
- targetPort: metrics
|
||||
path: /metrics
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- traefik
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: traefik
|
||||
app.kubernetes.io/instance: traefik-traefik
|
||||
app.kubernetes.io/component: metrics
|
||||
Reference in New Issue
Block a user