diff --git a/Makefile.version.aarch64.var b/Makefile.version.aarch64.var index 88093b147d..ef4b5ca48c 100644 --- a/Makefile.version.aarch64.var +++ b/Makefile.version.aarch64.var @@ -1 +1 @@ -OCP_VERSION := 4.22.0-0.nightly-arm64-2026-09-10-031406 +OCP_VERSION := 4.22.0-0.nightly-arm64-2026-09-14-021803 diff --git a/Makefile.version.x86_64.var b/Makefile.version.x86_64.var index 2ef2b827c3..d38def3aa6 100644 --- a/Makefile.version.x86_64.var +++ b/Makefile.version.x86_64.var @@ -1 +1 @@ -OCP_VERSION := 4.22.0-0.nightly-2026-09-09-183927 +OCP_VERSION := 4.22.0-0.nightly-2026-09-13-081542 diff --git a/assets/components/multus/kustomization.aarch64.yaml b/assets/components/multus/kustomization.aarch64.yaml index c21bca87fb..612bd92669 100644 --- a/assets/components/multus/kustomization.aarch64.yaml +++ b/assets/components/multus/kustomization.aarch64.yaml @@ -2,7 +2,7 @@ images: - name: multus-cni-microshift newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev - digest: sha256:e06ba02744e7ebe191a2e7b9204f1f12a64bac3265f03339bcc36e5916b0f18d + digest: sha256:2b95897e40230caf83b2ade3e82b1f4eeeb98defaca24f5f6476a1195db5b682 - name: containernetworking-plugins-microshift newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev - digest: sha256:1fad839c9ed7d1e33ec9383d7bba92b1ef293f076df3f8066771604ca3a30008 + digest: sha256:49bf90d0eef5efbd64fbcdde089c9030ed09023b50f666ef15a4b9a346596584 diff --git a/assets/components/multus/kustomization.x86_64.yaml b/assets/components/multus/kustomization.x86_64.yaml index 1da80e1b4c..a883811364 100644 --- a/assets/components/multus/kustomization.x86_64.yaml +++ b/assets/components/multus/kustomization.x86_64.yaml @@ -2,7 +2,7 @@ images: - name: multus-cni-microshift newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev - digest: sha256:8fd8ba1d57d9a2100f35419fc563135ed84f36024fe11bdaa2f34c290e1759f1 + digest: sha256:b333ffbd8ab5360e70cd081829d4a38429ed9ccbe55ea4bac8219515c711aee6 - name: containernetworking-plugins-microshift newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev - digest: sha256:e933bc71f9d436949d4b98149436f4fa409ceb815f071e3562df608e26ff0107 + digest: sha256:b3ec0ef7380c4e5d2129270293cc5c87a728f972b879f4b885e6dd1a1cb364c3 diff --git a/assets/components/multus/release-multus-aarch64.json b/assets/components/multus/release-multus-aarch64.json index 172b818c63..23a2086b0b 100644 --- a/assets/components/multus/release-multus-aarch64.json +++ b/assets/components/multus/release-multus-aarch64.json @@ -1,9 +1,9 @@ { "release": { - "base": "4.22.0-0.nightly-arm64-2026-09-10-031406" + "base": "4.22.0-0.nightly-arm64-2026-09-14-021803" }, "images": { - "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e06ba02744e7ebe191a2e7b9204f1f12a64bac3265f03339bcc36e5916b0f18d", - "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1fad839c9ed7d1e33ec9383d7bba92b1ef293f076df3f8066771604ca3a30008" + "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:2b95897e40230caf83b2ade3e82b1f4eeeb98defaca24f5f6476a1195db5b682", + "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:49bf90d0eef5efbd64fbcdde089c9030ed09023b50f666ef15a4b9a346596584" } } diff --git a/assets/components/multus/release-multus-x86_64.json b/assets/components/multus/release-multus-x86_64.json index 9e93d14ef7..b4eb096159 100644 --- a/assets/components/multus/release-multus-x86_64.json +++ b/assets/components/multus/release-multus-x86_64.json @@ -1,9 +1,9 @@ { "release": { - "base": "4.22.0-0.nightly-2026-09-09-183927" + "base": "4.22.0-0.nightly-2026-09-13-081542" }, "images": { - "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:8fd8ba1d57d9a2100f35419fc563135ed84f36024fe11bdaa2f34c290e1759f1", - "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e933bc71f9d436949d4b98149436f4fa409ceb815f071e3562df608e26ff0107" + "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b333ffbd8ab5360e70cd081829d4a38429ed9ccbe55ea4bac8219515c711aee6", + "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b3ec0ef7380c4e5d2129270293cc5c87a728f972b879f4b885e6dd1a1cb364c3" } } diff --git a/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml index f1c41bc81f..840955ee9a 100644 --- a/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml @@ -6,9 +6,10 @@ metadata: helm.sh/resource-policy: keep labels: app: cert-manager + app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.18.4 + app.kubernetes.io/version: v1.20.3 name: certificaterequests.cert-manager.io spec: group: cert-manager.io @@ -25,13 +26,13 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Approved")].status + - jsonPath: .status.conditions[?(@.type == "Approved")].status name: Approved type: string - - jsonPath: .status.conditions[?(@.type=="Denied")].status + - jsonPath: .status.conditions[?(@.type == "Denied")].status name: Denied type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].status + - jsonPath: .status.conditions[?(@.type == "Ready")].status name: Ready type: string - jsonPath: .spec.issuerRef.name @@ -40,7 +41,7 @@ spec: - jsonPath: .spec.username name: Requester type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message + - jsonPath: .status.conditions[?(@.type == "Ready")].message name: Status priority: 1 type: string @@ -128,13 +129,17 @@ spec: The `name` field of the reference must always be specified. properties: group: - description: Group of the resource being referred to. + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. type: string kind: - description: Kind of the resource being referred to. + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. type: string name: - description: Name of the resource being referred to. + description: Name of the issuer being referred to. type: string required: - name @@ -224,6 +229,7 @@ spec: - netscape sgc type: string type: array + x-kubernetes-list-type: atomic username: description: |- Username contains the name of the user that created the CertificateRequest. @@ -308,6 +314,10 @@ spec: type: string type: object type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml index 3d4d2536d1..74d51a799b 100644 --- a/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml @@ -6,9 +6,10 @@ metadata: helm.sh/resource-policy: keep labels: app: cert-manager + app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.18.4 + app.kubernetes.io/version: v1.20.3 name: certificates.cert-manager.io spec: group: cert-manager.io @@ -25,7 +26,7 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status + - jsonPath: .status.conditions[?(@.type == "Ready")].status name: Ready type: string - jsonPath: .spec.secretName @@ -35,7 +36,7 @@ spec: name: Issuer priority: 1 type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message + - jsonPath: .status.conditions[?(@.type == "Ready")].message name: Status priority: 1 type: string @@ -96,6 +97,7 @@ spec: - type type: object type: array + x-kubernetes-list-type: atomic commonName: description: |- Requested common name X509 certificate subject attribute. @@ -111,6 +113,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic duration: description: |- Requested 'duration' (i.e. lifetime) of the Certificate. Note that the @@ -126,6 +129,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic encodeUsagesInRequest: description: |- Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR. @@ -138,6 +142,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic isCA: description: |- Requested basic constraints isCA value. @@ -158,13 +163,17 @@ spec: The `name` field of the reference must always be specified. properties: group: - description: Group of the resource being referred to. + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. type: string kind: - description: Kind of the resource being referred to. + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. type: string name: - description: Name of the resource being referred to. + description: Name of the issuer being referred to. type: string required: - name @@ -324,11 +333,13 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic emailAddresses: description: EmailAddresses is a list of Email Addresses that are permitted or excluded. items: type: string type: array + x-kubernetes-list-type: atomic ipRanges: description: |- IPRanges is a list of IP Ranges that are permitted or excluded. @@ -336,11 +347,13 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic uriDomains: description: URIDomains is a list of URI domains that are permitted or excluded. items: type: string type: array + x-kubernetes-list-type: atomic type: object permitted: description: Permitted contains the constraints in which the names must be located. @@ -350,11 +363,13 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic emailAddresses: description: EmailAddresses is a list of Email Addresses that are permitted or excluded. items: type: string type: array + x-kubernetes-list-type: atomic ipRanges: description: |- IPRanges is a list of IP Ranges that are permitted or excluded. @@ -362,11 +377,13 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic uriDomains: description: URIDomains is a list of URI domains that are permitted or excluded. items: type: string type: array + x-kubernetes-list-type: atomic type: object type: object otherNames: @@ -390,6 +407,7 @@ spec: type: string type: object type: array + x-kubernetes-list-type: atomic privateKey: description: |- Private key options. These include the key algorithm and size, the used @@ -435,9 +453,6 @@ spec: will be generated whenever a re-issuance occurs. Default is `Always`. The default was changed from `Never` to `Always` in cert-manager >=v1.18.0. - The new default can be disabled by setting the - `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on - the controller component. enum: - Never - Always @@ -555,31 +570,37 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic localities: description: Cities to be used on the Certificate. items: type: string type: array + x-kubernetes-list-type: atomic organizationalUnits: description: Organizational Units to be used on the Certificate. items: type: string type: array + x-kubernetes-list-type: atomic organizations: description: Organizations to be used on the Certificate. items: type: string type: array + x-kubernetes-list-type: atomic postalCodes: description: Postal codes to be used on the Certificate. items: type: string type: array + x-kubernetes-list-type: atomic provinces: description: State/Provinces to be used on the Certificate. items: type: string type: array + x-kubernetes-list-type: atomic serialNumber: description: Serial number to be used on the Certificate. type: string @@ -588,12 +609,14 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic type: object uris: description: Requested URI subject alternative names. items: type: string type: array + x-kubernetes-list-type: atomic usages: description: |- Requested key usages and extended key usages. @@ -659,6 +682,7 @@ spec: - netscape sgc type: string type: array + x-kubernetes-list-type: atomic required: - issuerRef - secretName @@ -784,6 +808,10 @@ spec: type: integer type: object type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml index 11e7489ded..d7207f0013 100644 --- a/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml @@ -6,9 +6,10 @@ metadata: helm.sh/resource-policy: keep labels: app: cert-manager + app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.18.4 + app.kubernetes.io/version: v1.20.3 name: challenges.acme.cert-manager.io spec: group: acme.cert-manager.io @@ -81,13 +82,17 @@ spec: Challenge will be marked as failed. properties: group: - description: Group of the resource being referred to. + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. type: string kind: - description: Kind of the resource being referred to. + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. type: string name: - description: Name of the resource being referred to. + description: Name of the issuer being referred to. type: string required: - name @@ -280,6 +285,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -403,9 +424,15 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string + protocol: + description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). + enum: + - TCP + - UDP + type: string tsigAlgorithm: description: |- The TSIG Algorithm configured in the DNS supporting RFC2136. Used only @@ -447,8 +474,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -456,8 +483,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -497,6 +524,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string @@ -545,8 +573,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -773,6 +801,7 @@ spec: - name type: object type: array + x-kubernetes-list-type: atomic podTemplate: description: |- Optional pod template used to configure the ACME challenge solver pods @@ -1068,7 +1097,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1083,7 +1111,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1244,7 +1271,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1259,7 +1285,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1348,8 +1373,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -1413,7 +1438,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1428,7 +1452,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1589,7 +1612,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1604,7 +1626,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1702,6 +1723,9 @@ spec: type: object x-kubernetes-map-type: atomic type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: additionalProperties: type: string @@ -1713,6 +1737,40 @@ spec: priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context properties: @@ -1828,6 +1886,7 @@ spec: format: int64 type: integer type: array + x-kubernetes-list-type: atomic sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported @@ -1847,6 +1906,7 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic type: object serviceAccountName: description: If specified, the pod's service account @@ -1871,9 +1931,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -1890,6 +1951,7 @@ spec: type: string type: object type: array + x-kubernetes-list-type: atomic type: object type: object serviceType: @@ -2247,7 +2309,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2262,7 +2323,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2423,7 +2483,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2438,7 +2497,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2527,8 +2585,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -2592,7 +2650,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2607,7 +2664,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2768,7 +2824,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2783,7 +2838,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2881,6 +2935,9 @@ spec: type: object x-kubernetes-map-type: atomic type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: additionalProperties: type: string @@ -2892,6 +2949,40 @@ spec: priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context properties: @@ -3007,6 +3098,7 @@ spec: format: int64 type: integer type: array + x-kubernetes-list-type: atomic sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported @@ -3026,6 +3118,7 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic type: object serviceAccountName: description: If specified, the pod's service account @@ -3050,9 +3143,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3069,6 +3163,7 @@ spec: type: string type: object type: array + x-kubernetes-list-type: atomic type: object type: object serviceType: @@ -3098,6 +3193,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic dnsZones: description: |- List of DNSZones that this solver will be used to solve. @@ -3112,6 +3208,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string @@ -3197,6 +3294,10 @@ spec: - metadata - spec type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml index 982e361675..7bb683271b 100644 --- a/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml @@ -6,9 +6,10 @@ metadata: helm.sh/resource-policy: keep labels: app: cert-manager + app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.18.4 + app.kubernetes.io/version: v1.20.3 name: clusterissuers.cert-manager.io spec: group: cert-manager.io @@ -24,10 +25,10 @@ spec: scope: Cluster versions: - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status + - jsonPath: .status.conditions[?(@.type == "Ready")].status name: Ready type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message + - jsonPath: .status.conditions[?(@.type == "Ready")].message name: Status priority: 1 type: string @@ -397,6 +398,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -520,9 +537,15 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string + protocol: + description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). + enum: + - TCP + - UDP + type: string tsigAlgorithm: description: |- The TSIG Algorithm configured in the DNS supporting RFC2136. Used only @@ -564,8 +587,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -573,8 +596,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -614,6 +637,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string @@ -662,8 +686,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -890,6 +914,7 @@ spec: - name type: object type: array + x-kubernetes-list-type: atomic podTemplate: description: |- Optional pod template used to configure the ACME challenge solver pods @@ -1185,7 +1210,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1200,7 +1224,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1361,7 +1384,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1376,7 +1398,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1465,8 +1486,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -1530,7 +1551,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1545,7 +1565,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1706,7 +1725,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1721,7 +1739,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1819,6 +1836,9 @@ spec: type: object x-kubernetes-map-type: atomic type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: additionalProperties: type: string @@ -1830,6 +1850,40 @@ spec: priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context properties: @@ -1945,6 +1999,7 @@ spec: format: int64 type: integer type: array + x-kubernetes-list-type: atomic sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported @@ -1964,6 +2019,7 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic type: object serviceAccountName: description: If specified, the pod's service account @@ -1988,9 +2044,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -2007,6 +2064,7 @@ spec: type: string type: object type: array + x-kubernetes-list-type: atomic type: object type: object serviceType: @@ -2364,7 +2422,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2379,7 +2436,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2540,7 +2596,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2555,7 +2610,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2644,8 +2698,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -2709,7 +2763,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2724,7 +2777,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2885,7 +2937,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2900,7 +2951,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2998,6 +3048,9 @@ spec: type: object x-kubernetes-map-type: atomic type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: additionalProperties: type: string @@ -3009,6 +3062,40 @@ spec: priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context properties: @@ -3124,6 +3211,7 @@ spec: format: int64 type: integer type: array + x-kubernetes-list-type: atomic sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported @@ -3143,6 +3231,7 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic type: object serviceAccountName: description: If specified, the pod's service account @@ -3167,9 +3256,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3186,6 +3276,7 @@ spec: type: string type: object type: array + x-kubernetes-list-type: atomic type: object type: object serviceType: @@ -3215,6 +3306,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic dnsZones: description: |- List of DNSZones that this solver will be used to solve. @@ -3229,6 +3321,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string @@ -3239,6 +3332,7 @@ spec: type: object type: object type: array + x-kubernetes-list-type: atomic required: - privateKeySecretRef - server @@ -3257,6 +3351,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic issuingCertificateURLs: description: |- IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates @@ -3265,6 +3360,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic ocspServers: description: |- The OCSP server list is an X.509 v3 extension that defines a list of @@ -3275,6 +3371,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic secretName: description: |- SecretName is the name of the secret used to sign Certificates issued @@ -3296,6 +3393,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic type: object vault: description: |- @@ -3418,11 +3516,12 @@ spec: properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token - consisting of the issuer's namespace and name is always included. + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. items: type: string type: array + x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string @@ -3546,16 +3645,16 @@ spec: type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a Venafi TPP - or Venafi Cloud policy zone. + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. properties: cloud: description: |- - Cloud specifies the Venafi cloud configuration settings. - Only one of TPP or Cloud may be specified. + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. properties: key: description: |- @@ -3573,7 +3672,7 @@ spec: type: object url: description: |- - URL is the base URL for Venafi Cloud. + URL is the base URL for CyberArk Certificate Manager