diff --git a/cloudprofilesync/ossync/os_image_updater.go b/cloudprofilesync/ossync/os_image_updater.go index 907db24..498f979 100644 --- a/cloudprofilesync/ossync/os_image_updater.go +++ b/cloudprofilesync/ossync/os_image_updater.go @@ -122,6 +122,35 @@ func (iu *ImageUpdater) resolveExpiration(src SourceImage, existing *metav1.Time return &now } +// mergeCapabilityFlavor appends the flavor from src to existing if not already present. +func mergeCapabilityFlavor(existing []gardenerv1beta1.MachineImageFlavor, caps gardenerv1beta1.Capabilities) []gardenerv1beta1.MachineImageFlavor { + if len(caps) == 0 { + return existing + } + for _, f := range existing { + if capabilitiesEqual(f.Capabilities, caps) { + return existing + } + } + return append(existing, gardenerv1beta1.MachineImageFlavor{Capabilities: caps}) +} + +func capabilitiesEqual(a, b gardenerv1beta1.Capabilities) bool { + if len(a) != len(b) { + return false + } + for k, aVals := range a { + bVals, ok := b[k] + if !ok { + return false + } + if !slices.Equal(aVals, bVals) { + return false + } + } + return true +} + func inPlaceUpdates(supported bool) *gardenerv1beta1.InPlaceUpdates { if !supported { return nil @@ -190,8 +219,10 @@ func (iu *ImageUpdater) Update(ctx context.Context, cpSpec *gardenerv1beta1.Clou } } - // When capabilities are enabled, also write the clean version entry. - if iu.EnableCapabilities && sourceImage.CleanVersion != "" && sourceImage.CleanVersion != sourceImage.Version { + // When capabilities are enabled, also write/update the clean version entry. + // When CleanVersion == Version the entry already exists from the legacy path above; + // the existing-entry branch merges the flavor onto it without re-writing other fields. + if iu.EnableCapabilities && sourceImage.CleanVersion != "" { if idx, exists := existingVersions[sourceImage.CleanVersion]; exists { existing := &image.Versions[idx] for _, arch := range sourceImage.Architectures { @@ -202,20 +233,21 @@ func (iu *ImageUpdater) Update(ctx context.Context, cpSpec *gardenerv1beta1.Clou existing.Classification = sourceImage.Classification //nolint:staticcheck // legacy fields; Lifecycle needs the VersionClassificationLifecycle feature gate existing.ExpirationDate = iu.resolveExpiration(sourceImage, existing.ExpirationDate) //nolint:staticcheck // legacy fields; Lifecycle needs the VersionClassificationLifecycle feature gate existing.InPlaceUpdates = inPlaceUpdates(sourceImage.SupportInPlaceUpdate) + existing.CapabilityFlavors = mergeCapabilityFlavor(existing.CapabilityFlavors, sourceImage.Capabilities) } else { - image.Versions = append(image.Versions, gardenerv1beta1.MachineImageVersion{ + v := gardenerv1beta1.MachineImageVersion{ ExpirableVersion: gardenerv1beta1.ExpirableVersion{ Version: sourceImage.CleanVersion, Classification: sourceImage.Classification, ExpirationDate: iu.resolveExpiration(sourceImage, nil), }, - Architectures: slices.Clone(sourceImage.Architectures), - }) + Architectures: slices.Clone(sourceImage.Architectures), + CapabilityFlavors: mergeCapabilityFlavor(nil, sourceImage.Capabilities), + } if sourceImage.SupportInPlaceUpdate { - image.Versions[len(image.Versions)-1].InPlaceUpdates = &gardenerv1beta1.InPlaceUpdates{ - Supported: sourceImage.SupportInPlaceUpdate, - } + v.InPlaceUpdates = &gardenerv1beta1.InPlaceUpdates{Supported: true} } + image.Versions = append(image.Versions, v) existingVersions[sourceImage.CleanVersion] = len(image.Versions) - 1 } } diff --git a/cloudprofilesync/ossync/os_image_updater_test.go b/cloudprofilesync/ossync/os_image_updater_test.go index f72d96f..3db6be3 100644 --- a/cloudprofilesync/ossync/os_image_updater_test.go +++ b/cloudprofilesync/ossync/os_image_updater_test.go @@ -248,6 +248,170 @@ var _ = Describe("ImageUpdater", func() { }) Describe("flag ON (dual-write clean version)", func() { + It("sets CapabilityFlavors when CleanVersion equals Version (semver tag with matching annotation)", func(ctx SpecContext) { + mockSource.images = []ossync.SourceImage{ + { + Version: "2254.0.0", + CleanVersion: "2254.0.0", + Architectures: []string{"amd64"}, + Capabilities: gardencorev1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_usi"}}, + }, + } + updater := ossync.ImageUpdater{ + Log: GinkgoLogr, + Source: &mockSource, + ImageName: "test", + EnableCapabilities: true, + } + var cpSpec gardencorev1beta1.CloudProfileSpec + Expect(updater.Update(ctx, &cpSpec)).To(Succeed()) + + Expect(cpSpec.MachineImages[0].Versions).To(HaveLen(1)) + v := cpSpec.MachineImages[0].Versions[0] + Expect(v.Version).To(Equal("2254.0.0")) + Expect(v.CapabilityFlavors).To(HaveLen(1)) + Expect(v.CapabilityFlavors[0].Capabilities).To(Equal( + gardencorev1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_usi"}}, + )) + }) + + It("sets CapabilityFlavors on the clean version entry", func(ctx SpecContext) { + mockSource.images = []ossync.SourceImage{ + { + Version: "2254.0.0-baremetal-sci-usi-amd64", + CleanVersion: "2254.0.0", + Architectures: []string{"amd64"}, + Capabilities: gardencorev1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_usi"}}, + }, + } + updater := ossync.ImageUpdater{ + Log: GinkgoLogr, + Source: &mockSource, + ImageName: "test", + EnableCapabilities: true, + } + var cpSpec gardencorev1beta1.CloudProfileSpec + Expect(updater.Update(ctx, &cpSpec)).To(Succeed()) + + versions := cpSpec.MachineImages[0].Versions + var cleanEntry *gardencorev1beta1.MachineImageVersion + for i := range versions { + if versions[i].Version == "2254.0.0" { + cleanEntry = &versions[i] + break + } + } + Expect(cleanEntry).NotTo(BeNil()) + Expect(cleanEntry.CapabilityFlavors).To(HaveLen(1)) + Expect(cleanEntry.CapabilityFlavors[0].Capabilities).To(Equal( + gardencorev1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_usi"}}, + )) + }) + + It("accumulates multiple flavors under the same clean version entry", func(ctx SpecContext) { + mockSource.images = []ossync.SourceImage{ + { + Version: "2254.0.0-baremetal-sci-usi-amd64", + CleanVersion: "2254.0.0", + Architectures: []string{"amd64"}, + Capabilities: gardencorev1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_usi"}}, + }, + { + Version: "2254.0.0-baremetal-sci-pxe-amd64", + CleanVersion: "2254.0.0", + Architectures: []string{"amd64"}, + Capabilities: gardencorev1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_pxe"}}, + }, + } + updater := ossync.ImageUpdater{ + Log: GinkgoLogr, + Source: &mockSource, + ImageName: "test", + EnableCapabilities: true, + } + var cpSpec gardencorev1beta1.CloudProfileSpec + Expect(updater.Update(ctx, &cpSpec)).To(Succeed()) + + versions := cpSpec.MachineImages[0].Versions + var cleanEntry *gardencorev1beta1.MachineImageVersion + for i := range versions { + if versions[i].Version == "2254.0.0" { + cleanEntry = &versions[i] + break + } + } + Expect(cleanEntry).NotTo(BeNil()) + Expect(cleanEntry.CapabilityFlavors).To(HaveLen(2)) + flavors := []gardencorev1beta1.Capabilities{ + cleanEntry.CapabilityFlavors[0].Capabilities, + cleanEntry.CapabilityFlavors[1].Capabilities, + } + Expect(flavors).To(ConsistOf( + gardencorev1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_usi"}}, + gardencorev1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_pxe"}}, + )) + }) + + It("does not append duplicate flavors on re-reconcile", func(ctx SpecContext) { + mockSource.images = []ossync.SourceImage{ + { + Version: "2254.0.0-baremetal-sci-usi-amd64", + CleanVersion: "2254.0.0", + Architectures: []string{"amd64"}, + Capabilities: gardencorev1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_usi"}}, + }, + } + updater := ossync.ImageUpdater{ + Log: GinkgoLogr, + Source: &mockSource, + ImageName: "test", + EnableCapabilities: true, + } + var cpSpec gardencorev1beta1.CloudProfileSpec + Expect(updater.Update(ctx, &cpSpec)).To(Succeed()) + Expect(updater.Update(ctx, &cpSpec)).To(Succeed()) + + versions := cpSpec.MachineImages[0].Versions + var cleanEntry *gardencorev1beta1.MachineImageVersion + for i := range versions { + if versions[i].Version == "2254.0.0" { + cleanEntry = &versions[i] + break + } + } + Expect(cleanEntry).NotTo(BeNil()) + Expect(cleanEntry.CapabilityFlavors).To(HaveLen(1)) + }) + + It("does not set CapabilityFlavors when Capabilities is nil", func(ctx SpecContext) { + mockSource.images = []ossync.SourceImage{ + { + Version: "2254.0.0-baremetal-amd64", + CleanVersion: "2254.0.0", + Architectures: []string{"amd64"}, + }, + } + updater := ossync.ImageUpdater{ + Log: GinkgoLogr, + Source: &mockSource, + ImageName: "test", + EnableCapabilities: true, + } + var cpSpec gardencorev1beta1.CloudProfileSpec + Expect(updater.Update(ctx, &cpSpec)).To(Succeed()) + + versions := cpSpec.MachineImages[0].Versions + var cleanEntry *gardencorev1beta1.MachineImageVersion + for i := range versions { + if versions[i].Version == "2254.0.0" { + cleanEntry = &versions[i] + break + } + } + Expect(cleanEntry).NotTo(BeNil()) + Expect(cleanEntry.CapabilityFlavors).To(BeEmpty()) + }) + It("writes both full tag and clean version entries when CleanVersion differs", func(ctx SpecContext) { mockSource.images = []ossync.SourceImage{ { diff --git a/controllers/garbage_collection.go b/controllers/garbage_collection.go index 4ccb0e5..c827bc3 100644 --- a/controllers/garbage_collection.go +++ b/controllers/garbage_collection.go @@ -126,10 +126,10 @@ func (r *Reconciler) deleteVersions(ctx context.Context, cloudProfileName, image return err } - // Track which clean versions still have remaining capability flavors after deletion, - // so we can cascade-delete empty clean version entries from spec.machineImages. - // A version present in this map was a clean version entry; true means it still has flavors. - cleanVersionsWithFlavors := make(map[string]bool) + // Track surviving capability flavors per clean version so the spec.machineImages + // entry can be kept in sync. Nil value means the version was not a clean version entry. + // Non-nil (possibly empty) slice means it was, and holds the remaining capabilities. + survivingFlavors := make(map[string][]gardenerv1beta1.Capabilities) if cp.Spec.ProviderConfig != nil { var cfg providercfg.CloudProfileConfig @@ -146,11 +146,7 @@ func (r *Reconciler) deleteVersions(ctx context.Context, cloudProfileName, image // Legacy flat entry — not a clean version, skip. continue } - // Mark as a clean version entry; value indicates whether any flavors remain. - cleanVersionsWithFlavors[v.Version] = len(v.CapabilityFlavors) > 0 - if len(v.CapabilityFlavors) == 0 { - continue - } + // Prune stale flavors. v.CapabilityFlavors = slices.DeleteFunc(v.CapabilityFlavors, func(f providercfg.MachineImageFlavor) bool { idx := strings.LastIndex(f.Image, ":") if idx == -1 { @@ -159,7 +155,12 @@ func (r *Reconciler) deleteVersions(ctx context.Context, cloudProfileName, image _, exists := versionsToDelete[f.Image[idx+1:]] return exists }) - cleanVersionsWithFlavors[v.Version] = len(v.CapabilityFlavors) > 0 + // Record surviving capabilities for this clean version. + caps := make([]gardenerv1beta1.Capabilities, 0, len(v.CapabilityFlavors)) + for _, f := range v.CapabilityFlavors { + caps = append(caps, f.Capabilities) + } + survivingFlavors[v.Version] = caps } // Remove version entries that have no legacy image ref and no remaining flavors. cfg.MachineImages[i].Versions = slices.DeleteFunc(cfg.MachineImages[i].Versions, func(mv providercfg.MachineImageVersion) bool { @@ -173,7 +174,7 @@ func (r *Reconciler) deleteVersions(ctx context.Context, cloudProfileName, image return exists } // Clean version entry — delete if all flavors were removed. - return !cleanVersionsWithFlavors[mv.Version] + return len(survivingFlavors[mv.Version]) == 0 }) } raw, err := json.Marshal(cfg) @@ -193,9 +194,23 @@ func (r *Reconciler) deleteVersions(ctx context.Context, cloudProfileName, image } // Cascade-delete clean version entry if all its capability flavors were removed. // Only entries tracked as clean versions (present in the map) are eligible. - hasRemainingFlavors, isCleanVersion := cleanVersionsWithFlavors[mv.Version] - return isCleanVersion && !hasRemainingFlavors + remaining, isCleanVersion := survivingFlavors[mv.Version] + return isCleanVersion && len(remaining) == 0 }) + // Rebuild CapabilityFlavors on surviving clean version entries to match + // what remains in providerConfig after pruning. + for j := range cp.Spec.MachineImages[i].Versions { + mv := &cp.Spec.MachineImages[i].Versions[j] + remaining, isCleanVersion := survivingFlavors[mv.Version] + if !isCleanVersion { + continue + } + flavors := make([]gardenerv1beta1.MachineImageFlavor, 0, len(remaining)) + for _, caps := range remaining { + flavors = append(flavors, gardenerv1beta1.MachineImageFlavor{Capabilities: caps}) + } + mv.CapabilityFlavors = flavors + } } if err := r.Update(ctx, &cp); err != nil { diff --git a/controllers/managedcloudprofile_controller_test.go b/controllers/managedcloudprofile_controller_test.go index ea88b00..57572c4 100644 --- a/controllers/managedcloudprofile_controller_test.go +++ b/controllers/managedcloudprofile_controller_test.go @@ -1045,11 +1045,129 @@ var _ = Describe("The ManagedCloudProfile reconciler", func() { Expect(k8sClient.Delete(ctx, shoot)).To(Succeed()) }) + It("removes the capability flavor from spec.machineImages when its backing tag is garbage collected", func(ctx SpecContext) { + oldFactory := reconciler.OCISourceFactory + defer func() { reconciler.OCISourceFactory = oldFactory }() + reconciler.OCISourceFactory = &emptyFactory{} + + oldTag := "2254.0.0-baremetal-sci-usi-amd64" + newTag := "2254.0.0-baremetal-sci-pxe-amd64" + cleanVersion := "2254.0.0" + oldCaps := gardenerv1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_usi"}} + newCaps := gardenerv1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_pxe"}} + + provCfg := providercfg.CloudProfileConfig{ + MachineImages: []providercfg.MachineImages{{ + Name: "gc-flavor-image", + Versions: []providercfg.MachineImageVersion{{ + Version: cleanVersion, + CapabilityFlavors: []providercfg.MachineImageFlavor{ + {Image: "repo/gc-flavor-image:" + oldTag, Capabilities: oldCaps}, + {Image: "repo/gc-flavor-image:" + newTag, Capabilities: newCaps}, + }, + }}, + }}, + } + raw, err := json.Marshal(provCfg) + Expect(err).To(Succeed()) + + mcpSpec := baseCloudProfileSpec(gardenerv1beta1.MachineImage{ + Name: "gc-flavor-image", + Versions: []gardenerv1beta1.MachineImageVersion{ + {ExpirableVersion: gardenerv1beta1.ExpirableVersion{Version: oldTag}, Architectures: []string{"amd64"}}, + {ExpirableVersion: gardenerv1beta1.ExpirableVersion{Version: newTag}, Architectures: []string{"amd64"}}, + {ExpirableVersion: gardenerv1beta1.ExpirableVersion{Version: cleanVersion}, Architectures: []string{"amd64"}}, + }, + }) + mcpSpec.ProviderConfig = &runtime.RawExtension{Raw: raw} + + mcp := &v1alpha1.ManagedCloudProfile{ + ObjectMeta: metav1.ObjectMeta{Name: "test-gc-flavor-removal"}, + Spec: v1alpha1.ManagedCloudProfileSpec{ + CloudProfile: mcpSpec, + MachineImageUpdates: []v1alpha1.MachineImageUpdate{{ + ImageName: "gc-flavor-image", + Source: v1alpha1.MachineImageUpdateSource{ + OCI: &v1alpha1.OCI{Registry: "keppel-fake", Repository: "account/gc-flavor-repo", Insecure: true}, + }, + Provider: v1alpha1.MachineImageUpdateProvider{ + IroncoreMetal: &v1alpha1.MachineImagesUpdateProviderIroncoreMetal{ + Registry: "keppel-fake", Repository: "account/gc-flavor-repo", + }, + }, + }}, + GarbageCollection: &v1alpha1.GarbageCollectionConfig{ + Enabled: true, + MaxAge: metav1.Duration{Duration: 24 * time.Hour}, + }, + }, + } + Expect(k8sClient.Create(ctx, mcp)).To(Succeed()) + + // Wait for the background manager to create the CloudProfile, then patch in capabilityFlavors. + // This avoids a race where the background manager overwrites the CP after we pre-create it. + cp := &gardenerv1beta1.CloudProfile{} + Eventually(func() error { + return k8sClient.Get(ctx, client.ObjectKey{Name: mcp.Name}, cp) + }).Should(Succeed()) + for i, mi := range cp.Spec.MachineImages { + if mi.Name != "gc-flavor-image" { + continue + } + for j, v := range mi.Versions { + if v.Version == cleanVersion { + cp.Spec.MachineImages[i].Versions[j].CapabilityFlavors = []gardenerv1beta1.MachineImageFlavor{ + {Capabilities: oldCaps}, {Capabilities: newCaps}, + } + } + } + } + Expect(k8sClient.Update(ctx, cp)).To(Succeed()) + + r := &controllers.Reconciler{ + Client: k8sClient, + OCISourceFactory: &emptyFactory{}, + RegistryProviderFunc: func(registry string) (controllers.RegistryClient, error) { + return &fakeRegistryClientWithTags{tags: map[string]time.Time{ + oldTag: time.Now().Add(-48 * time.Hour), + newTag: time.Now().Add(-1 * time.Minute), + }}, nil + }, + } + _, err = r.Reconcile(ctx, ctrl.Request{NamespacedName: client.ObjectKey{Name: mcp.Name}}) + Expect(err).ToNot(HaveOccurred()) + + Expect(k8sClient.Get(ctx, client.ObjectKey{Name: mcp.Name}, cp)).To(Succeed()) + + var specFlavors []gardenerv1beta1.MachineImageFlavor + for _, mi := range cp.Spec.MachineImages { + if mi.Name == "gc-flavor-image" { + for _, v := range mi.Versions { + if v.Version == cleanVersion { + specFlavors = v.CapabilityFlavors + } + } + } + } + Expect(specFlavors).To(HaveLen(1)) + Expect(specFlavors[0].Capabilities).To(Equal(newCaps)) + + Expect(k8sClient.Delete(ctx, mcp)).To(Succeed()) + Expect(k8sClient.Delete(ctx, cp)).To(Succeed()) + }) + It("deletes only old flavors from a clean version entry, keeping new ones", func(ctx SpecContext) { + oldFactory := reconciler.OCISourceFactory + defer func() { reconciler.OCISourceFactory = oldFactory }() + reconciler.OCISourceFactory = &emptyFactory{} + // Clean version "2254.0.0" has two flavors: one old (should be deleted), one recent (should stay). + // After GC the spec.machineImages entry must reflect only the surviving flavor's capabilities. oldTag := "2254.0.0-baremetal-sci-usi-amd64" newTag := "2254.0.0-baremetal-sci-usi-arm64" cleanVersion := "2254.0.0" + oldCaps := gardenerv1beta1.Capabilities{"architecture": {"amd64"}, "feature": {"sci", "_usi"}} + newCaps := gardenerv1beta1.Capabilities{"architecture": {"arm64"}, "feature": {"sci", "_usi"}} cfg := providercfg.CloudProfileConfig{ MachineImages: []providercfg.MachineImages{ @@ -1059,8 +1177,8 @@ var _ = Describe("The ManagedCloudProfile reconciler", func() { { Version: cleanVersion, CapabilityFlavors: []providercfg.MachineImageFlavor{ - {Image: "repo/multi-flavor-image:" + oldTag}, - {Image: "repo/multi-flavor-image:" + newTag}, + {Image: "repo/multi-flavor-image:" + oldTag, Capabilities: oldCaps}, + {Image: "repo/multi-flavor-image:" + newTag, Capabilities: newCaps}, }, }, }, @@ -1070,23 +1188,20 @@ var _ = Describe("The ManagedCloudProfile reconciler", func() { raw, err := json.Marshal(cfg) Expect(err).To(Succeed()) + mcpSpec := baseCloudProfileSpec(gardenerv1beta1.MachineImage{ + Name: "multi-flavor-image", + Versions: []gardenerv1beta1.MachineImageVersion{ + {ExpirableVersion: gardenerv1beta1.ExpirableVersion{Version: oldTag}, Architectures: []string{"amd64"}}, + {ExpirableVersion: gardenerv1beta1.ExpirableVersion{Version: newTag}, Architectures: []string{"arm64"}}, + {ExpirableVersion: gardenerv1beta1.ExpirableVersion{Version: cleanVersion}, Architectures: []string{"amd64", "arm64"}}, + }, + }) + mcpSpec.ProviderConfig = &runtime.RawExtension{Raw: raw} + mcp := &v1alpha1.ManagedCloudProfile{ ObjectMeta: metav1.ObjectMeta{Name: "test-gc-partial-flavor"}, Spec: v1alpha1.ManagedCloudProfileSpec{ - CloudProfile: func() v1alpha1.CloudProfileSpec { - cp := baseCloudProfileSpec( - gardenerv1beta1.MachineImage{ - Name: "multi-flavor-image", - Versions: []gardenerv1beta1.MachineImageVersion{ - {ExpirableVersion: gardenerv1beta1.ExpirableVersion{Version: oldTag}, Architectures: []string{"amd64"}}, - {ExpirableVersion: gardenerv1beta1.ExpirableVersion{Version: newTag}, Architectures: []string{"arm64"}}, - {ExpirableVersion: gardenerv1beta1.ExpirableVersion{Version: cleanVersion}, Architectures: []string{"amd64", "arm64"}}, - }, - }, - ) - cp.ProviderConfig = &runtime.RawExtension{Raw: raw} - return cp - }(), + CloudProfile: mcpSpec, MachineImageUpdates: []v1alpha1.MachineImageUpdate{ { ImageName: "multi-flavor-image", @@ -1113,6 +1228,26 @@ var _ = Describe("The ManagedCloudProfile reconciler", func() { } Expect(k8sClient.Create(ctx, mcp)).To(Succeed()) + // Wait for the background manager to create the CloudProfile, then patch in capabilityFlavors. + // This avoids a race where the background manager overwrites the CP after we pre-create it. + cp := &gardenerv1beta1.CloudProfile{} + Eventually(func() error { + return k8sClient.Get(ctx, client.ObjectKey{Name: mcp.Name}, cp) + }).Should(Succeed()) + for i, mi := range cp.Spec.MachineImages { + if mi.Name != "multi-flavor-image" { + continue + } + for j, v := range mi.Versions { + if v.Version == cleanVersion { + cp.Spec.MachineImages[i].Versions[j].CapabilityFlavors = []gardenerv1beta1.MachineImageFlavor{ + {Capabilities: oldCaps}, {Capabilities: newCaps}, + } + } + } + } + Expect(k8sClient.Update(ctx, cp)).To(Succeed()) + r := &controllers.Reconciler{ Client: k8sClient, OCISourceFactory: &emptyFactory{}, @@ -1127,13 +1262,12 @@ var _ = Describe("The ManagedCloudProfile reconciler", func() { _, err = r.Reconcile(ctx, req) Expect(err).ToNot(HaveOccurred()) - cp := &gardenerv1beta1.CloudProfile{} Expect(k8sClient.Get(ctx, client.ObjectKey{Name: mcp.Name}, cp)).To(Succeed()) Expect(cp.Spec.ProviderConfig).ToNot(BeNil()) var updatedCfg providercfg.CloudProfileConfig Expect(json.Unmarshal(cp.Spec.ProviderConfig.Raw, &updatedCfg)).To(Succeed()) - // Old flavor must be gone; new flavor must remain. + // Old flavor must be gone from providerConfig; new flavor must remain. var flavors []string for _, img := range updatedCfg.MachineImages { if img.Name == "multi-flavor-image" { @@ -1152,7 +1286,22 @@ var _ = Describe("The ManagedCloudProfile reconciler", func() { // Clean version entry must still be present in spec.machineImages (has remaining flavor). Expect(versionsByMachineImage(cp, "multi-flavor-image")).To(ContainElement(cleanVersion)) + // spec.machineImages clean version entry must have only the surviving flavor's capabilities. + var specFlavors []gardenerv1beta1.MachineImageFlavor + for _, mi := range cp.Spec.MachineImages { + if mi.Name == "multi-flavor-image" { + for _, v := range mi.Versions { + if v.Version == cleanVersion { + specFlavors = v.CapabilityFlavors + } + } + } + } + Expect(specFlavors).To(HaveLen(1)) + Expect(specFlavors[0].Capabilities).To(Equal(newCaps)) + Expect(k8sClient.Delete(ctx, mcp)).To(Succeed()) + Expect(k8sClient.Delete(ctx, cp)).To(Succeed()) }) It("cascade-deletes clean version entry when all its flavors are garbage collected", func(ctx SpecContext) { diff --git a/crd/README.md b/crd/README.md new file mode 100644 index 0000000..2bf50f6 --- /dev/null +++ b/crd/README.md @@ -0,0 +1,24 @@ +`core.gardener.cloud_cloudprofiles.yaml` and `core.gardener.cloud_shoots.yaml` files are required for the tests setup (these CRDs should be installed) + +Since these resources are not actual CRDs from the k8s api perspective and their spec cant be fetched via `kubectl` + +Gardener currently does not provide these CRDs in `yaml` so we need to generate it ourselves as a temporary solution + +1. Clone gardener repo +2. Add `kubebuilder` markers to `gardener/pkg/apis/core/v1beta1/types_cloudprofile.go` +```go +// CloudProfile represents certain properties about a provider environment. +// +kubebuilder:object:root=true +// +kubebuilder:resource:scope=Cluster +type CloudProfile struct { +``` +3. Generate +```shell +go run sigs.k8s.io/controller-tools/cmd/controller-gen@latest \ + crd:allowDangerousTypes=true \ + paths=./pkg/apis/core/v1beta1/... \ + output:crd:artifacts:config=crd-out +``` +and copy + +Probably this thingy should be revisited at some point to reduce overhead. Maybe using different testing approach diff --git a/crd/core.gardener.cloud_cloudprofiles.yaml b/crd/core.gardener.cloud_cloudprofiles.yaml index c68e8c6..4edfaf9 100644 --- a/crd/core.gardener.cloud_cloudprofiles.yaml +++ b/crd/core.gardener.cloud_cloudprofiles.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.18.0 + controller-gen.kubebuilder.io/version: v0.21.0 name: cloudprofiles.core.gardener.cloud spec: group: core.gardener.cloud @@ -14,493 +14,638 @@ spec: singular: cloudprofile scope: Cluster versions: - - name: v1beta1 - schema: - openAPIV3Schema: - description: CloudProfile represents certain properties about a provider environment. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the provider environment properties. - properties: - bastion: - description: Bastion contains the machine and image properties - properties: - machineImage: - description: MachineImage contains the bastions machine image - properties - properties: - name: - description: Name of the machine image - type: string - version: - description: Version of the machine image - type: string - required: - - name - type: object - machineType: - description: MachineType contains the bastions machine type properties - properties: - name: - description: Name of the machine type - type: string - required: - - name - type: object - type: object - caBundle: - description: CABundle is a certificate bundle which will be installed - onto every host machine of shoot cluster targeting this profile. - type: string - capabilities: - description: |- - Capabilities contains the definition of all possible capabilities in the CloudProfile. - Only capabilities and values defined here can be used to describe MachineImages and MachineTypes. - The order of values for a given capability is relevant. The most important value is listed first. - During maintenance upgrades, the image that matches most capabilities will be selected. - items: - description: CapabilityDefinition contains the Name and Values of - a capability. + - name: v1beta1 + schema: + openAPIV3Schema: + description: CloudProfile represents certain properties about a provider environment. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the provider environment properties. + properties: + bastion: + description: Bastion contains the machine and image properties properties: - name: - type: string - values: - description: |- - CapabilityValues contains capability values. - This is a workaround as the Protobuf generator can't handle a map with slice values. - items: - type: string - type: array - required: - - name - - values - type: object - type: array - kubernetes: - description: Kubernetes contains constraints regarding allowed values - of the 'kubernetes' block in the Shoot specification. - properties: - versions: - description: Versions is the list of allowed Kubernetes versions - with optional expiration dates for Shoot clusters. - items: - description: ExpirableVersion contains a version and an expiration - date. + machineImage: + description: MachineImage contains the bastions machine image + properties properties: - classification: - description: Classification defines the state of a version - (preview, supported, deprecated) - type: string - expirationDate: - description: ExpirationDate defines the time at which this - version expires. - format: date-time + name: + description: Name of the machine image type: string version: - description: Version is the version identifier. + description: Version of the machine image type: string required: - - version + - name + type: object + machineType: + description: MachineType contains the bastions machine type properties + properties: + name: + description: Name of the machine type + type: string + required: + - name type: object - type: array - type: object - limits: - description: |- - Limits configures operational limits for Shoot clusters using this CloudProfile. - See https://github.com/gardener/gardener/blob/master/docs/usage/shoot/shoot_limits.md. - properties: - maxNodesTotal: - description: MaxNodesTotal configures the maximum node count a - Shoot cluster can have during runtime. - format: int32 - type: integer - type: object - machineImages: - description: MachineImages contains constraints regarding allowed - values for machine images in the Shoot specification. - items: - description: MachineImage defines the name and multiple versions - of the machine image in any environment. + type: object + caBundle: + description: CABundle is a certificate bundle which will be installed + onto every host machine of shoot cluster targeting this profile. + type: string + controlPlane: + description: |- + ControlPlane holds settings that control what control-plane-related features shoots + using this CloudProfile may configure. properties: - name: - description: Name is the name of the image. - type: string - updateStrategy: + allowZonePinning: description: |- - UpdateStrategy is the update strategy to use for the machine image. Possible values are: - - patch: update to the latest patch version of the current minor version. - - minor: update to the latest minor and patch version. - - major: always update to the overall latest version (default). - type: string + AllowZonePinning enables shoots to set spec.controlPlane.zones to explicitly pin + their control plane to specific seed zones. Only set to true for providers where + zone names are globally consistent across all users of the provider. + type: boolean + type: object + kubernetes: + description: Kubernetes contains constraints regarding allowed values + of the 'kubernetes' block in the Shoot specification. + properties: versions: - description: Versions contains versions, expiration dates and - container runtimes of the machine image + description: Versions is the list of allowed Kubernetes versions + with optional expiration dates for Shoot clusters. items: - description: MachineImageVersion is an expirable version with - list of supported container runtimes and interfaces + description: ExpirableVersion contains a version with associated + lifecycle information. properties: - architectures: - description: Architectures is the list of CPU architectures - of the machine image in this version. - items: - type: string - type: array - capabilitySets: - description: |- - CapabilitySets is an array of capability sets. Each entry represents a combination of capabilities that is provided by - the machine image version. - items: - description: |- - CapabilitySet is a wrapper for Capabilities. - This is a workaround as the Protobuf generator can't handle a slice of maps. - type: object - type: array classification: - description: Classification defines the state of a version - (preview, supported, deprecated) + description: |- + Classification defines the state of a version (preview, supported, deprecated). + + Deprecated: Is replaced by Lifecycle. mutually exclusive with it. + type: string + expirationDate: + description: |- + ExpirationDate defines the time at which this version expires. + + Deprecated: Is replaced by Lifecycle; mutually exclusive with it. + format: date-time type: string - cri: - description: CRI list of supported container runtime and - interfaces supported by this version + lifecycle: + description: |- + Lifecycle defines the lifecycle stages for this version. + Mutually exclusive with Classification and ExpirationDate. + This can only be used when the VersionClassificationLifecycle feature gate is enabled. items: - description: CRI contains information about the Container - Runtimes. + description: |- + LifecycleStage describes a stage in the versions lifecycle. + Each stage defines the classification of the version (e.g. unavailable, preview, supported, deprecated, expired) + and the time at which this classification becomes effective. properties: - containerRuntimes: - description: ContainerRuntimes is the list of the - required container runtimes supported for a worker - pool. - items: - description: ContainerRuntime contains information - about worker's available container runtime - properties: - providerConfig: - description: ProviderConfig is the configuration - passed to container runtime resource. - type: object - x-kubernetes-preserve-unknown-fields: true - type: - description: Type is the type of the Container - Runtime. - type: string - required: - - type - type: object - type: array - name: - description: The name of the CRI library. Supported - values are `containerd`. + classification: + description: Classification is the category of this + lifecycle stage (unavailable, preview, supported, + deprecated, expired). + type: string + startTime: + description: |- + StartTime defines when this lifecycle stage becomes active. + StartTime can be omitted for the first lifecycle stage, implying a start time in the past. + format: date-time type: string required: - - name + - classification type: object type: array - expirationDate: - description: ExpirationDate defines the time at which - this version expires. - format: date-time - type: string - inPlaceUpdates: - description: InPlaceUpdates contains the configuration - for in-place updates for this machine image version. - properties: - minVersionForUpdate: - description: MinVersionForInPlaceUpdate specifies - the minimum supported version from which an in-place - update to this machine image version can be performed. - type: string - supported: - description: Supported indicates whether in-place - updates are supported for this machine image version. - type: boolean - required: - - supported - type: object - kubeletVersionConstraint: - description: |- - KubeletVersionConstraint is a constraint describing the supported kubelet versions by the machine image in this version. - If the field is not specified, it is assumed that the machine image in this version supports all kubelet versions. - Examples: - - '>= 1.26' - supports only kubelet versions greater than or equal to 1.26 - - '< 1.26' - supports only kubelet versions less than 1.26 - type: string version: description: Version is the version identifier. type: string required: - - version + - version type: object type: array - required: - - name - - versions type: object - type: array - machineTypes: - description: MachineTypes contains constraints regarding allowed values - for machine types in the 'workers' block in the Shoot specification. - items: - description: MachineType contains certain properties of a machine - type. + limits: + description: |- + Limits configures operational limits for Shoot clusters using this CloudProfile. + See https://github.com/gardener/gardener/blob/master/docs/usage/shoot/shoot_limits.md. properties: - architecture: - description: Architecture is the CPU architecture of this machine - type. - type: string - capabilities: - additionalProperties: + maxNodesTotal: + description: MaxNodesTotal configures the maximum node count a + Shoot cluster can have during runtime. + format: int32 + type: integer + type: object + machineCapabilities: + description: |- + MachineCapabilities contains the definition of all possible capabilities in the CloudProfile. + Only capabilities and values defined here can be used to describe MachineImages and MachineTypes. + The order of values for a given capability is relevant. The most important value is listed first. + During maintenance upgrades, the image that matches most capabilities will be selected. + items: + description: CapabilityDefinition contains the Name and Values of + a capability. + properties: + name: + type: string + values: description: |- CapabilityValues contains capability values. This is a workaround as the Protobuf generator can't handle a map with slice values. items: type: string type: array - description: Capabilities contains the machine type capabilities. - type: object - cpu: - anyOf: - - type: integer - - type: string - description: CPU is the number of CPUs for this machine type. - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - gpu: - anyOf: - - type: integer - - type: string - description: GPU is the number of GPUs for this machine type. - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - memory: - anyOf: - - type: integer - - type: string - description: Memory is the amount of memory for this machine - type. - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - name: - description: Name is the name of the machine type. - type: string - storage: - description: Storage is the amount of storage associated with - the root volume of this machine type. - properties: - class: - description: Class is the class of the storage type. - type: string - minSize: - anyOf: + required: + - name + - values + type: object + type: array + machineImages: + description: MachineImages contains constraints regarding allowed + values for machine images in the Shoot specification. + items: + description: MachineImage defines the name and multiple versions + of the machine image in any environment. + properties: + name: + description: Name is the name of the image. + type: string + updateStrategy: + description: |- + UpdateStrategy is the update strategy to use for the machine image. Possible values are: + - patch: update to the latest patch version of the current minor version. + - minor: update to the latest minor and patch version. + - major: always update to the overall latest version (default). + type: string + versions: + description: Versions contains versions, expiration dates and + container runtimes of the machine image + items: + description: MachineImageVersion is an expirable version with + list of supported container runtimes and interfaces + properties: + architectures: + description: Architectures is the list of CPU architectures + of the machine image in this version. + items: + type: string + type: array + capabilityFlavors: + description: |- + CapabilityFlavors is an array of MachineImageFlavor. Each entry represents a combination of capabilities that is provided by + the machine image version. + items: + description: |- + MachineImageFlavor is a wrapper for Capabilities. + This is a workaround as the Protobuf generator can't handle a slice of maps. + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + classification: + description: |- + Classification defines the state of a version (preview, supported, deprecated). + + Deprecated: Is replaced by Lifecycle. mutually exclusive with it. + type: string + cri: + description: CRI list of supported container runtime and + interfaces supported by this version + items: + description: CRI contains information about the Container + Runtimes. + properties: + containerRuntimes: + description: ContainerRuntimes is the list of the + required container runtimes supported for a worker + pool. + items: + description: ContainerRuntime contains information + about worker's available container runtime + properties: + providerConfig: + description: ProviderConfig is the configuration + passed to container runtime resource. + type: object + x-kubernetes-preserve-unknown-fields: true + type: + description: Type is the type of the Container + Runtime. + type: string + required: + - type + type: object + type: array + name: + description: The name of the CRI library. Supported + values are `containerd`. + type: string + required: + - name + type: object + type: array + expirationDate: + description: |- + ExpirationDate defines the time at which this version expires. + + Deprecated: Is replaced by Lifecycle; mutually exclusive with it. + format: date-time + type: string + inPlaceUpdates: + description: InPlaceUpdates contains the configuration + for in-place updates for this machine image version. + properties: + minVersionForUpdate: + description: MinVersionForInPlaceUpdate specifies + the minimum supported version from which an in-place + update to this machine image version can be performed. + type: string + supported: + description: Supported indicates whether in-place + updates are supported for this machine image version. + type: boolean + required: + - supported + type: object + kubeletVersionConstraint: + description: |- + KubeletVersionConstraint is a constraint describing the supported kubelet versions by the machine image in this version. + If the field is not specified, it is assumed that the machine image in this version supports all kubelet versions. + Examples: + - '>= 1.26' - supports only kubelet versions greater than or equal to 1.26 + - '< 1.26' - supports only kubelet versions less than 1.26 + type: string + lifecycle: + description: |- + Lifecycle defines the lifecycle stages for this version. + Mutually exclusive with Classification and ExpirationDate. + This can only be used when the VersionClassificationLifecycle feature gate is enabled. + items: + description: |- + LifecycleStage describes a stage in the versions lifecycle. + Each stage defines the classification of the version (e.g. unavailable, preview, supported, deprecated, expired) + and the time at which this classification becomes effective. + properties: + classification: + description: Classification is the category of this + lifecycle stage (unavailable, preview, supported, + deprecated, expired). + type: string + startTime: + description: |- + StartTime defines when this lifecycle stage becomes active. + StartTime can be omitted for the first lifecycle stage, implying a start time in the past. + format: date-time + type: string + required: + - classification + type: object + type: array + version: + description: Version is the version identifier. + type: string + required: + - version + type: object + type: array + required: + - name + - versions + type: object + type: array + machineTypes: + description: MachineTypes contains constraints regarding allowed values + for machine types in the 'workers' block in the Shoot specification. + items: + description: MachineType contains certain properties of a machine + type. + properties: + architecture: + description: Architecture is the CPU architecture of this machine + type. + type: string + capabilities: + additionalProperties: + description: |- + CapabilityValues contains capability values. + This is a workaround as the Protobuf generator can't handle a map with slice values. + items: + type: string + type: array + description: Capabilities contains the machine type capabilities. + type: object + cpu: + anyOf: - type: integer - type: string - description: |- - MinSize is the minimal supported storage size. - This overrides any other common minimum size configuration from `spec.volumeTypes[*].minSize`. - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - size: - anyOf: + description: CPU is the number of CPUs for this machine type. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + gpu: + anyOf: - type: integer - type: string - description: StorageSize is the storage size. - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: - description: Type is the type of the storage. - type: string - required: - - class - - type - type: object - usable: - description: Usable defines if the machine type can be used - for shoot clusters. - type: boolean - required: - - cpu - - gpu - - memory - - name + description: GPU is the number of GPUs for this machine type. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + machineControllerManager: + description: MachineControllerManagerSettings contains a subset + of the MachineControllerManagerSettings which can be defaulted + for a machine type in a CloudProfile. + properties: + machineCreationTimeout: + description: MachineCreationTimeout is the period after + which creation of a machine of this machine type is declared + failed. + type: string + type: object + memory: + anyOf: + - type: integer + - type: string + description: Memory is the amount of memory for this machine + type. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + name: + description: Name is the name of the machine type. + type: string + storage: + description: Storage is the amount of storage associated with + the root volume of this machine type. + properties: + class: + description: Class is the class of the storage type. + type: string + minSize: + anyOf: + - type: integer + - type: string + description: |- + MinSize is the minimal supported storage size. + This overrides any other common minimum size configuration from `spec.volumeTypes[*].minSize`. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + size: + anyOf: + - type: integer + - type: string + description: StorageSize is the storage size. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: + description: Type is the type of the storage. + type: string + required: + - class + - type + type: object + usable: + description: Usable defines if the machine type can be used + for shoot clusters. + type: boolean + required: + - cpu + - gpu + - memory + - name + type: object + type: array + providerConfig: + description: ProviderConfig contains provider-specific configuration + for the profile. type: object - type: array - providerConfig: - description: ProviderConfig contains provider-specific configuration - for the profile. - type: object - x-kubernetes-preserve-unknown-fields: true - regions: - description: Regions contains constraints regarding allowed values - for regions and zones. - items: - description: Region contains certain properties of a region. + x-kubernetes-preserve-unknown-fields: true + regions: + description: Regions contains constraints regarding allowed values + for regions and zones. + items: + description: Region contains certain properties of a region. + properties: + accessRestrictions: + description: AccessRestrictions describe a list of access restrictions + that can be used for Shoots using this region. + items: + description: AccessRestriction describes an access restriction + for a Kubernetes cluster (e.g., EU access-only). + properties: + name: + description: Name is the name of the restriction. + type: string + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + description: |- + Labels is an optional set of key-value pairs that contain certain administrator-controlled labels for this region. + It can be used by Gardener administrators/operators to provide additional information about a region, e.g. wrt + quality, reliability, etc. + type: object + name: + description: Name is a region name. + type: string + zones: + description: Zones is a list of availability zones in this region. + items: + description: AvailabilityZone is an availability zone. + properties: + name: + description: Name is an availability zone name. + type: string + unavailableMachineTypes: + description: UnavailableMachineTypes is a list of machine + type names that are not availability in this zone. + items: + type: string + type: array + unavailableVolumeTypes: + description: UnavailableVolumeTypes is a list of volume + type names that are not availability in this zone. + items: + type: string + type: array + required: + - name + type: object + type: array + required: + - name + type: object + type: array + seedSelector: + description: |- + SeedSelector contains an optional list of labels on `Seed` resources that marks those seeds whose shoots may use this provider profile. + An empty list means that all seeds of the same provider type are supported. + This is useful for environments that are of the same type (like openstack) but may have different "instances"/landscapes. + Optionally a list of possible providers can be added to enable cross-provider scheduling. By default, the provider + type of the seed must match the shoot's provider. properties: - accessRestrictions: - description: AccessRestrictions describe a list of access restrictions - that can be used for Shoots using this region. + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. items: - description: AccessRestriction describes an access restriction - for a Kubernetes cluster (e.g., EU access-only). + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: - name: - description: Name is the name of the restriction. + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic required: - - name + - key + - operator type: object type: array - labels: + x-kubernetes-list-type: atomic + matchLabels: additionalProperties: type: string description: |- - Labels is an optional set of key-value pairs that contain certain administrator-controlled labels for this region. - It can be used by Gardener administrators/operators to provide additional information about a region, e.g. wrt - quality, reliability, etc. + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - name: - description: Name is a region name. - type: string - zones: - description: Zones is a list of availability zones in this region. + providerTypes: + description: Providers is optional and can be used by restricting + seeds by their provider type. '*' can be used to enable seeds + regardless of their provider type. items: - description: AvailabilityZone is an availability zone. + type: string + type: array + type: object + x-kubernetes-map-type: atomic + type: + description: Type is the name of the provider. + type: string + volumeTypes: + description: VolumeTypes contains constraints regarding allowed values + for volume types in the 'workers' block in the Shoot specification. + items: + description: VolumeType contains certain properties of a volume + type. + properties: + class: + description: Class is the class of the volume type. + type: string + minSize: + anyOf: + - type: integer + - type: string + description: MinSize is the minimal supported storage size. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + name: + description: Name is the name of the volume type. + type: string + usable: + description: Usable defines if the volume type can be used for + shoot clusters. + type: boolean + required: + - class + - name + type: object + type: array + required: + - kubernetes + - machineImages + - machineTypes + - regions + - type + type: object + status: + description: Status contains the current status of the cloud profile. + properties: + kubernetes: + description: Kubernetes contains the status information for kubernetes. + properties: + versions: + description: Versions contains the statuses of the kubernetes + versions. + items: + description: ExpirableVersionStatus defines the current status + of an expirable version. properties: - name: - description: Name is an availability zone name. + classification: + description: Classification reflects the current state in + the classification lifecycle. + type: string + version: + description: Version is the version identifier. type: string - unavailableMachineTypes: - description: UnavailableMachineTypes is a list of machine - type names that are not availability in this zone. - items: - type: string - type: array - unavailableVolumeTypes: - description: UnavailableVolumeTypes is a list of volume - type names that are not availability in this zone. - items: - type: string - type: array required: - - name + - classification + - version type: object type: array - required: - - name type: object - type: array - seedSelector: - description: |- - SeedSelector contains an optional list of labels on `Seed` resources that marks those seeds whose shoots may use this provider profile. - An empty list means that all seeds of the same provider type are supported. - This is useful for environments that are of the same type (like openstack) but may have different "instances"/landscapes. - Optionally a list of possible providers can be added to enable cross-provider scheduling. By default, the provider - type of the seed must match the shoot's provider. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDead. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDead. + machineImages: + description: MachineImages contains the statuses of the machine image + versions. + items: + description: MachineImageStatus contains the status of a machine + image and its version classifications. + properties: + name: + description: Name matches the name of the MachineImage the status + is represented of. + type: string + versions: + description: Versions contains the statuses of the machine image + versions. + items: + description: ExpirableVersionStatus defines the current status + of an expirable version. + properties: + classification: + description: Classification reflects the current state + in the classification lifecycle. + type: string + version: + description: Version is the version identifier. + type: string + required: + - classification + - version + type: object + type: array + required: + - name type: object - providerTypes: - description: Providers is optional and can be used by restricting - seeds by their provider type. '*' can be used to enable seeds - regardless of their provider type. - items: - type: string - type: array - type: object - x-kubernetes-map-type: atomic - type: - description: Type is the name of the provider. - type: string - volumeTypes: - description: VolumeTypes contains constraints regarding allowed values - for volume types in the 'workers' block in the Shoot specification. - items: - description: VolumeType contains certain properties of a volume - type. - properties: - class: - description: Class is the class of the volume type. - type: string - minSize: - anyOf: - - type: integer - - type: string - description: MinSize is the minimal supported storage size. - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - name: - description: Name is the name of the volume type. - type: string - usable: - description: Usable defines if the volume type can be used for - shoot clusters. - type: boolean - required: - - class - - name - type: object - type: array - required: - - kubernetes - - machineImages - - machineTypes - - regions - - type - type: object - type: object - served: true - storage: true + type: array + type: object + type: object + served: true + storage: true diff --git a/crd/core.gardener.cloud_shoots.yaml b/crd/core.gardener.cloud_shoots.yaml index da58e2b..8629016 100644 --- a/crd/core.gardener.cloud_shoots.yaml +++ b/crd/core.gardener.cloud_shoots.yaml @@ -1,75 +1,3268 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.21.0 name: shoots.core.gardener.cloud spec: group: core.gardener.cloud + names: + kind: Shoot + listKind: ShootList + plural: shoots + singular: shoot + scope: Namespaced versions: - - name: v1beta1 - served: true - storage: true - schema: - openAPIV3Schema: - description: Shoot is the schema for the shoots API. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of the Shoot. - type: object - properties: - cloudProfile: - description: Reference to the CloudProfile used by the Shoot. - type: object - properties: - name: - description: Name of the CloudProfile. - type: string - provider: - description: Provider-specific configuration. - type: object - properties: - workers: - description: Worker pools for the Shoot. - type: array - items: - type: object - properties: - machine: - description: Machine configuration for a worker pool. - type: object - properties: - image: - description: Image configuration for worker nodes. + - name: v1beta1 + schema: + openAPIV3Schema: + description: Shoot represents a Shoot cluster created and managed by Gardener. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Specification of the Shoot cluster. + If the object's deletion timestamp is set, this field is immutable. + properties: + accessRestrictions: + description: AccessRestrictions describe a list of access restrictions + for this shoot cluster. + items: + description: |- + AccessRestrictionWithOptions describes an access restriction for a Kubernetes cluster (e.g., EU access-only) and + allows to specify additional options. + properties: + name: + description: Name is the name of the restriction. + type: string + options: + additionalProperties: + type: string + description: Options is a map of additional options for the + access restriction. + type: object + required: + - name + type: object + type: array + addons: + description: |- + Addons contains information about enabled/disabled addons and their configuration. + + Deprecated: This field is deprecated. Enabling addons will be forbidden starting from Kubernetes 1.35. + properties: + kubernetesDashboard: + description: KubernetesDashboard holds configuration settings + for the kubernetes dashboard addon. + properties: + authenticationMode: + description: AuthenticationMode defines the authentication + mode for the kubernetes-dashboard. + type: string + enabled: + description: Enabled indicates whether the addon is enabled + or not. + type: boolean + required: + - enabled + type: object + nginxIngress: + description: NginxIngress holds configuration settings for the + nginx-ingress addon. + properties: + config: + additionalProperties: + type: string + description: |- + Config contains custom configuration for the nginx-ingress-controller configuration. + See https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/configmap.md#configuration-options + type: object + enabled: + description: Enabled indicates whether the addon is enabled + or not. + type: boolean + externalTrafficPolicy: + description: |- + ExternalTrafficPolicy controls the `.spec.externalTrafficPolicy` value of the load balancer `Service` + exposing the nginx-ingress. Defaults to `Cluster`. + type: string + loadBalancerSourceRanges: + description: LoadBalancerSourceRanges is list of allowed IP + sources for NginxIngress + items: + type: string + type: array + required: + - enabled + type: object + type: object + cloudProfile: + description: CloudProfile contains a reference to a CloudProfile or + a NamespacedCloudProfile. + properties: + kind: + description: Kind contains a CloudProfile kind. + type: string + name: + description: Name contains the name of the referenced CloudProfile. + type: string + required: + - kind + - name + type: object + cloudProfileName: + description: |- + CloudProfileName is a name of a CloudProfile object. + + Deprecated: This field will be removed in a future version of Gardener. Use `CloudProfile` instead. + Until Kubernetes v1.33, this field is synced with the `CloudProfile` field. + Starting with Kubernetes v1.34, this field is set to empty string and must not be provided anymore. + type: string + controlPlane: + description: ControlPlane contains general settings for the control + plane of the shoot. + properties: + highAvailability: + description: |- + HighAvailability holds the configuration settings for high availability of the + control plane of a shoot. + properties: + failureTolerance: + description: FailureTolerance holds information about failure + tolerance level of a highly available resource. + properties: + type: + description: Type specifies the type of failure that the + highly available resource can tolerate + type: string + required: + - type + type: object + required: + - failureTolerance + type: object + zones: + description: |- + Zones is a list of availability zones in which the control plane components should be placed. + Requires the referenced CloudProfile to have spec.controlPlane.allowZonePinning set to true. + This field is immutable once set. + items: + type: string + type: array + type: object + credentialsBindingName: + description: |- + CredentialsBindingName is the name of a CredentialsBinding that has a