SaaS. Defaults to "https://api.venafi.cloud/". type: string required: @@ -3581,13 +3680,13 @@ spec: type: object tpp: description: |- - TPP specifies Trust Protection Platform configuration settings. - Only one of TPP or Cloud may be specified. + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. format: byte @@ -3595,7 +3694,7 @@ spec: caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the TPP server. + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. @@ -3616,7 +3715,7 @@ spec: type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. properties: @@ -3630,7 +3729,7 @@ spec: type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, for example: "https://tpp.example.com/vedsdk". type: string required: @@ -3639,8 +3738,8 @@ spec: type: object zone: description: |- - Zone is the Venafi Policy Zone to use for this issuer. - All requests made to the Venafi platform will be restricted by the named + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named zone policy. This field is required. type: string diff --git a/assets/optional/cert-manager/crd/bases/customresourcedefinition_bundles.trust.cert-manager.io.yml b/assets/optional/cert-manager/crd/bases/customresourcedefinition_bundles.trust.cert-manager.io.yml new file mode 100644 index 0000000000..a938502c13 --- /dev/null +++ b/assets/optional/cert-manager/crd/bases/customresourcedefinition_bundles.trust.cert-manager.io.yml @@ -0,0 +1,477 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: "bundles.trust.cert-manager.io" + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/name: cert-manager-trust-manager + app.kubernetes.io/instance: cert-manager-trust-manager + app.kubernetes.io/version: "v0.20.3" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +spec: + group: trust.cert-manager.io + names: + kind: Bundle + listKind: BundleList + plural: bundles + singular: bundle + scope: Cluster + versions: + - additionalPrinterColumns: + - description: Bundle ConfigMap Target Key + jsonPath: .spec.target.configMap.key + name: ConfigMap Target + type: string + - description: Bundle Secret Target Key + jsonPath: .spec.target.secret.key + name: Secret Target + type: string + - description: Bundle has been synced + jsonPath: .status.conditions[?(@.type == "Synced")].status + name: Synced + type: string + - description: Reason Bundle has Synced status + jsonPath: .status.conditions[?(@.type == "Synced")].reason + name: Reason + type: string + - description: Timestamp Bundle was created + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Desired state of the Bundle resource. + properties: + sources: + description: Sources is a set of references to data whose data will sync to the target. + items: + description: |- + BundleSource is the set of sources whose data will be appended and synced to + the BundleTarget in all Namespaces. + properties: + configMap: + description: |- + ConfigMap is a reference (by name) to a ConfigMap's `data` key(s), or to a + list of ConfigMap's `data` key(s) using label selector, in the trust Namespace. + properties: + includeAllKeys: + description: |- + IncludeAllKeys is a flag to include all keys in the object's `data` field to be used. False by default. + This field must not be true when `Key` is set. + type: boolean + key: + description: Key of the entry in the object's `data` field to be used. + minLength: 1 + type: string + name: + description: |- + Name is the name of the source object in the trust Namespace. + This field must be left empty when `selector` is set + minLength: 1 + type: string + selector: + description: |- + Selector is the label selector to use to fetch a list of objects. Must not be set + when `Name` is set. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + x-kubernetes-map-type: atomic + inLine: + description: InLine is a simple string to append as the source data. + type: string + secret: + description: |- + Secret is a reference (by name) to a Secret's `data` key(s), or to a + list of Secret's `data` key(s) using label selector, in the trust Namespace. + properties: + includeAllKeys: + description: |- + IncludeAllKeys is a flag to include all keys in the object's `data` field to be used. False by default. + This field must not be true when `Key` is set. + type: boolean + key: + description: Key of the entry in the object's `data` field to be used. + minLength: 1 + type: string + name: + description: |- + Name is the name of the source object in the trust Namespace. + This field must be left empty when `selector` is set + minLength: 1 + type: string + selector: + description: |- + Selector is the label selector to use to fetch a list of objects. Must not be set + when `Name` is set. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + x-kubernetes-map-type: atomic + useDefaultCAs: + description: |- + UseDefaultCAs, when true, requests the default CA bundle to be used as a source. + Default CAs are available if trust-manager was installed via Helm + or was otherwise set up to include a package-injecting init container by using the + "--default-package-location" flag when starting the trust-manager controller. + If default CAs were not configured at start-up, any request to use the default + CAs will fail. + The version of the default CA package which is used for a Bundle is stored in the + defaultCAPackageVersion field of the Bundle's status field. + type: boolean + type: object + x-kubernetes-map-type: atomic + maxItems: 100 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + target: + description: Target is the target location in all namespaces to sync source data to. + properties: + additionalFormats: + description: AdditionalFormats specifies any additional formats to write to the target + properties: + jks: + description: |- + JKS requests a JKS-formatted binary trust bundle to be written to the target. + The bundle has "changeit" as the default password. + For more information refer to this link https://cert-manager.io/docs/faq/#keystore-passwords + Format is deprecated: Writing JKS is subject for removal. Please migrate to PKCS12. + PKCS#12 trust stores created by trust-manager are compatible with Java. + properties: + key: + description: Key is the key of the entry in the object's `data` field to be used. + minLength: 1 + type: string + password: + default: changeit + description: Password for JKS trust store + maxLength: 128 + minLength: 1 + type: string + required: + - key + type: object + x-kubernetes-map-type: atomic + pkcs12: + description: |- + PKCS12 requests a PKCS12-formatted binary trust bundle to be written to the target. + + The bundle is by default created without a password. + For more information refer to this link https://cert-manager.io/docs/faq/#keystore-passwords + properties: + key: + description: Key is the key of the entry in the object's `data` field to be used. + minLength: 1 + type: string + password: + default: "" + description: Password for PKCS12 trust store + maxLength: 128 + type: string + profile: + description: |- + Profile specifies the certificate encryption algorithms and the HMAC algorithm + used to create the PKCS12 trust store. + + If provided, allowed values are: + `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. + `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. + `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms (e.g. because of company policy). + + Default value is `LegacyRC2` for backward compatibility. + enum: + - LegacyRC2 + - LegacyDES + - Modern2023 + type: string + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + configMap: + description: |- + ConfigMap is the target ConfigMap in Namespaces that all Bundle source + data will be synced to. + properties: + key: + description: Key is the key of the entry in the object's `data` field to be used. + minLength: 1 + type: string + metadata: + description: Metadata is an optional set of labels and annotations to be copied to the target. + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a key value map to be copied to the target. + type: object + labels: + additionalProperties: + type: string + description: Labels is a key value map to be copied to the target. + type: object + type: object + required: + - key + type: object + namespaceSelector: + description: |- + NamespaceSelector will, if set, only sync the target resource in + Namespaces which match the selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + secret: + description: |- + Secret is the target Secret that all Bundle source data will be synced to. + Using Secrets as targets is only supported if enabled at trust-manager startup. + By default, trust-manager has no permissions for writing to secrets and can only read secrets in the trust namespace. + properties: + key: + description: Key is the key of the entry in the object's `data` field to be used. + minLength: 1 + type: string + metadata: + description: Metadata is an optional set of labels and annotations to be copied to the target. + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a key value map to be copied to the target. + type: object + labels: + additionalProperties: + type: string + description: Labels is a key value map to be copied to the target. + type: object + type: object + required: + - key + type: object + type: object + required: + - sources + type: object + status: + description: Status of the Bundle. This is set and managed automatically. + properties: + conditions: + description: |- + List of status conditions to indicate the status of the Bundle. + Known condition types are `Bundle`. + items: + description: Condition contains details for one aspect of the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + defaultCAVersion: + description: |- + DefaultCAPackageVersion, if set and non-empty, indicates the version information + which was retrieved when the set of default CAs was requested in the bundle + source. This should only be set if useDefaultCAs was set to "true" on a source, + and will be the same for the same version of a bundle with identical certificates. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml index 0befddce16..dab8da6d11 100644 --- a/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.18.4 + app.kubernetes.io/version: v1.20.3 name: issuers.cert-manager.io spec: group: cert-manager.io @@ -25,10 +25,10 @@ spec: scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status + - jsonPath: .status.conditions[?(@.type == "Ready")].status name: Ready type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message + - jsonPath: .status.conditions[?