reference to the provider credentials. + The credentials will be used to create the shoot in the respective account. The field is mutually exclusive with SecretBindingName. + type: string + dns: + description: DNS contains information about the DNS settings of the + Shoot. + properties: + domain: + description: |- + Domain is the external available domain of the Shoot cluster. This domain will be written into the + kubeconfig that is handed out to end-users. This field is immutable. + type: string + providers: + description: |- + Providers is a list of DNS providers that shall be enabled for this shoot cluster. Only relevant if + not a default domain is used. + + Deprecated: Configuring multiple DNS providers is deprecated and will be forbidden in a future release. + Please use the DNS extension provider config (e.g. shoot-dns-service) for additional providers. + items: + description: DNSProvider contains information about a DNS provider. + properties: + credentialsRef: + description: |- + CredentialsRef is a reference to a resource providing credentials for the DNS provider. + Supported resources are Secret and WorkloadIdentity. + properties: + apiVersion: + description: apiVersion is the API version of the referent + type: string + kind: + description: 'kind is the kind of the referent; More + info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'name is the name of the referent; More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + domains: + description: |- + Domains contains information about which domains shall be included/excluded for this provider. + + Deprecated: This field is deprecated and will be removed in a future release. + Please use the DNS extension provider config (e.g. shoot-dns-service) for additional configuration. + properties: + exclude: + description: Exclude is a list of domains that shall + be excluded. + items: + type: string + type: array + include: + description: Include is a list of domains that shall + be included. + items: + type: string + type: array + type: object + primary: + description: |- + Primary indicates that this DNSProvider is used for shoot related domains. + + Deprecated: This field is deprecated and will be removed in a future release. + Please use the DNS extension provider config (e.g. shoot-dns-service) for additional and non-primary providers. + type: boolean + secretName: + description: |- + SecretName is a name of a secret containing credentials for the stated domain and the + provider. When not specified, the Gardener will use the cloud provider credentials referenced + by the Shoot and try to find respective credentials there (primary provider only). Specifying this field may override + this behavior, i.e. forcing the Gardener to only look into the given secret. + + Deprecated: This field is deprecated and will be forbidden starting from Kubernetes 1.35. Please use `CredentialsRef` instead. + Until removed, this field is synced with the `CredentialsRef` field when it refers to a secret. + type: string + type: + description: Type is the DNS provider type. + type: string + zones: + description: |- + Zones contains information about which hosted zones shall be included/excluded for this provider. + + Deprecated: This field is deprecated and will be removed in a future release. + Please use the DNS extension provider config (e.g. shoot-dns-service) for additional configuration. + properties: + exclude: + description: Exclude is a list of domains that shall + be excluded. + items: + type: string + type: array + include: + description: Include is a list of domains that shall + be included. + items: + type: string + type: array + type: object + type: object + type: array + type: object + exposureClassName: + description: ExposureClassName is the optional name of an exposure + class to apply a control plane endpoint exposure strategy. + type: string + extensions: + description: Extensions contain type and provider information for + Shoot extensions. + items: + description: Extension contains type and provider information for + extensions. + properties: + disabled: + description: Disabled allows to disable extensions that were + marked as 'automatically enabled' by Gardener administrators. + type: boolean + providerConfig: + description: ProviderConfig is the configuration passed to extension + resource. + type: object + x-kubernetes-preserve-unknown-fields: true + type: + description: Type is the type of the extension resource. + type: string + required: + - type + type: object + type: array + hibernation: + description: Hibernation contains information whether the Shoot is + suspended or not. + properties: + enabled: + description: |- + Enabled specifies whether the Shoot needs to be hibernated or not. If it is true, the Shoot's desired state is to be hibernated. + If it is false or nil, the Shoot's desired state is to be awakened. + type: boolean + schedules: + description: Schedules determine the hibernation schedules. + items: + description: |- + HibernationSchedule determines the hibernation schedule of a Shoot. + A Shoot will be regularly hibernated at each start time and will be woken up at each end time. + Start or End can be omitted, though at least one of each has to be specified. + properties: + end: + description: End is a Cron spec at which time a Shoot will + be woken up. + type: string + location: + description: Location is the time location in which both + start and shall be evaluated. + type: string + start: + description: Start is a Cron spec at which time a Shoot + will be hibernated. + type: string + type: object + type: array + type: object + kubernetes: + description: Kubernetes contains the version and configuration settings + of the control plane components. + properties: + clusterAutoscaler: + description: ClusterAutoscaler contains the configuration flags + for the Kubernetes cluster autoscaler. + properties: + autoscaling: + description: Autoscaling contains auto-scaling configuration + options for the cluster-autoscaler. + properties: + minAllowed: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + MinAllowed configures the minimum allowed resource requests for vertical pod autoscaling.. + Configuration of minAllowed resources is an advanced feature that can help clusters to overcome scale-up delays. + Default values are not applied to this field. type: object + required: + - minAllowed + type: object + emitPerNodeGroupMetrics: + description: 'EmitPerNodeGroupMetrics emits additional per + node group metrics (default: false).' + type: boolean + expander: + description: |- + Expander defines the algorithm to use during scale up (default: least-waste). + See: https://github.com/gardener/autoscaler/blob/machine-controller-manager-provider/cluster-autoscaler/FAQ.md#what-are-expanders. + type: string + ignoreDaemonsetsUtilization: + description: 'IgnoreDaemonsetsUtilization allows CA to ignore + DaemonSet pods when calculating resource utilization for + scaling down (default: false).' + type: boolean + ignoreTaints: + description: |- + IgnoreTaints specifies a list of taint keys to ignore in node templates when considering to scale a node group. + + Deprecated: Ignore taints are deprecated and treated as startup taints + items: + type: string + type: array + initialNodeGroupBackoffDuration: + description: 'InitialNodeGroupBackoffDuration is the duration + of first backoff after a new node failed to start (default: + 5m).' + type: string + maxBinpackingTime: + description: |- + MaxBinpackingTime is the maximum time spent on binpacking for a single scale-up. + If binpacking is limited by this, scale-up continues with the already calculated scale-up options (default: 5m). + type: string + maxDrainParallelism: + description: |- + MaxDrainParallelism specifies the maximum number of nodes needing drain, that can be drained and deleted in parallel. + Default: 1 + format: int32 + type: integer + maxEmptyBulkDelete: + description: |- + MaxEmptyBulkDelete specifies the maximum number of empty nodes that can be deleted at the same time (default: MaxScaleDownParallelism when that is set). + + Deprecated: This field is deprecated. Setting this field will be forbidden starting from Kubernetes 1.33 and will be removed once gardener drops support for kubernetes v1.32. + This cluster-autoscaler field is deprecated upstream, use --max-scale-down-parallelism instead. + format: int32 + type: integer + maxGracefulTerminationSeconds: + description: 'MaxGracefulTerminationSeconds is the number + of seconds CA waits for pod termination when trying to scale + down a node (default: 600).' + format: int32 + type: integer + maxNodeGroupBackoffDuration: + description: 'MaxNodeGroupBackoffDuration is the maximum backoff + duration for a NodeGroup after new nodes failed to start + (default: 30m).' + type: string + maxNodeProvisionTime: + description: 'MaxNodeProvisionTime defines how long CA waits + for node to be provisioned (default: 20 mins).' + type: string + maxScaleDownParallelism: + description: |- + MaxScaleDownParallelism specifies the maximum number of nodes (both empty and needing drain) that can be deleted in parallel. + Default: 10 or MaxEmptyBulkDelete when that is set + format: int32 + type: integer + newPodScaleUpDelay: + description: 'NewPodScaleUpDelay specifies how long CA should + ignore newly created pods before they have to be considered + for scale-up (default: 0s).' + type: string + nodeGroupBackoffResetTimeout: + description: 'NodeGroupBackoffResetTimeout is the time after + last failed scale-up when the backoff duration is reset + (default: 3h).' + type: string + scaleDownDelayAfterAdd: + description: 'ScaleDownDelayAfterAdd defines how long after + scale up that scale down evaluation resumes (default: 1 + hour).' + type: string + scaleDownDelayAfterDelete: + description: 'ScaleDownDelayAfterDelete how long after node + deletion that scale down evaluation resumes, defaults to + scanInterval (default: 0 secs).' + type: string + scaleDownDelayAfterFailure: + description: 'ScaleDownDelayAfterFailure how long after scale + down failure that scale down evaluation resumes (default: + 3 mins).' + type: string + scaleDownUnneededTime: + description: 'ScaleDownUnneededTime defines how long a node + should be unneeded before it is eligible for scale down + (default: 30 mins).' + type: string + scaleDownUtilizationThreshold: + description: 'ScaleDownUtilizationThreshold defines the threshold + in fraction (0.0 - 1.0) under which a node is being removed + (default: 0.5).' + type: number + scanInterval: + description: 'ScanInterval how often cluster is reevaluated + for scale up or down (default: 10 secs).' + type: string + startupTaints: + description: |- + StartupTaints specifies a list of taint keys to ignore in node templates when considering to scale a node group. + Cluster Autoscaler treats nodes tainted with startup taints as unready, but taken into account during scale up logic, assuming they will become ready shortly. + items: + type: string + type: array + statusTaints: + description: |- + StatusTaints specifies a list of taint keys to ignore in node templates when considering to scale a node group. + Cluster Autoscaler internally treats nodes tainted with status taints as ready, but filtered out during scale up logic. + items: + type: string + type: array + verbosity: + description: 'Verbosity allows CA to modify its log level + (default: 2).' + format: int32 + type: integer + type: object + etcd: + description: ETCD contains configuration for etcds of the shoot + cluster. + properties: + events: + description: Events contains configuration for the events + etcd. + properties: + autoscaling: + description: Autoscaling contains auto-scaling configuration + options for etcd. + properties: + minAllowed: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + MinAllowed configures the minimum allowed resource requests for vertical pod autoscaling.. + Configuration of minAllowed resources is an advanced feature that can help clusters to overcome scale-up delays. + Default values are not applied to this field. + type: object + required: + - minAllowed + type: object + type: object + main: + description: Main contains configuration for the main etcd. + properties: + autoscaling: + description: Autoscaling contains auto-scaling configuration + options for etcd. + properties: + minAllowed: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + MinAllowed configures the minimum allowed resource requests for vertical pod autoscaling.. + Configuration of minAllowed resources is an advanced feature that can help clusters to overcome scale-up delays. + Default values are not applied to this field. + type: object + required: + - minAllowed + type: object + type: object + type: object + kubeAPIServer: + description: KubeAPIServer contains configuration settings for + the kube-apiserver. + properties: + admissionPlugins: + description: |- + AdmissionPlugins contains the list of user-defined admission plugins (additional to those managed by Gardener), and, if desired, the corresponding + configuration. + items: + description: AdmissionPlugin contains information about + a specific admission plugin and its corresponding configuration. + properties: + config: + description: Config is the configuration of the plugin. + type: object + x-kubernetes-preserve-unknown-fields: true + disabled: + description: Disabled specifies whether this plugin + should be disabled. + type: boolean + kubeconfigSecretName: + description: KubeconfigSecretName specifies the name + of a secret containing the kubeconfig for this admission + plugin. + type: string + name: + description: Name is the name of the plugin. + type: string + required: + - name + type: object + type: array + apiAudiences: + description: |- + APIAudiences are the identifiers of the API. The service account token authenticator will + validate that tokens used against the API are bound to at least one of these audiences. + Defaults to ["kubernetes"]. + items: + type: string + type: array + auditConfig: + description: AuditConfig contains configuration settings for + the audit of the kube-apiserver. + properties: + auditPolicy: + description: AuditPolicy contains configuration settings + for audit policy of the kube-apiserver. + properties: + configMapRef: + description: |- + ConfigMapRef is a reference to a ConfigMap object in the same namespace, + which contains the audit policy for the kube-apiserver. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: object + type: object + autoscaling: + description: Autoscaling contains auto-scaling configuration + options for the kube-apiserver. + properties: + minAllowed: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + MinAllowed configures the minimum allowed resource requests for vertical pod autoscaling.. + Configuration of minAllowed resources is an advanced feature that can help clusters to overcome scale-up delays. + Default values are not applied to this field. + type: object + required: + - minAllowed + type: object + defaultNotReadyTolerationSeconds: + description: |- + DefaultNotReadyTolerationSeconds indicates the tolerationSeconds of the toleration for notReady:NoExecute + that is added by default to every pod that does not already have such a toleration (flag `--default-not-ready-toleration-seconds`). + The field has effect only when the `DefaultTolerationSeconds` admission plugin is enabled. + Defaults to 300. + format: int64 + type: integer + defaultUnreachableTolerationSeconds: + description: |- + DefaultUnreachableTolerationSeconds indicates the tolerationSeconds of the toleration for unreachable:NoExecute + that is added by default to every pod that does not already have such a toleration (flag `--default-unreachable-toleration-seconds`). + The field has effect only when the `DefaultTolerationSeconds` admission plugin is enabled. + Defaults to 300. + format: int64 + type: integer + enableAnonymousAuthentication: + description: |- + EnableAnonymousAuthentication defines whether anonymous requests to the secure port + of the API server should be allowed (flag `--anonymous-auth`). + See: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ + + Deprecated: This field is deprecated and will be removed after support for Kubernetes v1.34 is dropped. + This field is forbidden for clusters with Kubernetes version >= 1.35. + Please use anonymous authentication configuration instead. + type: boolean + encryptionConfig: + description: EncryptionConfig contains customizable encryption + configuration of the Kube API server. + properties: + provider: + description: Provider contains information about the encryption + provider. properties: + type: + description: |- + Type contains the type of the encryption provider. + + Supported types: + - "aescbc" + - "aesgcm" + - "secretbox" + Defaults to aescbc. + type: string + type: object + resources: + description: |- + Resources contains the list of resources that shall be encrypted in addition to secrets. + Each item is a Kubernetes resource name in plural (resource or resource.group) that should be encrypted. + Wildcards are not supported for now. + See https://github.com/gardener/gardener/blob/master/docs/usage/security/etcd_encryption_config.md for more details. + items: + type: string + type: array + required: + - provider + type: object + eventTTL: + description: |- + EventTTL controls the amount of time to retain events. + Defaults to 1h. + type: string + featureGates: + additionalProperties: + type: boolean + description: FeatureGates contains information about enabled + feature gates. + type: object + logging: + description: Logging contains configuration for the log level + and HTTP access logs. + properties: + httpAccessVerbosity: + description: HTTPAccessVerbosity is the kube-apiserver + access logs level + format: int32 + type: integer + verbosity: + description: |- + Verbosity is the kube-apiserver log verbosity level + Defaults to 2. + format: int32 + type: integer + type: object + requests: + description: Requests contains configuration for request-specific + settings for the kube-apiserver. + properties: + maxMutatingInflight: + description: |- + MaxMutatingInflight is the maximum number of mutating requests in flight at a given time. When the server + exceeds this, it rejects requests. + format: int32 + type: integer + maxNonMutatingInflight: + description: |- + MaxNonMutatingInflight is the maximum number of non-mutating requests in flight at a given time. When the server + exceeds this, it rejects requests. + format: int32 + type: integer + type: object + runtimeConfig: + additionalProperties: + type: boolean + description: RuntimeConfig contains information about enabled + or disabled APIs. + type: object + serviceAccountConfig: + description: |- + ServiceAccountConfig contains configuration settings for the service account handling + of the kube-apiserver. + properties: + acceptedIssuers: + description: |- + AcceptedIssuers is an additional set of issuers that are used to determine which service account tokens are accepted. + These values are not used to generate new service account tokens. Only useful when service account tokens are also + issued by another external system or a change of the current issuer that is used for generating tokens is being performed. + items: + type: string + type: array + extendTokenExpiration: + description: |- + ExtendTokenExpiration turns on projected service account expiration extension during token generation, which + helps safe transition from legacy token to bound service account token feature. If this flag is enabled, + admission injected tokens would be extended up to 1 year to prevent unexpected failure during transition, + ignoring value of service-account-max-token-expiration. + type: boolean + issuer: + description: |- + Issuer is the identifier of the service account token issuer. The issuer will assert this + identifier in "iss" claim of issued tokens. This value is used to generate new service account tokens. + This value is a string or URI. Defaults to URI of the API server. + type: string + maxTokenExpiration: + description: |- + MaxTokenExpiration is the maximum validity duration of a token created by the service account token issuer. If an + otherwise valid TokenRequest with a validity duration larger than this value is requested, a token will be issued + with a validity duration of this value. + This field must be within [30d,90d]. + type: string + type: object + structuredAuthentication: + description: StructuredAuthentication contains configuration + settings for structured authentication for the kube-apiserver. + properties: + configMapName: + description: |- + ConfigMapName is the name of the ConfigMap in the project namespace which contains AuthenticationConfiguration + for the kube-apiserver. + type: string + required: + - configMapName + type: object + structuredAuthorization: + description: StructuredAuthorization contains configuration + settings for structured authorization for the kube-apiserver. + properties: + configMapName: + description: |- + ConfigMapName is the name of the ConfigMap in the project namespace which contains AuthorizationConfiguration for + the kube-apiserver. + type: string + kubeconfigs: + description: Kubeconfigs is a list of references for kubeconfigs + for the authorization webhooks. + items: + description: AuthorizerKubeconfigReference is a reference + for a kubeconfig for a authorization webhook. + properties: + authorizerName: + description: AuthorizerName is the name of a webhook + authorizer. + type: string + secretName: + description: SecretName is the name of a secret + containing the kubeconfig. + type: string + required: + - authorizerName + - secretName + type: object + type: array + required: + - configMapName + - kubeconfigs + type: object + tlsMinVersion: + description: |- + TLSMinVersion is the minimum TLS version accepted by the kube-apiserver. + Supported values: VersionTLS12, VersionTLS13. + type: string + watchCacheSizes: + description: |- + WatchCacheSizes contains configuration of the API server's watch cache sizes. + Configuring these flags might be useful for large-scale Shoot clusters with a lot of parallel update requests + and a lot of watching controllers (e.g. large ManagedSeed clusters). When the API server's watch cache's + capacity is too small to cope with the amount of update requests and watchers for a particular resource, it + might happen that controller watches are permanently stopped with `too old resource version` errors. + Starting from kubernetes v1.19, the API server's watch cache size is adapted dynamically and setting the watch + cache size flags will have no effect, except when setting it to 0 (which disables the watch cache). + properties: + default: + description: |- + Default is not respected anymore by kube-apiserver. + The cache is sized automatically. + + Deprecated: This field is deprecated. Setting the default cache size will be forbidden starting from Kubernetes 1.35. + format: int32 + type: integer + resources: + description: |- + Resources configures the watch cache size of the kube-apiserver per resource + (flag `--watch-cache-sizes`). + See: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ + items: + description: ResourceWatchCacheSize contains configuration + of the API server's watch cache size for one specific + resource. + properties: + apiGroup: + description: |- + APIGroup is the API group of the resource for which the watch cache size should be configured. + An unset value is used to specify the legacy core API (e.g. for `secrets`). + type: string + resource: + description: |- + Resource is the name of the resource for which the watch cache size should be configured + (in lowercase plural form, e.g. `secrets`). + type: string + size: + description: CacheSize specifies the watch cache + size that should be configured for the specified + resource. + format: int32 + type: integer + required: + - resource + - size + type: object + type: array + type: object + type: object + kubeControllerManager: + description: KubeControllerManager contains configuration settings + for the kube-controller-manager. + properties: + featureGates: + additionalProperties: + type: boolean + description: FeatureGates contains information about enabled + feature gates. + type: object + horizontalPodAutoscaler: + description: HorizontalPodAutoscalerConfig contains horizontal + pod autoscaler configuration settings for the kube-controller-manager. + properties: + cpuInitializationPeriod: + description: The period after which a ready pod transition + is considered to be the first. + type: string + downscaleStabilization: + description: The configurable window at which the controller + will choose the highest recommendation for autoscaling. + type: string + initialReadinessDelay: + description: The configurable period at which the horizontal + pod autoscaler considers a Pod “not yet ready” given + that it’s unready and it has transitioned to unready + during that time. + type: string + syncPeriod: + description: The period for syncing the number of pods + in horizontal pod autoscaler. + type: string + tolerance: + description: The minimum change (from 1.0) in the desired-to-actual + metrics ratio for the horizontal pod autoscaler to consider + scaling. + type: number + type: object + nodeCIDRMaskSize: + description: NodeCIDRMaskSize defines the mask size for node + cidr in cluster (default is 24). This field is immutable. + format: int32 + type: integer + nodeCIDRMaskSizeIPv6: + description: NodeCIDRMaskSizeIPv6 defines the mask size for + node cidr in cluster (default is 64). This field is immutable. + format: int32 + type: integer + nodeMonitorGracePeriod: + description: NodeMonitorGracePeriod defines the grace period + before an unresponsive node is marked unhealthy. + type: string + podEvictionTimeout: + description: |- + PodEvictionTimeout defines the grace period for deleting pods on failed nodes. Defaults to 2m. + + Deprecated: The corresponding kube-controller-manager flag `--pod-eviction-timeout` is deprecated + in favor of the kube-apiserver flags `--default-not-ready-toleration-seconds` and `--default-unreachable-toleration-seconds`. + The `--pod-eviction-timeout` flag does not have effect when the taint based eviction is enabled. The taint + based eviction is beta (enabled by default) since Kubernetes 1.13 and GA since Kubernetes 1.18. Hence, + instead of setting this field, set the `spec.kubernetes.kubeAPIServer.defaultNotReadyTolerationSeconds` and + `spec.kubernetes.kubeAPIServer.defaultUnreachableTolerationSeconds`. Setting this field is forbidden starting + from Kubernetes 1.33. + type: string + type: object + kubeProxy: + description: KubeProxy contains configuration settings for the + kube-proxy. + properties: + enabled: + description: |- + Enabled indicates whether kube-proxy should be deployed or not. + Depending on the networking extensions switching kube-proxy off might be rejected. Consulting the respective documentation of the used networking extension is recommended before using this field. + defaults to true if not specified. + type: boolean + featureGates: + additionalProperties: + type: boolean + description: FeatureGates contains information about enabled + feature gates. + type: object + mode: + description: |- + Mode specifies which proxy mode to use. + defaults to IPTables. + type: string + type: object + kubeScheduler: + description: KubeScheduler contains configuration settings for + the kube-scheduler. + properties: + featureGates: + additionalProperties: + type: boolean + description: FeatureGates contains information about enabled + feature gates. + type: object + kubeMaxPDVols: + description: |- + KubeMaxPDVols is not respected anymore by kube-scheduler. + The maximum number of attached volumes is configured by the CSI driver. + More information can be found at https://kubernetes.io/docs/concepts/storage/storage-limits/#custom-limits. + + Deprecated: This field is deprecated. Using this field will be forbidden starting from Kubernetes 1.35. + type: string + profile: + description: |- + Profile configures the scheduling profile for the cluster. + If not specified, the used profile is "balanced" (provides the default kube-scheduler behavior). + type: string + type: object + kubelet: + description: Kubelet contains configuration settings for the kubelet. + properties: + containerLogMaxFiles: + description: Maximum number of container log files that can + be present for a container. + format: int32 + type: integer + containerLogMaxSize: + anyOf: + - type: integer + - type: string + description: |- + A quantity defines the maximum size of the container log file before it is rotated. For example: "5Mi" or "256Ki". + Default: 100Mi + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + cpuCFSQuota: + description: CPUCFSQuota allows you to disable/enable CPU + throttling for Pods. + type: boolean + cpuManagerPolicy: + description: 'CPUManagerPolicy allows to set alternative CPU + management policies (default: none).' + type: string + evictionHard: + description: |- + EvictionHard describes a set of eviction thresholds (e.g. memory.available<1Gi) that if met would trigger a Pod eviction. + Default: + memory.available: "100Mi/1Gi/5%" + nodefs.available: "5%" + nodefs.inodesFree: "5%" + imagefs.available: "5%" + imagefs.inodesFree: "5%" + properties: + imageFSAvailable: + description: ImageFSAvailable is the threshold for the + free disk space in the imagefs filesystem (docker images + and container writable layers). + type: string + imageFSInodesFree: + description: ImageFSInodesFree is the threshold for the + available inodes in the imagefs filesystem. + type: string + memoryAvailable: + description: MemoryAvailable is the threshold for the + free memory on the host server. + type: string + nodeFSAvailable: + description: NodeFSAvailable is the threshold for the + free disk space in the nodefs filesystem (docker volumes, + logs, etc). + type: string + nodeFSInodesFree: + description: NodeFSInodesFree is the threshold for the + available inodes in the nodefs filesystem. + type: string + type: object + evictionMaxPodGracePeriod: + description: |- + EvictionMaxPodGracePeriod describes the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. + Default: 90 + format: int32 + type: integer + evictionMinimumReclaim: + description: |- + EvictionMinimumReclaim configures the amount of resources below the configured eviction threshold that the kubelet attempts to reclaim whenever the kubelet observes resource pressure. + Default: 0 for each resource + properties: + imageFSAvailable: + anyOf: + - type: integer + - type: string + description: ImageFSAvailable is the threshold for the + disk space reclaim in the imagefs filesystem (docker + images and container writable layers). + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + imageFSInodesFree: + anyOf: + - type: integer + - type: string + description: ImageFSInodesFree is the threshold for the + inodes reclaim in the imagefs filesystem. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + memoryAvailable: + anyOf: + - type: integer + - type: string + description: MemoryAvailable is the threshold for the + memory reclaim on the host server. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + nodeFSAvailable: + anyOf: + - type: integer + - type: string + description: NodeFSAvailable is the threshold for the + disk space reclaim in the nodefs filesystem (docker + volumes, logs, etc). + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + nodeFSInodesFree: + anyOf: + - type: integer + - type: string + description: NodeFSInodesFree is the threshold for the + inodes reclaim in the nodefs filesystem. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + evictionPressureTransitionPeriod: + description: |- + EvictionPressureTransitionPeriod is the duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. + Default: 4m0s + type: string + evictionSoft: + description: |- + EvictionSoft describes a set of eviction thresholds (e.g. memory.available<1.5Gi) that if met over a corresponding grace period would trigger a Pod eviction. + Default: + memory.available: "200Mi/1.5Gi/10%" + nodefs.available: "10%" + nodefs.inodesFree: "10%" + imagefs.available: "10%" + imagefs.inodesFree: "10%" + properties: + imageFSAvailable: + description: ImageFSAvailable is the threshold for the + free disk space in the imagefs filesystem (docker images + and container writable layers). + type: string + imageFSInodesFree: + description: ImageFSInodesFree is the threshold for the + available inodes in the imagefs filesystem. + type: string + memoryAvailable: + description: MemoryAvailable is the threshold for the + free memory on the host server. + type: string + nodeFSAvailable: + description: NodeFSAvailable is the threshold for the + free disk space in the nodefs filesystem (docker volumes, + logs, etc). + type: string + nodeFSInodesFree: + description: NodeFSInodesFree is the threshold for the + available inodes in the nodefs filesystem. + type: string + type: object + evictionSoftGracePeriod: + description: |- + EvictionSoftGracePeriod describes a set of eviction grace periods (e.g. memory.available=1m30s) that correspond to how long a soft eviction threshold must hold before triggering a Pod eviction. + Default: + memory.available: 1m30s + nodefs.available: 1m30s + nodefs.inodesFree: 1m30s + imagefs.available: 1m30s + imagefs.inodesFree: 1m30s + properties: + imageFSAvailable: + description: ImageFSAvailable is the grace period for + the ImageFSAvailable eviction threshold. + type: string + imageFSInodesFree: + description: ImageFSInodesFree is the grace period for + the ImageFSInodesFree eviction threshold. + type: string + memoryAvailable: + description: MemoryAvailable is the grace period for the + MemoryAvailable eviction threshold. + type: string + nodeFSAvailable: + description: NodeFSAvailable is the grace period for the + NodeFSAvailable eviction threshold. + type: string + nodeFSInodesFree: + description: NodeFSInodesFree is the grace period for + the NodeFSInodesFree eviction threshold. + type: string + type: object + failSwapOn: + description: FailSwapOn makes the Kubelet fail to start if + swap is enabled on the node. (default true). + type: boolean + featureGates: + additionalProperties: + type: boolean + description: FeatureGates contains information about enabled + feature gates. + type: object + imageGCHighThresholdPercent: + description: |- + ImageGCHighThresholdPercent describes the percent of the disk usage which triggers image garbage collection. + Default: 50 + format: int32 + type: integer + imageGCLowThresholdPercent: + description: |- + ImageGCLowThresholdPercent describes the percent of the disk to which garbage collection attempts to free. + Default: 40 + format: int32 + type: integer + imageMaximumGCAge: + description: |- + ImageMaximumGCAge is the maximum age of an unused image before it can be garbage collected. + Default: 0s + type: string + imageMinimumGCAge: + description: |- + ImageMinimumGCAge is the minimum age of an unused image before it can be garbage collected. + Default: 2m0s + type: string + imagePullCredentialsVerificationPolicy: + description: |- + ImagePullCredentialsVerificationPolicy determines how credentials should be verified when pulling images that + already exist on the node. It corresponds to the kubelet's `imagePullCredentialsVerificationPolicy` field and is only + effective for Kubernetes versions >= 1.35. May be one of {"NeverVerify", "NeverVerifyPreloadedImages", + "NeverVerifyAllowlistedImages", "AlwaysVerify"}. Defaults to "NeverVerifyPreloadedImages" (the kubelet default). + type: string + kubeReserved: + description: |- + KubeReserved is the configuration for resources reserved for kubernetes node components (mainly kubelet and container runtime). + When updating these values, be aware that cgroup resizes may not succeed on active worker nodes. Look for the NodeAllocatableEnforced event to determine if the configuration was applied. + Default: cpu=80m,memory=1Gi,pid=20k + properties: + cpu: + anyOf: + - type: integer + - type: string + description: CPU is the reserved cpu. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + ephemeralStorage: + anyOf: + - type: integer + - type: string + description: EphemeralStorage is the reserved ephemeral-storage. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + memory: + anyOf: + - type: integer + - type: string + description: Memory is the reserved memory. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + pid: + anyOf: + - type: integer + - type: string + description: PID is the reserved process-ids. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + maxParallelImagePulls: + description: |- + MaxParallelImagePulls describes the maximum number of image pulls in parallel. The value must be a positive number. + This field cannot be set if SerializeImagePulls (pull one image at a time) is set to true. + Setting it to nil means no limit. + Default: nil + format: int32 + type: integer + maxPods: + description: |- + MaxPods is the maximum number of Pods that are allowed by the Kubelet. + Default: 110 + format: int32 + type: integer + memorySwap: + description: MemorySwap configures swap memory available to + container workloads. + properties: + swapBehavior: + description: |- + SwapBehavior configures swap memory available to container workloads. May be one of {"NoSwap", "LimitedSwap"} + defaults to: LimitedSwap + type: string + type: object + podPidsLimit: + description: PodPIDsLimit is the maximum number of process + IDs per pod allowed by the kubelet. + format: int64 + type: integer + preloadedImagesVerificationAllowlist: + description: |- + PreloadedImagesVerificationAllowlist specifies a list of images that are exempted from credential + re-verification for the "NeverVerifyAllowlistedImages" ImagePullCredentialsVerificationPolicy. The list accepts a + full path segment wildcard suffix "/*". Only image specs without an image tag or digest must be used. It + corresponds to the kubelet's `preloadedImagesVerificationAllowlist` field and is only effective for Kubernetes versions + >= 1.35. + items: + type: string + type: array + protectKernelDefaults: + description: |- + ProtectKernelDefaults ensures that the kernel tunables are equal to the kubelet defaults. + Defaults to true. + type: boolean + registryBurst: + description: |- + RegistryBurst is the maximum size of bursty pulls, temporarily allows pulls to burst to this number, + while still not exceeding registryPullQPS. The value must not be a negative number. + Only used if registryPullQPS is greater than 0. + Default: 10 + format: int32 + type: integer + registryPullQPS: + description: |- + RegistryPullQPS is the limit of registry pulls per second. The value must not be a negative number. + Setting it to 0 means no limit. + Default: 5 + format: int32 + type: integer + seccompDefault: + description: SeccompDefault enables the use of `RuntimeDefault` + as the default seccomp profile for all workloads. + type: boolean + serializeImagePulls: + description: |- + SerializeImagePulls describes whether the images are pulled one at a time. + Default: true + type: boolean + singleProcessOOMKill: + description: |- + SingleProcessOOMKill, if true, will prevent the `memory.oom.group` flag from being set for container + cgroups in cgroups v2. This causes processes in the container to be OOM killed individually instead of + as a group. It means that if true, the behavior aligns with the behavior of cgroups v1. + type: boolean + streamingConnectionIdleTimeout: + description: |- + StreamingConnectionIdleTimeout is the maximum time a streaming connection can be idle before the connection is automatically closed. + This field cannot be set lower than "30s" or greater than "4h". + Default: "5m". + type: string + type: object + version: + description: |- + Version is the semantic Kubernetes version to use for the Shoot cluster. + Defaults to the highest supported minor and patch version given in the referenced cloud profile. + The version can be omitted completely or partially specified, e.g. `.`. + type: string + verticalPodAutoscaler: + description: VerticalPodAutoscaler contains the configuration + flags for the Kubernetes vertical pod autoscaler. + properties: + cpuHistogramDecayHalfLife: + description: |- + CPUHistogramDecayHalfLife is the amount of time it takes a historical CPU usage sample to lose half of its weight. + (default: 24h) + type: string + enabled: + description: Enabled specifies whether the Kubernetes VPA + shall be enabled for the shoot cluster. + type: boolean + evictAfterOOMThreshold: + description: |- + EvictAfterOOMThreshold defines the threshold that will lead to pod eviction in case it OOMed in less than the given + threshold since its start and if it has only one container (default: 10m0s). + type: string + evictionRateBurst: + description: 'EvictionRateBurst defines the burst of pods + that can be evicted (default: 1)' + format: int32 + type: integer + evictionRateLimit: + description: |- + EvictionRateLimit defines the number of pods that can be evicted per second. A rate limit set to 0 or -1 will + disable the rate limiter (default: -1). + type: number + evictionTolerance: + description: |- + EvictionTolerance defines the fraction of replica count that can be evicted for update in case more than one + pod can be evicted (default: 0.5). + type: number + featureGates: + additionalProperties: + type: boolean + description: FeatureGates contains information about enabled + feature gates. + type: object + maxAllowed: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + MaxAllowed specifies the global maximum allowed (maximum amount of resources) that vpa-recommender can recommend for a container. + The VerticalPodAutoscaler-level maximum allowed takes precedence over the global maximum allowed. + For more information, see https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/examples.md#specifying-global-maximum-allowed-resources-to-prevent-pods-from-being-unschedulable. + + Defaults to nil (no maximum). + type: object + memoryAggregationInterval: + description: |- + MemoryAggregationInterval is the length of a single interval, for which the peak memory usage is computed. + (default: 24h) + type: string + memoryAggregationIntervalCount: + description: |- + MemoryAggregationIntervalCount is the number of consecutive memory-aggregation-intervals which make up the + MemoryAggregationWindowLength which in turn is the period for memory usage aggregation by VPA. In other words, + `MemoryAggregationWindowLength = memory-aggregation-interval * memory-aggregation-interval-count`. + (default: 8) + format: int64 + type: integer + memoryHistogramDecayHalfLife: + description: |- + MemoryHistogramDecayHalfLife is the amount of time it takes a historical memory usage sample to lose half of its weight. + (default: 24h) + type: string + recommendationLowerBoundCPUPercentile: + description: |- + RecommendationLowerBoundCPUPercentile is the usage percentile that will be used for the lower bound on CPU recommendation. + (default: 0.5) + type: number + recommendationLowerBoundMemoryPercentile: + description: |- + RecommendationLowerBoundMemoryPercentile is the usage percentile that will be used for the lower bound on memory recommendation. + (default: 0.5) + type: number + recommendationMarginFraction: + description: |- + RecommendationMarginFraction is the fraction of usage added as the safety margin to the recommended request + (default: 0.15). + type: number + recommendationUpperBoundCPUPercentile: + description: |- + RecommendationUpperBoundCPUPercentile is the usage percentile that will be used for the upper bound on CPU recommendation. + (default: 0.95) + type: number + recommendationUpperBoundMemoryPercentile: + description: |- + RecommendationUpperBoundMemoryPercentile is the usage percentile that will be used for the upper bound on memory recommendation. + (default: 0.95) + type: number + recommenderInterval: + description: 'RecommenderInterval is the interval how often + metrics should be fetched (default: 1m0s).' + type: string + recommenderUpdateWorkerCount: + description: |- + RecommenderUpdateWorkerCount is the number of workers used in the vpa-recommender for updating VPAs and VPACheckpoints in parallel. + (default: 10) + format: int64 + type: integer + targetCPUPercentile: + description: |- + TargetCPUPercentile is the usage percentile that will be used as a base for CPU target recommendation. + Doesn't affect CPU lower bound, CPU upper bound nor memory recommendations. + (default: 0.9) + type: number + targetMemoryPercentile: + description: |- + TargetMemoryPercentile is the usage percentile that will be used as a base for memory target recommendation. + Doesn't affect memory lower bound nor memory upper bound. + (default: 0.9) + type: number + updaterInterval: + description: 'UpdaterInterval is the interval how often the + updater should run (default: 1m0s).' + type: string + required: + - enabled + type: object + type: object + maintenance: + description: |- + Maintenance contains information about the time window for maintenance operations and which + operations should be performed. + properties: + autoRotation: + description: AutoRotation contains information about which rotations + should be automatically performed. + properties: + credentials: + description: Credentials contains information about which + credentials should be automatically rotated. + properties: + etcdEncryptionKey: + description: ETCDEncryptionKey configures the automatic + rotation for the etcd encryption key. + properties: + rotationPeriod: + description: |- + RotationPeriod is the period between a completed rotation and the start of a new rotation (default: 7d). + The allowed rotation period is between 30m and 90d. When set to 0, rotation is disabled. + type: string + type: object + observability: + description: Observability configures the automatic rotation + for the observability credentials. + properties: + rotationPeriod: + description: |- + RotationPeriod is the period between a completed rotation and the start of a new rotation (default: 7d). + The allowed rotation period is between 30m and 90d. When set to 0, rotation is disabled. + type: string + type: object + sshKeypair: + description: SSHKeypair configures the automatic rotation + for the ssh keypair for worker nodes. + properties: + rotationPeriod: + description: |- + RotationPeriod is the period between a completed rotation and the start of a new rotation (default: 7d). + The allowed rotation period is between 30m and 90d. When set to 0, rotation is disabled. + type: string + type: object + type: object + type: object + autoUpdate: + description: AutoUpdate contains information about which constraints + should be automatically updated. + properties: + kubernetesVersion: + description: 'KubernetesVersion indicates whether the patch + Kubernetes version may be automatically updated (default: + true).' + type: boolean + machineImageVersion: + description: 'MachineImageVersion indicates whether the machine + image version may be automatically updated (default: true).' + type: boolean + required: + - kubernetesVersion + type: object + confineSpecUpdateRollout: + description: |- + ConfineSpecUpdateRollout prevents that changes/updates to the shoot specification will be rolled out immediately. + Instead, they are rolled out during the shoot's maintenance time window. There is one exception that will trigger + an immediate roll out which is changes to the Spec.Hibernation.Enabled field. + type: boolean + timeWindow: + description: TimeWindow contains information about the time window + for maintenance operations. + properties: + begin: + description: |- + Begin is the beginning of the time window in the format HHMMSS±ZONE, e.g. "220000+0100" or "220000-0500". + If not present, a random value will be computed. + pattern: ([0-1][0-9]|2[0-3])[0-5][0-9][0-5][0-9]([+](0[0-9]|1[0-4])|[-](0[0-9]|1[0-2]))00 + type: string + end: + description: |- + End is the end of the time window in the format HHMMSS±ZONE, e.g. "220000+0100" or "220000-0500". + If not present, the value will be computed based on the "Begin" value. + pattern: ([0-1][0-9]|2[0-3])[0-5][0-9][0-5][0-9]([+](0[0-9]|1[0-4])|[-](0[0-9]|1[0-2]))00 + type: string + required: + - begin + - end + type: object + type: object + monitoring: + description: Monitoring contains information about custom monitoring + configurations for the shoot. + properties: + alerting: + description: Alerting contains information about the alerting + configuration for the shoot cluster. + properties: + emailReceivers: + description: MonitoringEmailReceivers is a list of recipients + for alerts + items: + type: string + type: array + type: object + type: object + networking: + description: Networking contains information about cluster networking + such as CNI Plugin type, CIDRs, ...etc. + properties: + ipFamilies: + description: |- + IPFamilies specifies the IP protocol versions to use for shoot networking. + See https://github.com/gardener/gardener/blob/master/docs/development/ipv6.md. + Defaults to ["IPv4"]. + items: + description: IPFamily is a type for specifying an IP protocol + version to use in Gardener clusters. + type: string + type: array + nodes: + description: |- + Nodes is the CIDR of the entire node network. + This field is mutable. + type: string + pods: + description: Pods is the CIDR of the pod network. This field is + immutable. + type: string + providerConfig: + description: ProviderConfig is the configuration passed to network + resource. + type: object + x-kubernetes-preserve-unknown-fields: true + services: + description: Services is the CIDR of the service network. This + field is immutable. + type: string + type: + description: Type identifies the type of the networking plugin. + This field is immutable. + type: string + type: object + provider: + description: Provider contains all provider-specific and provider-relevant + information. + properties: + controlPlaneConfig: + description: |- + ControlPlaneConfig contains the provider-specific control plane config blob. Please look up the concrete + definition in the documentation of your provider extension. + type: object + x-kubernetes-preserve-unknown-fields: true + infrastructureConfig: + description: |- + InfrastructureConfig contains the provider-specific infrastructure config blob. Please look up the concrete + definition in the documentation of your provider extension. + type: object + x-kubernetes-preserve-unknown-fields: true + type: + description: Type is the type of the provider. This field is immutable. + type: string + workers: + description: Workers is a list of worker groups. + items: + description: Worker is the base definition of a worker group. + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a map of key/value pairs for + annotations for all the `Node` objects in this worker + pool. + type: object + caBundle: + description: CABundle is a certificate bundle which will + be installed onto every machine of this worker pool. + type: string + clusterAutoscaler: + description: ClusterAutoscaler contains the cluster autoscaler + configurations for the worker pool. + properties: + maxNodeProvisionTime: + description: MaxNodeProvisionTime defines how long CA + waits for node to be provisioned. + type: string + scaleDownGpuUtilizationThreshold: + description: ScaleDownGpuUtilizationThreshold defines + the threshold in fraction (0.0 - 1.0) of gpu resources + under which a node is being removed. + type: number + scaleDownUnneededTime: + description: ScaleDownUnneededTime defines how long + a node should be unneeded before it is eligible for + scale down. + type: string + scaleDownUnreadyTime: + description: ScaleDownUnreadyTime defines how long an + unready node should be unneeded before it is eligible + for scale down. + type: string + scaleDownUtilizationThreshold: + description: ScaleDownUtilizationThreshold defines the + threshold in fraction (0.0 - 1.0) under which a node + is being removed. + type: number + type: object + controlPlane: + description: |- + ControlPlane specifies that the shoot cluster control plane components should be running in this worker pool. + This is only relevant for self-hosted shoot clusters. + properties: + backup: + description: |- + Backup holds the object store configuration for the backups of shoot (currently only etcd). + If it is not specified, then there won't be any backups taken. + properties: + credentialsRef: + description: |- + CredentialsRef is reference to a resource holding the credentials used for + authentication with the object store service where the backups are stored. + Supported referenced resources are v1.Secrets and + security.gardener.cloud/v1alpha1.WorkloadIdentity + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + provider: + description: Provider is a provider name. This field + is immutable. + type: string + providerConfig: + description: ProviderConfig is the configuration + passed to BackupBucket resource. + type: object + x-kubernetes-preserve-unknown-fields: true + region: + description: Region is a region name. This field + is immutable. + type: string + required: + - provider + type: object + exposure: + description: Exposure holds the exposure configuration + for the shoot (either `extension` or `dns` or omitted/empty). + properties: + dns: + description: |- + DNS specifies that this shoot will be exposed by DNS. + Mutually exclusive with Extension. + type: object + extension: + description: |- + Extension holds the type and provider config of the exposure extension. + Mutually exclusive with DNS. + properties: + providerConfig: + description: ProviderConfig holds the extension + specific configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + type: + description: |- + Type defines the type of the extension exposure. + Defaults to `.spec.provider.type` + type: string + type: object + type: object + type: object + cri: + description: |- + CRI contains configurations of CRI support of every machine in the worker pool. + Defaults to a CRI with name `containerd`. + properties: + containerRuntimes: + description: ContainerRuntimes is the list of the required + container runtimes supported for a worker pool. + items: + description: ContainerRuntime contains information + about worker's available container runtime + properties: + providerConfig: + description: ProviderConfig is the configuration + passed to container runtime resource. + type: object + x-kubernetes-preserve-unknown-fields: true + type: + description: Type is the type of the Container + Runtime. + type: string + required: + - type + type: object + type: array + name: + description: The name of the CRI library. Supported + values are `containerd`. + type: string + required: + - name + type: object + dataVolumes: + description: DataVolumes contains a list of additional worker + volumes. + items: + description: DataVolume contains information about a data + volume. + properties: + encrypted: + description: Encrypted determines if the volume should + be encrypted. + type: boolean name: - description: Machine image name. + description: Name of the volume to make it referenceable. type: string - version: - description: Machine image version. + size: + description: VolumeSize is the size of the volume. type: string - status: - description: Status contains the current status of the Shoot. - type: object - scope: Namespaced - names: - plural: shoots - singular: shoot - kind: Shoot \ No newline at end of file + type: + description: Type is the type of the volume. + type: string + required: + - name + - size + type: object + type: array + kubeletDataVolumeName: + description: KubeletDataVolumeName contains the name of + a dataVolume that should be used for storing kubelet state. + type: string + kubernetes: + description: Kubernetes contains configuration for Kubernetes + components related to this worker pool. + properties: + kubelet: + description: |- + Kubelet contains configuration settings for all kubelets of this worker pool. + If set, all `spec.kubernetes.kubelet` settings will be overwritten for this worker pool (no merge of settings). + properties: + containerLogMaxFiles: + description: Maximum number of container log files + that can be present for a container. + format: int32 + type: integer + containerLogMaxSize: + anyOf: + - type: integer + - type: string + description: |- + A quantity defines the maximum size of the container log file before it is rotated. For example: "5Mi" or "256Ki". + Default: 100Mi + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + cpuCFSQuota: + description: CPUCFSQuota allows you to disable/enable + CPU throttling for Pods. + type: boolean + cpuManagerPolicy: + description: 'CPUManagerPolicy allows to set alternative + CPU management policies (default: none).' + type: string + evictionHard: + description: |- + EvictionHard describes a set of eviction thresholds (e.g. memory.available<1Gi) that if met would trigger a Pod eviction. + Default: + memory.available: "100Mi/1Gi/5%" + nodefs.available: "5%" + nodefs.inodesFree: "5%" + imagefs.available: "5%" + imagefs.inodesFree: "5%" + properties: + imageFSAvailable: + description: ImageFSAvailable is the threshold + for the free disk space in the imagefs filesystem + (docker images and container writable layers). + type: string + imageFSInodesFree: + description: ImageFSInodesFree is the threshold + for the available inodes in the imagefs filesystem. + type: string + memoryAvailable: + description: MemoryAvailable is the threshold + for the free memory on the host server. + type: string + nodeFSAvailable: + description: NodeFSAvailable is the threshold + for the free disk space in the nodefs filesystem + (docker volumes, logs, etc). + type: string + nodeFSInodesFree: + description: NodeFSInodesFree is the threshold + for the available inodes in the nodefs filesystem. + type: string + type: object + evictionMaxPodGracePeriod: + description: |- + EvictionMaxPodGracePeriod describes the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. + Default: 90 + format: int32 + type: integer + evictionMinimumReclaim: + description: |- + EvictionMinimumReclaim configures the amount of resources below the configured eviction threshold that the kubelet attempts to reclaim whenever the kubelet observes resource pressure. + Default: 0 for each resource + properties: + imageFSAvailable: + anyOf: + - type: integer + - type: string + description: ImageFSAvailable is the threshold + for the disk space reclaim in the imagefs + filesystem (docker images and container writable + layers). + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + imageFSInodesFree: + anyOf: + - type: integer + - type: string + description: ImageFSInodesFree is the threshold + for the inodes reclaim in the imagefs filesystem. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + memoryAvailable: + anyOf: + - type: integer + - type: string + description: MemoryAvailable is the threshold + for the memory reclaim on the host server. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + nodeFSAvailable: + anyOf: + - type: integer + - type: string + description: NodeFSAvailable is the threshold + for the disk space reclaim in the nodefs filesystem + (docker volumes, logs, etc). + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + nodeFSInodesFree: + anyOf: + - type: integer + - type: string + description: NodeFSInodesFree is the threshold + for the inodes reclaim in the nodefs filesystem. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + evictionPressureTransitionPeriod: + description: |- + EvictionPressureTransitionPeriod is the duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. + Default: 4m0s + type: string + evictionSoft: + description: |- + EvictionSoft describes a set of eviction thresholds (e.g. memory.available<1.5Gi) that if met over a corresponding grace period would trigger a Pod eviction. + Default: + memory.available: "200Mi/1.5Gi/10%" + nodefs.available: "10%" + nodefs.inodesFree: "10%" + imagefs.available: "10%" + imagefs.inodesFree: "10%" + properties: + imageFSAvailable: + description: ImageFSAvailable is the threshold + for the free disk space in the imagefs filesystem + (docker images and container writable layers). + type: string + imageFSInodesFree: + description: ImageFSInodesFree is the threshold + for the available inodes in the imagefs filesystem. + type: string + memoryAvailable: + description: MemoryAvailable is the threshold + for the free memory on the host server. + type: string + nodeFSAvailable: + description: NodeFSAvailable is the threshold + for the free disk space in the nodefs filesystem + (docker volumes, logs, etc). + type: string + nodeFSInodesFree: + description: NodeFSInodesFree is the threshold + for the available inodes in the nodefs filesystem. + type: string + type: object + evictionSoftGracePeriod: + description: |- + EvictionSoftGracePeriod describes a set of eviction grace periods (e.g. memory.available=1m30s) that correspond to how long a soft eviction threshold must hold before triggering a Pod eviction. + Default: + memory.available: 1m30s + nodefs.available: 1m30s + nodefs.inodesFree: 1m30s + imagefs.available: 1m30s + imagefs.inodesFree: 1m30s + properties: + imageFSAvailable: + description: ImageFSAvailable is the grace period + for the ImageFSAvailable eviction threshold. + type: string + imageFSInodesFree: + description: ImageFSInodesFree is the grace + period for the ImageFSInodesFree eviction + threshold. + type: string + memoryAvailable: + description: MemoryAvailable is the grace period + for the MemoryAvailable eviction threshold. + type: string + nodeFSAvailable: + description: NodeFSAvailable is the grace period + for the NodeFSAvailable eviction threshold. + type: string + nodeFSInodesFree: + description: NodeFSInodesFree is the grace period + for the NodeFSInodesFree eviction threshold. + type: string + type: object + failSwapOn: + description: FailSwapOn makes the Kubelet fail to + start if swap is enabled on the node. (default + true). + type: boolean + featureGates: + additionalProperties: + type: boolean + description: FeatureGates contains information about + enabled feature gates. + type: object + imageGCHighThresholdPercent: + description: |- + ImageGCHighThresholdPercent describes the percent of the disk usage which triggers image garbage collection. + Default: 50 + format: int32 + type: integer + imageGCLowThresholdPercent: + description: |- + ImageGCLowThresholdPercent describes the percent of the disk to which garbage collection attempts to free. + Default: 40 + format: int32 + type: integer + imageMaximumGCAge: + description: |- + ImageMaximumGCAge is the maximum age of an unused image before it can be garbage collected. + Default: 0s + type: string + imageMinimumGCAge: + description: |- + ImageMinimumGCAge is the minimum age of an unused image before it can be garbage collected. + Default: 2m0s + type: string + imagePullCredentialsVerificationPolicy: + description: |- + ImagePullCredentialsVerificationPolicy determines how credentials should be verified when pulling images that + already exist on the node. It corresponds to the kubelet's `imagePullCredentialsVerificationPolicy` field and is only + effective for Kubernetes versions >= 1.35. May be one of {"NeverVerify", "NeverVerifyPreloadedImages", + "NeverVerifyAllowlistedImages", "AlwaysVerify"}. Defaults to "NeverVerifyPreloadedImages" (the kubelet default). + type: string + kubeReserved: + description: |- + KubeReserved is the configuration for resources reserved for kubernetes node components (mainly kubelet and container runtime). + When updating these values, be aware that cgroup resizes may not succeed on active worker nodes. Look for the NodeAllocatableEnforced event to determine if the configuration was applied. + Default: cpu=80m,memory=1Gi,pid=20k + properties: + cpu: + anyOf: + - type: integer + - type: string + description: CPU is the reserved cpu. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + ephemeralStorage: + anyOf: + - type: integer + - type: string + description: EphemeralStorage is the reserved + ephemeral-storage. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + memory: + anyOf: + - type: integer + - type: string + description: Memory is the reserved memory. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + pid: + anyOf: + - type: integer + - type: string + description: PID is the reserved process-ids. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + maxParallelImagePulls: + description: |- + MaxParallelImagePulls describes the maximum number of image pulls in parallel. The value must be a positive number. + This field cannot be set if SerializeImagePulls (pull one image at a time) is set to true. + Setting it to nil means no limit. + Default: nil + format: int32 + type: integer + maxPods: + description: |- + MaxPods is the maximum number of Pods that are allowed by the Kubelet. + Default: 110 + format: int32 + type: integer + memorySwap: + description: MemorySwap configures swap memory available + to container workloads. + properties: + swapBehavior: + description: |- + SwapBehavior configures swap memory available to container workloads. May be one of {"NoSwap", "LimitedSwap"} + defaults to: LimitedSwap + type: string + type: object + podPidsLimit: + description: PodPIDsLimit is the maximum number + of process IDs per pod allowed by the kubelet. + format: int64 + type: integer + preloadedImagesVerificationAllowlist: + description: |- + PreloadedImagesVerificationAllowlist specifies a list of images that are exempted from credential + re-verification for the "NeverVerifyAllowlistedImages" ImagePullCredentialsVerificationPolicy. The list accepts a + full path segment wildcard suffix "/*". Only image specs without an image tag or digest must be used. It + corresponds to the kubelet's `preloadedImagesVerificationAllowlist` field and is only effective for Kubernetes versions + >= 1.35. + items: + type: string + type: array + protectKernelDefaults: + description: |- + ProtectKernelDefaults ensures that the kernel tunables are equal to the kubelet defaults. + Defaults to true. + type: boolean + registryBurst: + description: |- + RegistryBurst is the maximum size of bursty pulls, temporarily allows pulls to burst to this number, + while still not exceeding registryPullQPS. The value must not be a negative number. + Only used if registryPullQPS is greater than 0. + Default: 10 + format: int32 + type: integer + registryPullQPS: + description: |- + RegistryPullQPS is the limit of registry pulls per second. The value must not be a negative number. + Setting it to 0 means no limit. + Default: 5 + format: int32 + type: integer + seccompDefault: + description: SeccompDefault enables the use of `RuntimeDefault` + as the default seccomp profile for all workloads. + type: boolean + serializeImagePulls: + description: |- + SerializeImagePulls describes whether the images are pulled one at a time. + Default: true + type: boolean + singleProcessOOMKill: + description: |- + SingleProcessOOMKill, if true, will prevent the `memory.oom.group` flag from being set for container + cgroups in cgroups v2. This causes processes in the container to be OOM killed individually instead of + as a group. It means that if true, the behavior aligns with the behavior of cgroups v1. + type: boolean + streamingConnectionIdleTimeout: + description: |- + StreamingConnectionIdleTimeout is the maximum time a streaming connection can be idle before the connection is automatically closed. + This field cannot be set lower than "30s" or greater than "4h". + Default: "5m". + type: string + type: object + version: + description: |- + Version is the semantic Kubernetes version to use for the Kubelet in this Worker Group. + If not specified the kubelet version is derived from the global shoot cluster kubernetes version. + version must be equal or lower than the version of the shoot kubernetes version. + Only one minor version difference to other worker groups and global kubernetes version is allowed. + type: string + type: object + labels: + additionalProperties: + type: string + description: Labels is a map of key/value pairs for labels + for all the `Node` objects in this worker pool. + type: object + machine: + description: Machine contains information about the machine + type and image. + properties: + architecture: + description: Architecture is CPU architecture of machines + in this worker pool. + type: string + image: + description: |- + Image holds information about the machine image to use for all nodes of this pool. It will default to the + latest version of the first image stated in the referenced CloudProfile if no value has been provided. + properties: + name: + description: Name is the name of the image. + type: string + providerConfig: + description: ProviderConfig is the shoot's individual + configuration passed to an extension resource. + type: object + x-kubernetes-preserve-unknown-fields: true + version: + description: |- + Version is the version of the shoot's image. + If version is not provided, it will be defaulted to the latest version from the CloudProfile. + type: string + required: + - name + type: object + type: + description: Type is the machine type of the worker + group. + type: string + required: + - type + type: object + machineControllerManager: + description: MachineControllerManagerSettings contains configurations + for different worker-pools. Eg. MachineDrainTimeout, MachineHealthTimeout. + properties: + autoPreserveFailedMachineMax: + description: |- + AutoPreserveFailedMachineMax is the maximum number of machines that can be auto-preserved by MCM for the worker pool. + This value is distributed across zones like Minimum and Maximum. + format: int32 + type: integer + disableHealthTimeout: + description: |- + DisableHealthTimeout if set to true, health timeout will be ignored. Leading to machine never being declared failed. + This is intended to be used only for in-place updates. + type: boolean + inPlaceUpdateTimeout: + description: MachineInPlaceUpdateTimeout is the timeout + after which in-place update is declared failed. + type: string + machineCreationTimeout: + description: MachineCreationTimeout is the period after + which creation of the machine is declared failed. + type: string + machineDrainTimeout: + description: MachineDrainTimeout is the period after + which machine is forcefully deleted. + type: string + machineHealthTimeout: + description: MachineHealthTimeout is the period after + which machine is declared failed. + type: string + machinePreserveTimeout: + description: |- + MachinePreserveTimeout defines the duration after which machine preservation is disabled. + If preservation is disabled while the machine is in the Failed phase, the machine transitions + to the Terminating phase. For machines in any other phase, disabling preservation does not + alter the current phase, and normal behavior and phase transitions continue as usual. + However, the Cluster Autoscaler (CA) may scale down the machine if required. + type: string + maxEvictRetries: + description: MaxEvictRetries are the number of eviction + retries on a pod after which drain is declared failed, + and forceful deletion is triggered. + format: int32 + type: integer + nodeConditions: + description: NodeConditions are the set of conditions + if set to true for the period of MachineHealthTimeout, + machine will be declared failed. + items: + type: string + type: array + type: object + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + MaxSurge is maximum number of machines that are created during an update. + This value is divided by the number of configured zones for a fair distribution. + Defaults to 0 in case of an in-place update. + Defaults to 1 in case of a rolling update. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + MaxUnavailable is the maximum number of machines that can be unavailable during an update. + This value is divided by the number of configured zones for a fair distribution. + Defaults to 1 in case of an in-place update. + Defaults to 0 in case of a rolling update. + x-kubernetes-int-or-string: true + maximum: + description: |- + Maximum is the maximum number of machines to create. + This value is divided by the number of configured zones for a fair distribution. + format: int32 + type: integer + minimum: + description: |- + Minimum is the minimum number of machines to create. + This value is divided by the number of configured zones for a fair distribution. + format: int32 + type: integer + name: + description: Name is the name of the worker group. + type: string + priority: + description: Priority (or weight) is the importance by which + this worker group will be scaled by cluster autoscaling. + format: int32 + type: integer + providerConfig: + description: ProviderConfig is the provider-specific configuration + for this worker pool. + type: object + x-kubernetes-preserve-unknown-fields: true + sysctls: + additionalProperties: + type: string + description: Sysctls is a map of kernel settings to apply + on all machines in this worker pool. + type: object + systemComponents: + description: SystemComponents contains configuration for + system components related to this worker pool + properties: + allow: + description: Allow determines whether the pool should + be allowed to host system components or not (defaults + to true) + type: boolean + required: + - allow + type: object + taints: + description: Taints is a list of taints for all the `Node` + objects in this worker pool. + items: + description: |- + The node this Taint is attached to has the "effect" on + any pod that does not tolerate the Taint. + properties: + effect: + description: |- + Required. The effect of the taint on pods + that do not tolerate the taint. + Valid effects are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Required. The taint key to be applied + to a node. + type: string + timeAdded: + description: TimeAdded represents the time at which + the taint was added. + format: date-time + type: string + value: + description: The taint value corresponding to the + taint key. + type: string + required: + - effect + - key + type: object + type: array + updateStrategy: + description: UpdateStrategy specifies the machine update + strategy for the worker pool. + type: string + volume: + description: Volume contains information about the volume + type and size. + properties: + encrypted: + description: Encrypted determines if the volume should + be encrypted. + type: boolean + name: + description: Name of the volume to make it referenceable. + type: string + size: + description: VolumeSize is the size of the volume. + type: string + type: + description: Type is the type of the volume. + type: string + required: + - size + type: object + zones: + description: |- + Zones is a list of availability zones that are used to evenly distribute this worker pool. Optional + as not every provider may support availability zones. + items: + type: string + type: array + required: + - machine + - maximum + - minimum + - name + type: object + type: array + workersSettings: + description: WorkersSettings contains settings for all workers. + properties: + sshAccess: + description: SSHAccess contains settings regarding ssh access + to the worker nodes. + properties: + enabled: + description: |- + Enabled indicates whether the SSH access to the worker nodes is ensured to be enabled or disabled in systemd. + Defaults to true. + type: boolean + required: + - enabled + type: object + type: object + required: + - type + type: object + purpose: + description: Purpose is the purpose class for this cluster. + type: string + region: + description: Region is a name of a region. This field is immutable. + type: string + resources: + description: Resources holds a list of named resource references that + can be referred to in extension configs by their names. + items: + description: NamedResourceReference is a named reference to a resource. + properties: + name: + description: Name of the resource reference. + type: string + resourceRef: + description: ResourceRef is a reference to a resource. + properties: + apiVersion: + description: apiVersion is the API version of the referent + type: string + kind: + description: 'kind is the kind of the referent; More info: + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'name is the name of the referent; More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + required: + - name + - resourceRef + type: object + type: array + schedulerName: + description: |- + SchedulerName is the name of the responsible scheduler which schedules the shoot. + If not specified, the default scheduler takes over. + This field is immutable. + type: string + secretBindingName: + description: |- + SecretBindingName is the name of a SecretBinding that has a reference to the provider secret. + The credentials inside the provider secret will be used to create the shoot in the respective account. + The field is mutually exclusive with CredentialsBindingName. + This field is immutable. + + Deprecated: Use CredentialsBindingName instead. See https://github.com/gardener/gardener/blob/master/docs/usage/shoot-operations/secretbinding-to-credentialsbinding-migration.md for migration instructions. + type: string + seedName: + description: SeedName is the name of the seed cluster that runs the + control plane of the Shoot. + type: string + seedSelector: + description: |- + SeedSelector is an optional selector which must match a seed's labels for the shoot to be scheduled on that seed. + Once the shoot is assigned to a seed, the selector can only be changed later if the new one still matches the assigned seed. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + providerTypes: + description: Providers is optional and can be used by restricting + seeds by their provider type. '*' can be used to enable seeds + regardless of their provider type. + items: + type: string + type: array + type: object + x-kubernetes-map-type: atomic + systemComponents: + description: SystemComponents contains the settings of system components + in the control or data plane of the Shoot cluster. + properties: + coreDNS: + description: CoreDNS contains the settings of the Core DNS components + running in the data plane of the Shoot cluster. + properties: + autoscaling: + description: Autoscaling contains the settings related to + autoscaling of the Core DNS components running in the data + plane of the Shoot cluster. + properties: + mode: + description: |- + The mode of the autoscaling to be used for the Core DNS components running in the data plane of the Shoot cluster. + Supported values are `horizontal` and `cluster-proportional`. + type: string + required: + - mode + type: object + rewriting: + description: Rewriting contains the setting related to rewriting + of requests, which are obviously incorrect due to the unnecessary + application of the search path. + properties: + commonSuffixes: + description: CommonSuffixes are expected to be the suffix + of a fully qualified domain name. Each suffix should + contain at least one or two dots ('.') to prevent accidental + clashes. + items: + type: string + type: array + type: object + type: object + nodeLocalDNS: + description: NodeLocalDNS contains the settings of the node local + DNS components running in the data plane of the Shoot cluster. + properties: + disableForwardToUpstreamDNS: + description: |- + DisableForwardToUpstreamDNS indicates whether requests from node local DNS to upstream DNS should be disabled. + Default, if unspecified, is to forward requests for external domains to upstream DNS + type: boolean + enabled: + description: Enabled indicates whether node local DNS is enabled + or not. + type: boolean + forceTCPToClusterDNS: + description: |- + ForceTCPToClusterDNS indicates whether the connection from the node local DNS to the cluster DNS (Core DNS) will be forced to TCP or not. + Default, if unspecified, is to enforce TCP. + type: boolean + forceTCPToUpstreamDNS: + description: |- + ForceTCPToUpstreamDNS indicates whether the connection from the node local DNS to the upstream DNS (infrastructure DNS) will be forced to TCP or not. + Default, if unspecified, is to enforce TCP. + type: boolean + required: + - enabled + type: object + type: object + tolerations: + description: Tolerations contains the tolerations for taints on seed + clusters. + items: + description: Toleration is a toleration for a seed taint. + properties: + key: + description: Key is the toleration key to be applied to a project + or shoot. + type: string + value: + description: Value is the toleration value corresponding to + the toleration key. + type: string + required: + - key + type: object + type: array + required: + - kubernetes + - provider + - region + type: object + status: + description: Most recently observed status of the Shoot cluster. + properties: + advertisedAddresses: + description: |- + List of addresses that are relevant to the shoot. + These include the Kube API server address and also the service account issuer. + items: + description: ShootAdvertisedAddress contains information for the + shoot's Kube API server. + properties: + application: + description: Application is the name of the application this + address belongs to. Used by UI clients. + type: string + name: + description: Name of the advertised address. e.g. external + type: string + url: + description: The URL of the API Server. e.g. https://api.foo.bar + or https://1.2.3.4 + type: string + required: + - name + - url + type: object + type: array + clusterIdentity: + description: ClusterIdentity is the identity of the Shoot cluster. + This field is immutable. + type: string + conditions: + description: Conditions represents the latest available observations + of a Shoots's current state. + items: + description: Condition holds the information about the state of + a resource. + properties: + codes: + description: Well-defined error codes in case the condition + reports a problem. + items: + description: ErrorCode is a string alias. + type: string + type: array + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + lastUpdateTime: + description: Last time the condition was updated. + format: date-time + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of the condition. + type: string + required: + - lastTransitionTime + - lastUpdateTime + - message + - reason + - status + - type + type: object + type: array + constraints: + description: Constraints represents conditions of a Shoot's current + state that constraint some operations on it. + items: + description: Condition holds the information about the state of + a resource. + properties: + codes: + description: Well-defined error codes in case the condition + reports a problem. + items: + description: ErrorCode is a string alias. + type: string + type: array + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + lastUpdateTime: + description: Last time the condition was updated. + format: date-time + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of the condition. + type: string + required: + - lastTransitionTime + - lastUpdateTime + - message + - reason + - status + - type + type: object + type: array + credentials: + description: Credentials contains information about the shoot credentials. + properties: + encryptionAtRest: + description: EncryptionAtRest contains information about Shoot + data encryption at rest. + properties: + provider: + description: Provider contains information about Shoot encryption + provider. + properties: + type: + description: Type is the used encryption provider type. + type: string + required: + - type + type: object + resources: + description: |- + Resources is the list of resources in the Shoot which are currently encrypted. + Secrets are encrypted by default and are not part of the list. + See https://github.com/gardener/gardener/blob/master/docs/usage/security/etcd_encryption_config.md for more details. + items: + type: string + type: array + required: + - provider + type: object + rotation: + description: Rotation contains information about the credential + rotations. + properties: + certificateAuthorities: + description: CertificateAuthorities contains information about + the certificate authority credential rotation. + properties: + lastCompletionTime: + description: |- + LastCompletionTime is the most recent time when the certificate authority credential rotation was successfully + completed. + format: date-time + type: string + lastCompletionTriggeredTime: + description: |- + LastCompletionTriggeredTime is the recent time when the certificate authority credential rotation completion was + triggered. + format: date-time + type: string + lastInitiationFinishedTime: + description: |- + LastInitiationFinishedTime is the recent time when the certificate authority credential rotation initiation was + completed. + format: date-time + type: string + lastInitiationTime: + description: LastInitiationTime is the most recent time + when the certificate authority credential rotation was + initiated. + format: date-time + type: string + pendingWorkersRollouts: + description: |- + PendingWorkersRollouts contains the name of a worker pool and the initiation time of their last rollout due to + credentials rotation. + items: + description: PendingWorkersRollout contains the name + of a worker pool and the initiation time of their + last rollout. + properties: + lastInitiationTime: + description: LastInitiationTime is the most recent + time when the worker rollout was initiated. + format: date-time + type: string + name: + description: Name is the name of a worker pool. + type: string + required: + - name + type: object + type: array + phase: + description: Phase describes the phase of the certificate + authority credential rotation. + type: string + required: + - phase + type: object + etcdEncryptionKey: + description: ETCDEncryptionKey contains information about + the ETCD encryption key credential rotation. + properties: + autoCompleteAfterPrepared: + description: |- + AutoCompleteAfterPrepared indicates whether the current ETCD encryption key rotation should be auto completed after the preparation phase has finished. + Such rotation can be triggered by the `rotate-etcd-encryption-key` annotation. + This field is needed while we support two types of key rotations: two-operation and single operation rotation. + + Deprecated: This field will be removed in a future release. The field will be no longer needed with + the removal `rotate-etcd-encryption-key-start` & `rotate-etcd-encryption-key-complete` annotations. + type: boolean + lastCompletionTime: + description: |- + LastCompletionTime is the most recent time when the ETCD encryption key credential rotation was successfully + completed. + format: date-time + type: string + lastCompletionTriggeredTime: + description: |- + LastCompletionTriggeredTime is the recent time when the ETCD encryption key credential rotation completion was + triggered. + format: date-time + type: string + lastInitiationFinishedTime: + description: |- + LastInitiationFinishedTime is the recent time when the ETCD encryption key credential rotation initiation was + completed. + format: date-time + type: string + lastInitiationTime: + description: LastInitiationTime is the most recent time + when the ETCD encryption key credential rotation was + initiated. + format: date-time + type: string + phase: + description: Phase describes the phase of the ETCD encryption + key credential rotation. + type: string + required: + - phase + type: object + observability: + description: Observability contains information about the + observability credential rotation. + properties: + lastCompletionTime: + description: LastCompletionTime is the most recent time + when the observability credential rotation was successfully + completed. + format: date-time + type: string + lastInitiationTime: + description: LastInitiationTime is the most recent time + when the observability credential rotation was initiated. + format: date-time + type: string + type: object + serviceAccountKey: + description: ServiceAccountKey contains information about + the service account key credential rotation. + properties: + lastCompletionTime: + description: |- + LastCompletionTime is the most recent time when the service account key credential rotation was successfully + completed. + format: date-time + type: string + lastCompletionTriggeredTime: + description: |- + LastCompletionTriggeredTime is the recent time when the service account key credential rotation completion was + triggered. + format: date-time + type: string + lastInitiationFinishedTime: + description: |- + LastInitiationFinishedTime is the recent time when the service account key credential rotation initiation was + completed. + format: date-time + type: string + lastInitiationTime: + description: LastInitiationTime is the most recent time + when the service account key credential rotation was + initiated. + format: date-time + type: string + pendingWorkersRollouts: + description: |- + PendingWorkersRollouts contains the name of a worker pool and the initiation time of their last rollout due to + credentials rotation. + items: + description: PendingWorkersRollout contains the name + of a worker pool and the initiation time of their + last rollout. + properties: + lastInitiationTime: + description: LastInitiationTime is the most recent + time when the worker rollout was initiated. + format: date-time + type: string + name: + description: Name is the name of a worker pool. + type: string + required: + - name + type: object + type: array + phase: + description: Phase describes the phase of the service + account key credential rotation. + type: string + required: + - phase + type: object + sshKeypair: + description: SSHKeypair contains information about the ssh-keypair + credential rotation. + properties: + lastCompletionTime: + description: LastCompletionTime is the most recent time + when the ssh-keypair credential rotation was successfully + completed. + format: date-time + type: string + lastInitiationTime: + description: LastInitiationTime is the most recent time + when the ssh-keypair credential rotation was initiated. + format: date-time + type: string + type: object + type: object + type: object + gardener: + description: Gardener holds information about the Gardener which last + acted on the Shoot. + properties: + id: + description: ID is the container id of the Gardener which last + acted on a resource. + type: string + name: + description: Name is the hostname (pod name) of the Gardener which + last acted on a resource. + type: string + version: + description: Version is the version of the Gardener which last + acted on a resource. + type: string + required: + - id + - name + - version + type: object + hibernated: + description: IsHibernated indicates whether the Shoot is currently + hibernated. + type: boolean + inPlaceUpdates: + description: InPlaceUpdates contains information about in-place updates + for the Shoot workers. + properties: + pendingWorkerUpdates: + description: PendingWorkerUpdates contains information about worker + pools pending in-place updates. + properties: + autoInPlaceUpdate: + description: AutoInPlaceUpdate contains the names of the pending + worker pools with strategy AutoInPlaceUpdate. + items: + type: string + type: array + manualInPlaceUpdate: + description: ManualInPlaceUpdate contains the names of the + pending worker pools with strategy ManualInPlaceUpdate. + items: + type: string + type: array + type: object + type: object + lastErrors: + description: LastErrors holds information about the last occurred + error(s) during an operation. + items: + description: LastError indicates the last occurred error for an + operation on a resource. + properties: + codes: + description: Well-defined error codes of the last error(s). + items: + description: ErrorCode is a string alias. + type: string + type: array + description: + description: A human readable message indicating details about + the last error. + type: string + lastUpdateTime: + description: Last time the error was reported + format: date-time + type: string + taskID: + description: ID of the task which caused this last error + type: string + required: + - description + type: object + type: array + lastHibernationTriggerTime: + description: |- + LastHibernationTriggerTime indicates the last time when the hibernation controller + managed to change the hibernation settings of the cluster + format: date-time + type: string + lastMaintenance: + description: LastMaintenance holds information about the last maintenance + operations on the Shoot. + properties: + description: + description: A human-readable message containing details about + the operations performed in the last maintenance. + type: string + failureReason: + description: FailureReason holds the information about the last + maintenance operation failure reason. + type: string + state: + description: Status of the last maintenance operation, one of + Processing, Succeeded, Error. + type: string + triggeredTime: + description: TriggeredTime is the time when maintenance was triggered. + format: date-time + type: string + required: + - description + - state + - triggeredTime + type: object + lastOperation: + description: LastOperation holds information about the last operation + on the Shoot. + properties: + description: + description: A human readable message indicating details about + the last operation. + type: string + lastUpdateTime: + description: Last time the operation state transitioned from one + to another. + format: date-time + type: string + progress: + description: The progress in percentage (0-100) of the last operation. + format: int32 + type: integer + state: + description: Status of the last operation, one of Aborted, Processing, + Succeeded, Error, Failed. + type: string + type: + description: Type of the last operation, one of Create, Reconcile, + Delete, Migrate, Restore. + type: string + required: + - description + - lastUpdateTime + - progress + - state + - type + type: object + liveMigration: + description: LiveMigration contains information about an ongoing live + control plane migration of the Shoot. + properties: + conditions: + description: Conditions represents the progress of the live migration, + one condition per migration step. + items: + description: Condition holds the information about the state + of a resource. + properties: + codes: + description: Well-defined error codes in case the condition + reports a problem. + items: + description: ErrorCode is a string alias. + type: string + type: array + lastTransitionTime: + description: Last time the condition transitioned from one + status to another. + format: date-time + type: string + lastUpdateTime: + description: Last time the condition was updated. + format: date-time + type: string + message: + description: A human readable message indicating details + about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of the condition. + type: string + required: + - lastTransitionTime + - lastUpdateTime + - message + - reason + - status + - type + type: object + type: array + type: object + manualWorkerPoolRollout: + description: ManualWorkerPoolRollout contains information about the + worker pool rollout progress. + properties: + pendingWorkersRollouts: + description: PendingWorkersRollouts contains the names of the + worker pools that are still pending rollout. + items: + description: PendingWorkersRollout contains the name of a worker + pool and the initiation time of their last rollout. + properties: + lastInitiationTime: + description: LastInitiationTime is the most recent time + when the worker rollout was initiated. + format: date-time + type: string + name: + description: Name is the name of a worker pool. + type: string + required: + - name + type: object + type: array + type: object + migrationStartTime: + description: MigrationStartTime is the time when a migration to a + different seed was initiated. + format: date-time + type: string + networking: + description: Networking contains information about cluster networking + such as CIDRs. + properties: + egressCIDRs: + description: |- + EgressCIDRs is a list of CIDRs used by the shoot as the source IP for egress traffic as reported by the used + Infrastructure extension controller. For certain environments the egress IPs may not be stable in which case the + extension controller may opt to not populate this field. + items: + type: string + type: array + nodes: + description: Nodes are the CIDRs of the node network. + items: + type: string + type: array + pods: + description: Pods are the CIDRs of the pod network. + items: + type: string + type: array + services: + description: Services are the CIDRs of the service network. + items: + type: string + type: array + type: object + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Shoot. It corresponds to the + Shoot's generation, which is updated on mutation by the API Server. + format: int64 + type: integer + retryCycleStartTime: + description: |- + RetryCycleStartTime is the start time of the last retry cycle (used to determine how often an operation + must be retried until we give up). + format: date-time + type: string + seedName: + description: |- + SeedName is the name of the seed cluster that runs the control plane of the Shoot. This value is only written + after a successful create/reconcile operation. It will be used when control planes are moved between Seeds. + type: string + technicalID: + description: |- + TechnicalID is a unique technical ID for this Shoot. It is used for the infrastructure resources, and + basically everything that is related to this particular Shoot. For regular shoot clusters, this is also the name + of the namespace in the seed cluster running the shoot's control plane. This field is immutable. + type: string + uid: + description: |- + UID is a unique identifier for the Shoot cluster to avoid portability between Kubernetes clusters. + It is used to compute unique hashes. This field is immutable. + type: string + required: + - gardener + - hibernated + - technicalID + - uid + type: object + type: object + served: true + storage: true