(@.type == "Ready")].message name: Status priority: 1 type: string @@ -397,6 +397,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -520,9 +536,15 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string + protocol: + description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). + enum: + - TCP + - UDP + type: string tsigAlgorithm: description: |- The TSIG Algorithm configured in the DNS supporting RFC2136. Used only @@ -564,8 +586,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -573,8 +595,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -614,6 +636,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string @@ -662,8 +685,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -890,6 +913,7 @@ spec: - name type: object type: array + x-kubernetes-list-type: atomic podTemplate: description: |- Optional pod template used to configure the ACME challenge solver pods @@ -1185,7 +1209,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1200,7 +1223,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1361,7 +1383,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1376,7 +1397,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1465,8 +1485,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -1530,7 +1550,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1545,7 +1564,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1706,7 +1724,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1721,7 +1738,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -1819,6 +1835,9 @@ spec: type: object x-kubernetes-map-type: atomic type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: additionalProperties: type: string @@ -1830,6 +1849,40 @@ spec: priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context properties: @@ -1945,6 +1998,7 @@ spec: format: int64 type: integer type: array + x-kubernetes-list-type: atomic sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported @@ -1964,6 +2018,7 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic type: object serviceAccountName: description: If specified, the pod's service account @@ -1988,9 +2043,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -2007,6 +2063,7 @@ spec: type: string type: object type: array + x-kubernetes-list-type: atomic type: object type: object serviceType: @@ -2364,7 +2421,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2379,7 +2435,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2540,7 +2595,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2555,7 +2609,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2644,8 +2697,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -2709,7 +2762,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2724,7 +2776,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2885,7 +2936,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2900,7 +2950,6 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array @@ -2998,6 +3047,9 @@ spec: type: object x-kubernetes-map-type: atomic type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: additionalProperties: type: string @@ -3009,6 +3061,40 @@ spec: priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context properties: @@ -3124,6 +3210,7 @@ spec: format: int64 type: integer type: array + x-kubernetes-list-type: atomic sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported @@ -3143,6 +3230,7 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic type: object serviceAccountName: description: If specified, the pod's service account @@ -3167,9 +3255,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3186,6 +3275,7 @@ spec: type: string type: object type: array + x-kubernetes-list-type: atomic type: object type: object serviceType: @@ -3215,6 +3305,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic dnsZones: description: |- List of DNSZones that this solver will be used to solve. @@ -3229,6 +3320,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string @@ -3239,6 +3331,7 @@ spec: type: object type: object type: array + x-kubernetes-list-type: atomic required: - privateKeySecretRef - server @@ -3257,6 +3350,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic issuingCertificateURLs: description: |- IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates @@ -3265,6 +3359,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic ocspServers: description: |- The OCSP server list is an X.509 v3 extension that defines a list of @@ -3275,6 +3370,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic secretName: description: |- SecretName is the name of the secret used to sign Certificates issued @@ -3296,6 +3392,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic type: object vault: description: |- @@ -3418,11 +3515,12 @@ spec: properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token - consisting of the issuer's namespace and name is always included. + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. items: type: string type: array + x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string @@ -3546,16 +3644,16 @@ spec: type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a Venafi TPP - or Venafi Cloud policy zone. + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. properties: cloud: description: |- - Cloud specifies the Venafi cloud configuration settings. - Only one of TPP or Cloud may be specified. + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. properties: key: description: |- @@ -3573,7 +3671,7 @@ spec: type: object url: description: |- - URL is the base URL for Venafi Cloud. + URL is the base URL for CyberArk Certificate Manager SaaS. Defaults to "https://api.venafi.cloud/". type: string required: @@ -3581,13 +3679,13 @@ spec: type: object tpp: description: |- - TPP specifies Trust Protection Platform configuration settings. - Only one of TPP or Cloud may be specified. + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. format: byte @@ -3595,7 +3693,7 @@ spec: caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the TPP server. + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. @@ -3616,7 +3714,7 @@ spec: type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. properties: @@ -3630,7 +3728,7 @@ spec: type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, for example: "https://tpp.example.com/vedsdk". type: string required: @@ -3639,8 +3737,8 @@ spec: type: object zone: description: |- - Zone is the Venafi Policy Zone to use for this issuer. - All requests made to the Venafi platform will be restricted by the named + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named zone policy. This field is required. type: string diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml index 10bd5254e7..015e301fda 100644 --- a/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.15.0 + controller-gen.kubebuilder.io/version: v0.19.0 name: certmanagers.operator.openshift.io spec: group: operator.openshift.io @@ -37,7 +37,7 @@ spec: metadata: type: object spec: - description: CertManagerSpec defines the desired state of CertManager + description: CertManagerSpec defines the desired state of CertManager. properties: cainjectorConfig: description: |- @@ -60,8 +60,9 @@ spec: in a Container. properties: name: - description: Name of the environment variable. Must be a - C_IDENTIFIER. + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. type: string value: description: |- @@ -119,6 +120,43 @@ spec: - fieldPath type: object x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + default: false + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + required: + - key + - path + - volumeName + type: object + x-kubernetes-map-type: atomic resourceFieldRef: description: |- Selects a resource of the container: only resources limits and requests @@ -251,9 +289,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -303,8 +342,9 @@ spec: in a Container. properties: name: - description: Name of the environment variable. Must be a - C_IDENTIFIER. + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. type: string value: description: |- @@ -362,6 +402,43 @@ spec: - fieldPath type: object x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + default: false + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + required: + - key + - path + - volumeName + type: object + x-kubernetes-map-type: atomic resourceFieldRef: description: |- Selects a resource of the container: only resources limits and requests @@ -494,9 +571,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -630,7 +708,6 @@ spec: If present, only traffic on the specified protocol AND port will be matched. x-kubernetes-int-or-string: true protocol: - default: TCP description: |- protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP. @@ -846,7 +923,7 @@ spec: For OverrideArgs, --config string Path to a file containing a WebhookConfiguration object used to configure the webhook - --dynamic-serving-ca-secret-name string name of the secret used to store the CA that signs serving certificates certificates + --dynamic-serving-ca-secret-name string name of the secret used to store the CA that signs serving certificates --dynamic-serving-ca-secret-namespace string namespace of the secret used to store the CA that signs serving certificates --dynamic-serving-dns-names strings DNS names that should be present on certificates generated by the dynamic serving CA --v Level number for the log level verbosity @@ -861,8 +938,9 @@ spec: in a Container. properties: name: - description: Name of the environment variable. Must be a - C_IDENTIFIER. + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. type: string value: description: |- @@ -920,6 +998,43 @@ spec: - fieldPath type: object x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + default: false + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + required: + - key + - path + - volumeName + type: object + x-kubernetes-map-type: atomic resourceFieldRef: description: |- Selects a resource of the container: only resources limits and requests @@ -1052,9 +1167,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -1076,7 +1192,7 @@ spec: type: object type: object status: - description: CertManagerStatus defines the observed state of CertManager + description: CertManagerStatus defines the observed state of CertManager. properties: conditions: description: conditions is a list of conditions and their status diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml index 99a594ab88..7a47c4fc46 100644 --- a/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.15.0 + controller-gen.kubebuilder.io/version: v0.19.0 labels: app.kubernetes.io/name: istiocsr app.kubernetes.io/part-of: cert-manager-operator @@ -657,8 +657,8 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm @@ -1013,13 +1013,17 @@ spec: This field is immutable once set. properties: group: - description: Group of the resource being referred to. + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. type: string kind: - description: Kind of the resource being referred to. + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. type: string name: - description: Name of the resource being referred to. + description: Name of the issuer being referred to. type: string required: - name @@ -1234,7 +1238,7 @@ spec: Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. - This is an alpha field and requires enabling the + This field depends on the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers. @@ -1331,9 +1335,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -1374,7 +1379,7 @@ spec: type: string conditions: description: conditions holds information about the current state - of the istio-csr agent deployment. + of the operand deployment. items: description: Condition contains details for one aspect of the current state of this API Resource. diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml new file mode 100644 index 0000000000..0a334f47d6 --- /dev/null +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml @@ -0,0 +1,1333 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.19.0 + labels: + app.kubernetes.io/name: trustmanager + app.kubernetes.io/part-of: cert-manager-operator + name: trustmanagers.operator.openshift.io +spec: + group: operator.openshift.io + names: + categories: + - cert-manager-operator + - trust-manager + kind: TrustManager + listKind: TrustManagerList + plural: trustmanagers + shortNames: + - trustmanager + - tm + singular: trustmanager + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].message + name: Message + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + TrustManager describes the configuration and information about the managed trust-manager deployment. + The name must be `cluster` to make TrustManager a singleton, allowing only one instance per cluster. + When a TrustManager CR is created, trust-manager operand is deployed in the cert-manager namespace. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec is the specification of the desired behavior of the + TrustManager. + properties: + controllerConfig: + description: controllerConfig configures the operator's behavior for + resource creation. + properties: + annotations: + additionalProperties: + type: string + description: annotations to apply to all resources created for + the trust-manager deployment. + maxProperties: 25 + minProperties: 0 + type: object + x-kubernetes-map-type: granular + labels: + additionalProperties: + type: string + description: labels to apply to all resources created for the + trust-manager deployment. + maxProperties: 25 + minProperties: 0 + type: object + x-kubernetes-map-type: granular + type: object + trustManagerConfig: + description: trustManagerConfig configures the trust-manager operand's + behavior. + properties: + affinity: + description: |- + affinity defines scheduling constraints for the trust-manager pod. + ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + defaultCAPackage: + description: |- + defaultCAPackage configures the default CA package for trust-manager. + When enabled, the operator will use OpenShift's trusted CA bundle injection mechanism. + properties: + policy: + default: Disabled + description: |- + policy controls whether the default CA package feature is enabled. + When set to "Enabled", the operator will inject OpenShift's trusted CA bundle + into trust-manager, enabling the "useDefaultCAs: true" source in Bundle resources. + When set to "Disabled", no default CA package is configured and Bundles cannot use useDefaultCAs (default behavior). + enum: + - Enabled + - Disabled + type: string + type: object + filterExpiredCertificates: + default: Disabled + description: |- + filterExpiredCertificates controls whether trust-manager filters out + expired certificates from trust bundles before distributing them. + When set to "Enabled", expired certificates are removed from bundles. + When set to "Disabled", expired certificates are included (default behavior). + enum: + - Enabled + - Disabled + type: string + logFormat: + default: text + description: |- + logFormat specifies the output format for trust-manager logging. + Supported formats are "text" and "json". + enum: + - text + - json + type: string + logLevel: + default: 1 + description: |- + logLevel configures the verbosity of trust-manager logging. + Follows [Kubernetes logging guidelines](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-instrumentation/logging.md#what-method-to-use). + format: int32 + maximum: 5 + minimum: 1 + type: integer + nodeSelector: + additionalProperties: + type: string + description: |- + nodeSelector restricts which nodes the trust-manager pod can be scheduled on. + ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + maxProperties: 50 + minProperties: 0 + type: object + x-kubernetes-map-type: atomic + resources: + description: |- + resources defines the compute resource requirements for the trust-manager pod. + ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + secretTargets: + description: secretTargets configures whether trust-manager can + write trust bundles to Secrets. + properties: + authorizedSecrets: + description: |- + authorizedSecrets is a list of specific secret names that trust-manager + is authorized to create and update. This field is only valid when policy is "Custom". + items: + minLength: 1 + type: string + minItems: 0 + type: array + x-kubernetes-list-type: set + policy: + default: Disabled + description: |- + policy controls whether and how trust-manager can write trust bundles to Secrets. + Allowed values are "Disabled" or "Custom". + "Disabled" means trust-manager cannot write trust bundles to Secrets (default behavior). + "Custom" grants trust-manager read access to all secrets cluster-wide, + and write access only to the secrets listed in authorizedSecrets. + enum: + - Disabled + - Custom + type: string + type: object + x-kubernetes-validations: + - message: authorizedSecrets must not be empty when policy is + Custom + rule: self.policy != 'Custom' || (has(self.authorizedSecrets) + && size(self.authorizedSecrets) > 0) + - message: authorizedSecrets must be empty when policy is not + Custom + rule: self.policy == 'Custom' || !has(self.authorizedSecrets) + || size(self.authorizedSecrets) == 0 + tolerations: + description: |- + tolerations allows the trust-manager pod to be scheduled on tainted nodes. + ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + maxItems: 50 + minItems: 0 + type: array + x-kubernetes-list-type: atomic + trustNamespace: + default: cert-manager + description: |- + trustNamespace is the namespace where trust-manager looks for trust sources + (ConfigMaps and Secrets containing CA certificates). + Defaults to "cert-manager" if not specified. + This field is immutable once set. + This field can have a maximum of 63 characters. + maxLength: 63 + minLength: 1 + type: string + x-kubernetes-validations: + - message: trustNamespace is immutable once set + rule: oldSelf == '' || self == oldSelf + type: object + required: + - trustManagerConfig + type: object + status: + description: status is the most recently observed status of the TrustManager. + properties: + conditions: + description: conditions holds information about the current state + of the operand deployment. + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + defaultCAPackagePolicy: + description: defaultCAPackagePolicy indicates the current default + CA package policy. + enum: + - Enabled + - Disabled + type: string + filterExpiredCertificatesPolicy: + description: filterExpiredCertificatesPolicy indicates the current + policy for filtering expired certificates. + enum: + - Enabled + - Disabled + type: string + secretTargetsPolicy: + description: secretTargetsPolicy indicates the current secret targets + policy. + enum: + - Disabled + - Custom + type: string + trustManagerImage: + description: trustManagerImage is the container image (name:tag) used + for trust-manager. + type: string + trustNamespace: + description: trustNamespace is the namespace where trust-manager looks + for trust sources. + type: string + type: object + required: + - metadata + - spec + type: object + x-kubernetes-validations: + - message: TrustManager is a singleton, .metadata.name must be 'cluster' + rule: self.metadata.name == 'cluster' + served: true + storage: true + subresources: + status: {} diff --git a/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml index d3f94fa34a..47c633abbc 100644 --- a/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.18.4 + app.kubernetes.io/version: v1.20.3 name: orders.acme.cert-manager.io spec: group: acme.cert-manager.io @@ -77,6 +77,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic duration: description: |- Duration is the duration for the not after date for the requested certificate. @@ -90,6 +91,7 @@ spec: items: type: string type: array + x-kubernetes-list-type: atomic issuerRef: description: |- IssuerRef references a properly configured ACME-type Issuer which should @@ -99,13 +101,17 @@ spec: Order will be marked as failed. properties: group: - description: Group of the resource being referred to. + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. type: string kind: - description: Kind of the resource being referred to. + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. type: string name: - description: Name of the resource being referred to. + description: Name of the issuer being referred to. type: string required: - name @@ -175,6 +181,7 @@ spec: - url type: object type: array + x-kubernetes-list-type: atomic identifier: description: Identifier is the DNS name to be validated as part of this authorization type: string @@ -212,6 +219,7 @@ spec: - url type: object type: array + x-kubernetes-list-type: atomic certificate: description: |- Certificate is a copy of the PEM encoded certificate for this Order. @@ -261,6 +269,10 @@ spec: - metadata - spec type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/kustomization.yaml b/assets/optional/cert-manager/crd/kustomization.yaml index 1d22d45723..b88e884756 100644 --- a/assets/optional/cert-manager/crd/kustomization.yaml +++ b/assets/optional/cert-manager/crd/kustomization.yaml @@ -10,6 +10,8 @@ resources: - bases/issuers.cert-manager.io-crd.yaml - bases/orders.acme.cert-manager.io-crd.yaml - bases/operator.openshift.io_istiocsrs.yaml +- bases/operator.openshift.io_trustmanagers.yaml +- bases/customresourcedefinition_bundles.trust.cert-manager.io.yml #+kubebuilder:scaffold:crdkustomizeresource patchesStrategicMerge: diff --git a/assets/optional/cert-manager/manager/images-aarch64.yaml b/assets/optional/cert-manager/manager/images-aarch64.yaml index 1ccfaeaa10..c386f18c99 100644 --- a/assets/optional/cert-manager/manager/images-aarch64.yaml +++ b/assets/optional/cert-manager/manager/images-aarch64.yaml @@ -4,9 +4,9 @@ metadata: name: cert-manager-images namespace: cert-manager data: - cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:f1b903ff69100fa938d6bdf4d730d35158eec905351344a246e30ef14c847222 - cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:f1b903ff69100fa938d6bdf4d730d35158eec905351344a246e30ef14c847222 - cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:f1b903ff69100fa938d6bdf4d730d35158eec905351344a246e30ef14c847222 - cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3258027c0fb9426c9ee3567f6dc0d02b85cb661c23300b230f5b1400b43bac25 - cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:95f5dfa4331fcfb96357ed28f4d7f0fd00d9419d9252e3cff3962aec6cedbeb9 - controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:22f4e686a81fc809e70e3f73206ec221f8081e842243f173308dc1fbc7f02a3e + cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c7eb92be1e699143736b0b78f79b4e49ef2621c08f7df13519a65ad79aaa641e + cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a0805907ffdb84f69313cc5d9673ba080737ed9150e9fdff6bcba1c8a34ca2f1 + controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4772792109e65d30e0a1838f1d4db6708bf34664440e62fa9f4ffc834b235802 diff --git a/assets/optional/cert-manager/manager/images-x86_64.yaml b/assets/optional/cert-manager/manager/images-x86_64.yaml index 71aea542a9..2be5421962 100644 --- a/assets/optional/cert-manager/manager/images-x86_64.yaml +++ b/assets/optional/cert-manager/manager/images-x86_64.yaml @@ -4,9 +4,9 @@ metadata: name: cert-manager-images namespace: cert-manager data: - cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:09c857f0c20721d6b447f5f567182befc1ca6157128225849117a5c830feab23 - cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:09c857f0c20721d6b447f5f567182befc1ca6157128225849117a5c830feab23 - cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:09c857f0c20721d6b447f5f567182befc1ca6157128225849117a5c830feab23 - cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:155383c4664ea3ed18d0f079be720ad68a5de044448a744d7579af7ff0fc7e0a - cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:41df7aabbce42599bad7fdc721cd12aa6e12d17e1c0658fb3294a1f68483d656 - controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:57a1aea49d7cc275b37b8f52d602a3a9d1601ec6a21a3268dd4903566cb2e335 + cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6806f7194b8d3c4d894caa1821d40a52b72a433f19f8470bcd6e5c90b8667f24 + cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:815517b1210632cf5e307aea4052355534b1955ce154d3cd0a637eb942fff815 + controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:9207cabe93f5133f56756aef5d72a5f588a3db96f1be8494e1b9aa139fcce542 diff --git a/assets/optional/cert-manager/manager/manager.yaml b/assets/optional/cert-manager/manager/manager.yaml index 68d65b34b5..af071a2b72 100644 --- a/assets/optional/cert-manager/manager/manager.yaml +++ b/assets/optional/cert-manager/manager/manager.yaml @@ -75,21 +75,25 @@ spec: - name: OPERATOR_NAME value: cert-manager-operator - name: RELATED_IMAGE_CERT_MANAGER_WEBHOOK - value: quay.io/jetstack/cert-manager-webhook:latest + value: quay.io/jetstack/cert-manager-webhook:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_CA_INJECTOR - value: quay.io/jetstack/cert-manager-cainjector:latest + value: quay.io/jetstack/cert-manager-cainjector:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_CONTROLLER - value: quay.io/jetstack/cert-manager-controller:latest + value: quay.io/jetstack/cert-manager-controller:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_ACMESOLVER - value: quay.io/jetstack/cert-manager-acmesolver:v1.18.4 + value: quay.io/jetstack/cert-manager-acmesolver:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_ISTIOCSR - value: quay.io/jetstack/cert-manager-istio-csr:v0.14.2 + value: quay.io/jetstack/cert-manager-istio-csr:v0.16.0 + - name: RELATED_IMAGE_CERT_MANAGER_TRUST_MANAGER + value: quay.io/jetstack/trust-manager:v0.20.3 - name: OPERAND_IMAGE_VERSION - value: 1.18.4 + value: 1.20.3 - name: ISTIOCSR_OPERAND_IMAGE_VERSION - value: 0.14.2 + value: 0.16.0 + - name: TRUSTMANAGER_OPERAND_IMAGE_VERSION + value: 0.20.3 - name: OPERATOR_IMAGE_VERSION - value: 1.18.1 + value: 1.20.0 - name: OPERATOR_LOG_LEVEL value: '2' - name: TRUSTED_CA_CONFIGMAP_NAME diff --git a/assets/optional/cert-manager/rbac/featuregate_clusterrole.yaml b/assets/optional/cert-manager/rbac/featuregate_clusterrole.yaml new file mode 100644 index 0000000000..ab615f2c25 --- /dev/null +++ b/assets/optional/cert-manager/rbac/featuregate_clusterrole.yaml @@ -0,0 +1,17 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: featuregate-reader + app.kubernetes.io/instance: featuregate-reader + app.kubernetes.io/created-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator + app.kubernetes.io/managed-by: kustomize + name: featuregate-reader +rules: +- apiGroups: + - config.openshift.io + resources: + - featuregates + verbs: + - get \ No newline at end of file diff --git a/assets/optional/cert-manager/rbac/featuregate_clusterrole_binding.yaml b/assets/optional/cert-manager/rbac/featuregate_clusterrole_binding.yaml new file mode 100644 index 0000000000..67f77a123e --- /dev/null +++ b/assets/optional/cert-manager/rbac/featuregate_clusterrole_binding.yaml @@ -0,0 +1,18 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/name: featuregate-reader + app.kubernetes.io/instance: featuregate-reader + app.kubernetes.io/created-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator + app.kubernetes.io/managed-by: kustomize + name: featuregate-reader +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: featuregate-reader +subjects: +- kind: ServiceAccount + name: controller-manager + namespace: system diff --git a/assets/optional/cert-manager/rbac/kustomization.yaml b/assets/optional/cert-manager/rbac/kustomization.yaml index e36e56881d..ca76ce6751 100644 --- a/assets/optional/cert-manager/rbac/kustomization.yaml +++ b/assets/optional/cert-manager/rbac/kustomization.yaml @@ -15,3 +15,7 @@ resources: - auth_proxy_role.yaml - auth_proxy_role_binding.yaml - auth_proxy_client_clusterrole.yaml +# RBAC for reading featuregates.config.openshift.io resource to determine +# feature enabling. +- featuregate_clusterrole.yaml +- featuregate_clusterrole_binding.yaml diff --git a/assets/optional/cert-manager/rbac/role.yaml b/assets/optional/cert-manager/rbac/role.yaml index c387f3a403..f5d902e214 100644 --- a/assets/optional/cert-manager/rbac/role.yaml +++ b/assets/optional/cert-manager/rbac/role.yaml @@ -106,8 +106,10 @@ rules: - certificates/finalizers - certificates/status - clusterissuers + - clusterissuers/finalizers - clusterissuers/status - issuers + - issuers/finalizers - issuers/status verbs: - create @@ -153,6 +155,14 @@ rules: - sign - update - watch +- apiGroups: + - config.openshift.io + resources: + - apiservers + verbs: + - get + - list + - watch - apiGroups: - config.openshift.io resources: @@ -168,6 +178,15 @@ rules: - patch - update - watch +- apiGroups: + - console.openshift.io + resources: + - consolequickstarts + - consoleyamlsamples + verbs: + - create + - get + - update - apiGroups: - coordination.k8s.io resources: @@ -187,6 +206,8 @@ rules: - gateways/finalizers - httproutes - httproutes/finalizers + - listenersets + - listenersets/finalizers verbs: - create - delete @@ -226,6 +247,7 @@ rules: resources: - certmanagers/finalizers - istiocsrs/finalizers + - trustmanagers/finalizers verbs: - update - apiGroups: @@ -233,6 +255,7 @@ rules: resources: - certmanagers/status - istiocsrs/status + - trustmanagers/status verbs: - get - patch @@ -241,6 +264,7 @@ rules: - operator.openshift.io resources: - istiocsrs + - trustmanagers verbs: - get - list @@ -275,3 +299,23 @@ rules: - patch - update - watch +- apiGroups: + - trust.cert-manager.io + resources: + - bundles + verbs: + - get + - list + - watch +- apiGroups: + - trust.cert-manager.io + resources: + - bundles/finalizers + verbs: + - update +- apiGroups: + - trust.cert-manager.io + resources: + - bundles/status + verbs: + - patch diff --git a/assets/optional/cert-manager/release-cert-manager-aarch64.json b/assets/optional/cert-manager/release-cert-manager-aarch64.json index af1ec78f24..78f0b53d83 100644 --- a/assets/optional/cert-manager/release-cert-manager-aarch64.json +++ b/assets/optional/cert-manager/release-cert-manager-aarch64.json @@ -1,13 +1,13 @@ { "release": { - "base": "1.18.1" + "base": "1.20.0" }, "images": { - "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:22f4e686a81fc809e70e3f73206ec221f8081e842243f173308dc1fbc7f02a3e", - "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:95f5dfa4331fcfb96357ed28f4d7f0fd00d9419d9252e3cff3962aec6cedbeb9", - "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3258027c0fb9426c9ee3567f6dc0d02b85cb661c23300b230f5b1400b43bac25", - "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:f1b903ff69100fa938d6bdf4d730d35158eec905351344a246e30ef14c847222", - "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:f1b903ff69100fa938d6bdf4d730d35158eec905351344a246e30ef14c847222", - "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:f1b903ff69100fa938d6bdf4d730d35158eec905351344a246e30ef14c847222" + "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4772792109e65d30e0a1838f1d4db6708bf34664440e62fa9f4ffc834b235802", + "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a0805907ffdb84f69313cc5d9673ba080737ed9150e9fdff6bcba1c8a34ca2f1", + "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c7eb92be1e699143736b0b78f79b4e49ef2621c08f7df13519a65ad79aaa641e", + "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70", + "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70", + "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70" } } diff --git a/assets/optional/cert-manager/release-cert-manager-x86_64.json b/assets/optional/cert-manager/release-cert-manager-x86_64.json index 40fb38817f..eb26567396 100644 --- a/assets/optional/cert-manager/release-cert-manager-x86_64.json +++ b/assets/optional/cert-manager/release-cert-manager-x86_64.json @@ -1,13 +1,13 @@ { "release": { - "base": "1.18.1" + "base": "1.20.0" }, "images": { - "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:57a1aea49d7cc275b37b8f52d602a3a9d1601ec6a21a3268dd4903566cb2e335", - "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:41df7aabbce42599bad7fdc721cd12aa6e12d17e1c0658fb3294a1f68483d656", - "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:155383c4664ea3ed18d0f079be720ad68a5de044448a744d7579af7ff0fc7e0a", - "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:09c857f0c20721d6b447f5f567182befc1ca6157128225849117a5c830feab23", - "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:09c857f0c20721d6b447f5f567182befc1ca6157128225849117a5c830feab23", - "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:09c857f0c20721d6b447f5f567182befc1ca6157128225849117a5c830feab23" + "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:9207cabe93f5133f56756aef5d72a5f588a3db96f1be8494e1b9aa139fcce542", + "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:815517b1210632cf5e307aea4052355534b1955ce154d3cd0a637eb942fff815", + "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6806f7194b8d3c4d894caa1821d40a52b72a433f19f8470bcd6e5c90b8667f24", + "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa", + "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa", + "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa" } } diff --git a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml index 9ecfd5dac5..347167bdae 100644 --- a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml +++ b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml @@ -2,13 +2,13 @@ images: - name: quay.io/operator-framework/olm newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev - digest: sha256:ef26c9bd1728be6dfb6adaa73321cd8ea19a37957532c6ce721577197df8a502 + digest: sha256:3865df57be6ad869062d80732552852b038810cc60db653f82be9e7b2d813256 - name: quay.io/operator-framework/configmap-operator-registry newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev - digest: sha256:da2ecb3d5ad08ae97a6dfde207bb0f047a21267f16a7e5deb8380847c35632a5 + digest: sha256:9ca6d1e104564ab7e274a6331cc1b1ed57431beac418b8bbd1953e92dca20ec4 - name: quay.io/openshift/origin-kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev - digest: sha256:d496cbc6540ef11c7f431fba0947b12e8fdf972af38b15ce7756caba5e1e262b + digest: sha256:1ecafa34078bdd47b0e955e18c28c45b50c51b34afdc3835626bdd8363d2555e patches: - patch: |- @@ -16,12 +16,12 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: OPERATOR_REGISTRY_IMAGE - value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:da2ecb3d5ad08ae97a6dfde207bb0f047a21267f16a7e5deb8380847c35632a5 + value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9ca6d1e104564ab7e274a6331cc1b1ed57431beac418b8bbd1953e92dca20ec4 - op: add path: /spec/template/spec/containers/0/env/- value: name: OLM_IMAGE - value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ef26c9bd1728be6dfb6adaa73321cd8ea19a37957532c6ce721577197df8a502 + value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3865df57be6ad869062d80732552852b038810cc60db653f82be9e7b2d813256 target: kind: Deployment labelSelector: app=catalog-operator diff --git a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml index fb1cb66735..eab3246ea9 100644 --- a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml +++ b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml @@ -2,13 +2,13 @@ images: - name: quay.io/operator-framework/olm newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev - digest: sha256:808f4ba4061182600d21bab1a4936d99e720b431608c32776985a86044aadd20 + digest: sha256:518e18cb81ee693c5361f7eae2329572aeb54053ad023226cf240a35ab1dc3f6 - name: quay.io/operator-framework/configmap-operator-registry newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev - digest: sha256:13f7048ce029a8eb4688771d08a234fe977bcc8d18fcec0010f969af85249b52 + digest: sha256:a208d433a4ff13c61b831c32303b8e0c701533079afd4d1681810bfc3e6675af - name: quay.io/openshift/origin-kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev - digest: sha256:686c34c021325fd33e7964916c3c6703c625bf83936ab411f30de7fb7ec62064 + digest: sha256:8f003bd7627e31ab27999f012aa513913233155f375f5e1d8095325b2246f2d6 patches: - patch: |- @@ -16,12 +16,12 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: OPERATOR_REGISTRY_IMAGE - value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:13f7048ce029a8eb4688771d08a234fe977bcc8d18fcec0010f969af85249b52 + value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a208d433a4ff13c61b831c32303b8e0c701533079afd4d1681810bfc3e6675af - op: add path: /spec/template/spec/containers/0/env/- value: name: OLM_IMAGE - value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:808f4ba4061182600d21bab1a4936d99e720b431608c32776985a86044aadd20 + value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:518e18cb81ee693c5361f7eae2329572aeb54053ad023226cf240a35ab1dc3f6 target: kind: Deployment labelSelector: app=catalog-operator diff --git a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json index b9c698f78e..b685f43268 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json @@ -1,10 +1,10 @@ { "release": { - "base": "4.22.0-0.nightly-arm64-2026-09-10-031406" + "base": "4.22.0-0.nightly-arm64-2026-09-14-021803" }, "images": { - "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ef26c9bd1728be6dfb6adaa73321cd8ea19a37957532c6ce721577197df8a502", - "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:da2ecb3d5ad08ae97a6dfde207bb0f047a21267f16a7e5deb8380847c35632a5", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:d496cbc6540ef11c7f431fba0947b12e8fdf972af38b15ce7756caba5e1e262b" + "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3865df57be6ad869062d80732552852b038810cc60db653f82be9e7b2d813256", + "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9ca6d1e104564ab7e274a6331cc1b1ed57431beac418b8bbd1953e92dca20ec4", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1ecafa34078bdd47b0e955e18c28c45b50c51b34afdc3835626bdd8363d2555e" } } diff --git a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json index ec5c29afcc..de60c25fc2 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json @@ -1,10 +1,10 @@ { "release": { - "base": "4.22.0-0.nightly-2026-09-09-183927" + "base": "4.22.0-0.nightly-2026-09-13-081542" }, "images": { - "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:808f4ba4061182600d21bab1a4936d99e720b431608c32776985a86044aadd20", - "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:13f7048ce029a8eb4688771d08a234fe977bcc8d18fcec0010f969af85249b52", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:686c34c021325fd33e7964916c3c6703c625bf83936ab411f30de7fb7ec62064" + "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:518e18cb81ee693c5361f7eae2329572aeb54053ad023226cf240a35ab1dc3f6", + "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a208d433a4ff13c61b831c32303b8e0c701533079afd4d1681810bfc3e6675af", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:8f003bd7627e31ab27999f012aa513913233155f375f5e1d8095325b2246f2d6" } } diff --git a/assets/release/release-aarch64.json b/assets/release/release-aarch64.json index 9e0fca11c5..ade844ebf8 100644 --- a/assets/release/release-aarch64.json +++ b/assets/release/release-aarch64.json @@ -1,16 +1,16 @@ { "release": { - "base": "4.22.0-0.nightly-arm64-2026-09-10-031406" + "base": "4.22.0-0.nightly-arm64-2026-09-14-021803" }, "images": { - "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e1c0c15ea5404dc0f3f7b303d6257da84295e11bc1c8e2139c7d17fa1494a328", - "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:5503f405b205cd3329f733342db6d8ff978d31c3f2bb3fa0ac4b5c8282d80296", - "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:d9bfbe74f51f77b180b8970b45b67f15a4ae57c4c7db3d13eb21139dd006d86f", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:d496cbc6540ef11c7f431fba0947b12e8fdf972af38b15ce7756caba5e1e262b", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:7123c0065685e1b93264e090be73bdbfa49dc54a085d9b3fb25637ef1f86bf4c", - "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6852a2c31787726844d6279c0ab14d2516b1de5dff49af0300a588822b3d6fc7", - "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:c4e1af3f74cf9bc88f01988f8982b510f5e893130bdcca8953e83ebbca24c6ec", + "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e4e0804b67d3def22100e46ea9afda7cc6fa4d9074f0878d96d6b1311487e66e", + "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9d76bf117edc72cd55a5bb060f51913f30d8fa7438db83216001bff354b44412", + "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3be74b9c3db4671a19c2c197995ae33c81d4f66128bb46ac3f487a46d17a5324", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1ecafa34078bdd47b0e955e18c28c45b50c51b34afdc3835626bdd8363d2555e", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e706acf4aa8ba7b50390002fe5aaf8dbf08605804cc8364700927e2adc4e94f8", + "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:73f58d8db74d41bde34f70156294482749a4bb5c81ae2822d003c9e7130be276", + "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:537b04bbf767c244454fe1c3a193d4d84e2d5b1c2bc0a031c4c4e19bf564a6e5", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:e77365e44676fbd8ab9e4ce53f3a406856bbdfef3467c545a7df1197d84477af", - "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:531e4fa3c7cbece20b5e7956693149bf10bdb44b3e9f4b23727d555ded254a33" + "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3ca7bac406ee8048b4df7988fb798a9214784628de0a44c824cbfcaf12333972" } } diff --git a/assets/release/release-x86_64.json b/assets/release/release-x86_64.json index a3791ff004..29e47f4879 100644 --- a/assets/release/release-x86_64.json +++ b/assets/release/release-x86_64.json @@ -1,16 +1,16 @@ { "release": { - "base": "4.22.0-0.nightly-2026-09-09-183927" + "base": "4.22.0-0.nightly-2026-09-13-081542" }, "images": { - "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3d64eeab58a903645291619362041d5e6c6ccbf45210f8a4fc1b8a818bc820bf", - "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:88833d6ff1454469553dfaac8f0668ac0ed054d0c8057f0f1e5b3920d1191fd6", - "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:5ccde7b0279de3bba3e29c76895db86c191727844dc800fde953b3e38bc119c6", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:686c34c021325fd33e7964916c3c6703c625bf83936ab411f30de7fb7ec62064", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f2378d8cc22a1527df98a6d7d07b09fef23681744088a7144d7fcfa57e695dc1", - "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b479b07459cfe22c7977f224404264eb2c919d11906d9b16f475cb3c955f03f4", - "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:aaf810731f7766d481a010e281e4151b37d66eb498ec3fd4cc8576957da2821d", + "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9eb6b4fd98c14a76e96579c51f711fa6711e0806d6ca8c7db057e6fac5b12093", + "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:132844b6c801c53c3a47dbd49dc946c8435ae8d5a5b0f3fa38f2480b13a93d59", + "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:739284cd61e36575cb1389ef79495059bcbf8c8131359feee7491c1aed914d23", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:8f003bd7627e31ab27999f012aa513913233155f375f5e1d8095325b2246f2d6", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:5bec06ce7e5c4db10192b03f8ac31908d877ec3370cd8f16a409e190ee0a19c5", + "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9de37fe5804aa2eb8b1403bd83ca4c7582809a53501c0f41fbbd597e5bc161e4", + "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:85fb5e6e562ce15256879c9f923798e352f8883c2efd11014f113177e68f42cb", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:10c9ccab4f2857d113b55e12cac29aed0dc97d5a4e29ed2e4ea0f77551ee55f8", - "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b5885a9992c3ac901b55565cf44693ea6a9798fee2dac68d7adf1ffae0ae2a5d" + "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:21f73f20b144d31243ace0e70fadc99b8281d5e45702ce39e07dfbfdb962b5b0" } } diff --git a/packaging/crio.conf.d/10-microshift_amd64.conf b/packaging/crio.conf.d/10-microshift_amd64.conf index d1dd1084d5..5ad0d0e279 100644 --- a/packaging/crio.conf.d/10-microshift_amd64.conf +++ b/packaging/crio.conf.d/10-microshift_amd64.conf @@ -2,6 +2,6 @@ # for community builds on top of OKD, this setting has no effect [crio.image] global_auth_file="/etc/crio/openshift-pull-secret" -pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b479b07459cfe22c7977f224404264eb2c919d11906d9b16f475cb3c955f03f4" +pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9de37fe5804aa2eb8b1403bd83ca4c7582809a53501c0f41fbbd597e5bc161e4" pause_image_auth_file = "/etc/crio/openshift-pull-secret" pause_command = "/usr/bin/pod" diff --git a/packaging/crio.conf.d/10-microshift_arm64.conf b/packaging/crio.conf.d/10-microshift_arm64.conf index 4f8969ce03..043514ab56 100644 --- a/packaging/crio.conf.d/10-microshift_arm64.conf +++ b/packaging/crio.conf.d/10-microshift_arm64.conf @@ -2,6 +2,6 @@ # for community builds on top of OKD, this setting has no effect [crio.image] global_auth_file="/etc/crio/openshift-pull-secret" -pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6852a2c31787726844d6279c0ab14d2516b1de5dff49af0300a588822b3d6fc7" +pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:73f58d8db74d41bde34f70156294482749a4bb5c81ae2822d003c9e7130be276" pause_image_auth_file = "/etc/crio/openshift-pull-secret" pause_command = "/usr/bin/pod" diff --git a/scripts/auto-rebase/assets_cert_manager.yaml b/scripts/auto-rebase/assets_cert_manager.yaml index 56bbdc4e8d..6f7caa2869 100644 --- a/scripts/auto-rebase/assets_cert_manager.yaml +++ b/scripts/auto-rebase/assets_cert_manager.yaml @@ -24,6 +24,8 @@ assets: - file: issuers.cert-manager.io-crd.yaml - file: operator.openshift.io_certmanagers.yaml - file: operator.openshift.io_istiocsrs.yaml + - file: operator.openshift.io_trustmanagers.yaml + - file: customresourcedefinition_bundles.trust.cert-manager.io.yml - file: orders.acme.cert-manager.io-crd.yaml - dir: optional/cert-manager/crd/patches/ src: cert-manager-operator/config/crd/patches/ @@ -50,6 +52,8 @@ assets: - file: auth_proxy_service.yaml - file: certmanager_editor_role.yaml - file: certmanager_viewer_role.yaml + - file: featuregate_clusterrole.yaml + - file: featuregate_clusterrole_binding.yaml - file: kustomization.yaml - file: leader_election_role.yaml - file: leader_election_role_binding.yaml diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt index 5a1e36ba60..b57cb66cf6 100644 --- a/scripts/auto-rebase/changelog.txt +++ b/scripts/auto-rebase/changelog.txt @@ -1,37 +1,29 @@ -- api embedded-component 160d28ee4bcb759daf12a47066e7026a4c5806ab to 42fb550ea02a47ab1de1ee81d798706cb74035a1 - - 7b09db07 2026-09-02T13:56:13-04:00 Tech preview feature gate file upgrades - - 92bc982f 2026-09-02T13:46:48-04:00 Move GCD to TechPreview - - 19c023c7 2026-09-02T13:22:47-04:00 Dev Preview updates to yaml files. - - 757f038d 2026-09-02T13:16:46-04:00 CORS-4435: GCP Sovereign Cloud Feature Gate - - 019fbdc1 2026-09-02T13:04:33-04:00 - Remove universeDomain from DevPreviewNoUpgrade CRDs — the first cherry-pick commit already added it to CustomNoUpgrade and DevPreviewNoUpgrade, but this second commit is adjusting the generated manifests. The diff removes universeDomain from several DevPreview CRDs and the AzureClusterHostedDNSInstall featuregated manifest, and trims down the GCPSovereignCloudInstall featuregated manifests. - Deletes SelfManagedHA-* payload CRDs — these don't exist in release-4.22. - - 520fea14 2026-09-02T13:00:05-04:00 Address review comments: improve docs and test coverage - - 8bd5b5c8 2026-09-02T12:54:03-04:00 CORS-4417: Add UniverseDomain field to GCPPlatformStatus - -- cluster-kube-apiserver-operator embedded-component 9c413cd4dc8c3876cc40ee85c207bf9b143f106f to a2ba9c6a2d1ed76ea98a40885cf9a824eb9b9071 - - 906e0be 2026-09-03T14:35:06+02:00 Use 10min inertia for GuardControllerDegraded - - 84d38af 2026-09-03T14:33:03+02:00 Add 10-minute degraded inertia for StaticPodsDegraded - - a430728 2026-09-03T14:32:56+02:00 Add 10-minute degraded inertia for NodeControllerDegraded - -- cluster-kube-controller-manager-operator embedded-component 95150ed5dbf11370b4a06e6959c77efa13768561 to c5c678b3e04a64214ae62f5ad6d873c8899ac363 - - 88be954 2026-09-02T15:21:30+02:00 Use 10min inertia for GuardControllerDegraded - - ad4e48a 2026-09-02T14:56:58+02:00 Add 10-minute degraded inertia for StaticPodsDegraded - - 6d2b464 2026-09-02T14:56:45+02:00 Add 10-minute degraded inertia for NodeControllerDegraded - -- cluster-kube-scheduler-operator embedded-component 51ea59abd057d0cef56b29b8a74efc28411d5427 to da4bf66b8f6d057ab1562b6640261d8fe9ded28f - - 37456f4 2026-09-03T14:23:20+02:00 Use 10min inertia for GuardControllerDegraded - - 6878bd1 2026-09-03T14:21:20+02:00 Add 10-minute degraded inertia for StaticPodsDegraded - - f5be8fe 2026-09-03T14:21:13+02:00 Add 10-minute degraded inertia for NodeControllerDegraded - -- kubernetes embedded-component 05744abbe07157bc72508fd1872e46e9c38fbfe7 to 19365a06f558a5c5dc7f5654fa99a8318e4a77f4 - - 059143d00 2026-08-31T22:09:49-06:00 UPSTREAM: : Add NodeSelectorAdjuster admission plugin for HCP clusters (part 2) - -- machine-config-operator embedded-component 68e5c4026c0571ea6ea351b06fc7f78dc9b72803 to 90b269666abb8df37c46bf49d9b54dcf2604447c - - 206fb079 2026-09-08T13:00:28Z OCPBUGS-120711: Fix vsphere network absolute paths - - 2629e4cc 2026-09-03T11:18:34-04:00 bootimage: skip vsphere fd-unmatched machinesets - - ecf4b31b 2026-09-03T09:29:31Z fix(test): increase TC-74751 Eventually timeout for vSphere OVA upload - - b7b4fa0b 2026-09-02T17:02:10Z chore: update AMIs - - ac6d66e0 2026-09-01T15:22:16-04:00 controller: update message for MachineOSBuildFailed condition - -- kubernetes image-amd64 05744abbe07157bc72508fd1872e46e9c38fbfe7 to 19365a06f558a5c5dc7f5654fa99a8318e4a77f4 - - 059143d00 2026-08-31T22:09:49-06:00 UPSTREAM: : Add NodeSelectorAdjuster admission plugin for HCP clusters (part 2) +- cluster-ingress-operator embedded-component 656d475a0bc76b31b8e387abd9e19458531cc4a3 to ab5f68632a64486c295c84301600f630c6693976 + - feb77cf 2026-08-26T13:14:55-04:00 vendor: updated google auth apis + - cc12883 2026-08-26T13:14:55-04:00 go.mod: bump google api to v0.199.0 + - 864e8fb 2026-08-26T13:14:55-04:00 GCP: Set Universe Domain + +- cluster-kube-apiserver-operator embedded-component a2ba9c6a2d1ed76ea98a40885cf9a824eb9b9071 to 6269fbc7b6ae116ff8e7e22cd24ca047fab18e1f + - 8def64b 2026-03-17T06:13:45Z Updating ose-cluster-kube-apiserver-operator-container image to be consistent with ART for 4.22 Reconciling with https://github.com/openshift/ocp-build-data/tree/0daf002c3db04b759c8f818f28800c1531cf2f79/images/ose-cluster-kube-apiserver-operator.yml + +- cluster-kube-controller-manager-operator embedded-component c5c678b3e04a64214ae62f5ad6d873c8899ac363 to 99a72b4e43a0e019a15a53739873f2f868c05dd7 + - 9c807e1 2026-03-03T16:52:38Z Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART for 4.22 Reconciling with https://github.com/openshift/ocp-build-data/tree/56cb39ad358cdec1db7c84ea1919fe8849c2550b/images/ose-cluster-kube-controller-manager-operator.yml + +- machine-config-operator embedded-component 90b269666abb8df37c46bf49d9b54dcf2604447c to f3334a057822a0f01ba82e15243c6ced44899a30 + - c2572ef1 2026-09-11T08:49:48Z OCPBUGS-69681: limit ContainerRuntimeConfig status condition to 3 + +- service-ca-operator embedded-component 9fff46a576033685f66fbb1121eb0a2f134a29be to de05110fb2993491ff7f40455deb2f70cb95423b + - fa94a82 2026-09-10T22:23:53Z OCPBUGS-114426: Update build-machinery-go vendor dependency + +- oc image-amd64 96ed0f43f0b5adf771ce3bd4fbc86809e93139f8 to aea5a82b408a8b83dd7d6f8b8ee9a83585dc87fd + - 4ec6cbb6 2026-09-10T22:24:35Z OCPBUGS-114426: Update build-machinery-go vendor dependency + +- service-ca-operator image-amd64 9fff46a576033685f66fbb1121eb0a2f134a29be to de05110fb2993491ff7f40455deb2f70cb95423b + - fa94a82 2026-09-10T22:23:53Z OCPBUGS-114426: Update build-machinery-go vendor dependency + +- oc image-arm64 96ed0f43f0b5adf771ce3bd4fbc86809e93139f8 to aea5a82b408a8b83dd7d6f8b8ee9a83585dc87fd + - 4ec6cbb6 2026-09-10T22:24:35Z OCPBUGS-114426: Update build-machinery-go vendor dependency + +- service-ca-operator image-arm64 9fff46a576033685f66fbb1121eb0a2f134a29be to de05110fb2993491ff7f40455deb2f70cb95423b + - fa94a82 2026-09-10T22:23:53Z OCPBUGS-114426: Update build-machinery-go vendor dependency diff --git a/scripts/auto-rebase/commits.txt b/scripts/auto-rebase/commits.txt index 065f06521d..8973bcbf22 100644 --- a/scripts/auto-rebase/commits.txt +++ b/scripts/auto-rebase/commits.txt @@ -1,9 +1,9 @@ https://github.com/openshift/api embedded-component 42fb550ea02a47ab1de1ee81d798706cb74035a1 https://github.com/openshift/cluster-csi-snapshot-controller-operator embedded-component e9b3b21fbc322cb410a58b5f147ac76893d851ea https://github.com/openshift/cluster-dns-operator embedded-component 3d2141182243cde1ec6417bd005c76d29aa88a01 -https://github.com/openshift/cluster-ingress-operator embedded-component 656d475a0bc76b31b8e387abd9e19458531cc4a3 -https://github.com/openshift/cluster-kube-apiserver-operator embedded-component a2ba9c6a2d1ed76ea98a40885cf9a824eb9b9071 -https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component c5c678b3e04a64214ae62f5ad6d873c8899ac363 +https://github.com/openshift/cluster-ingress-operator embedded-component ab5f68632a64486c295c84301600f630c6693976 +https://github.com/openshift/cluster-kube-apiserver-operator embedded-component 6269fbc7b6ae116ff8e7e22cd24ca047fab18e1f +https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component 99a72b4e43a0e019a15a53739873f2f868c05dd7 https://github.com/openshift/cluster-kube-scheduler-operator embedded-component da4bf66b8f6d057ab1562b6640261d8fe9ded28f https://github.com/openshift/cluster-network-operator embedded-component fe422f7670aa55e037c2180f1b7f2dc4e3d34cde https://github.com/openshift/cluster-openshift-controller-manager-operator embedded-component 2d2699e4f3fabc80e402f4c090c8cf80c4517977 @@ -12,24 +12,24 @@ https://github.com/openshift/csi-external-snapshotter embedded-component 28f6e06 https://github.com/openshift/etcd embedded-component 6bd01267dc858aca6ff21632f95e98dc62ba33e7 https://github.com/openshift/kubernetes embedded-component 19365a06f558a5c5dc7f5654fa99a8318e4a77f4 https://github.com/openshift/kubernetes-kube-storage-version-migrator embedded-component 72835e43c7754356645e41031f3a99926b4d42e6 -https://github.com/openshift/machine-config-operator embedded-component 90b269666abb8df37c46bf49d9b54dcf2604447c +https://github.com/openshift/machine-config-operator embedded-component f3334a057822a0f01ba82e15243c6ced44899a30 https://github.com/openshift/openshift-controller-manager embedded-component 26d20feae8892f648f5b06ed3f5492fe6ffb4532 https://github.com/openshift/operator-framework-olm embedded-component 5359e60525288af86885e14d89e3210878f87274 https://github.com/openshift/route-controller-manager embedded-component 55f77ca4cf0328b7c4fd7736bce79ebe171a9b6b -https://github.com/openshift/service-ca-operator embedded-component 9fff46a576033685f66fbb1121eb0a2f134a29be -https://github.com/openshift/oc image-amd64 96ed0f43f0b5adf771ce3bd4fbc86809e93139f8 +https://github.com/openshift/service-ca-operator embedded-component de05110fb2993491ff7f40455deb2f70cb95423b +https://github.com/openshift/oc image-amd64 aea5a82b408a8b83dd7d6f8b8ee9a83585dc87fd https://github.com/openshift/coredns image-amd64 9a71d9a6b788437e755b5ed3bfad78c63fa7c6f4 https://github.com/openshift/csi-external-snapshotter image-amd64 28f6e06357f2840c241b9cfe09d301516e681c87 https://github.com/openshift/router image-amd64 b70b28c0380056950793382f42b9b2eaf9330945 https://github.com/openshift/kube-rbac-proxy image-amd64 d12e274605248f6c59373240a7eae7a7a357dcb3 https://github.com/openshift/ovn-kubernetes image-amd64 e2082ef4a1aaad8fa5acc7b24880394b60a4e8ae https://github.com/openshift/kubernetes image-amd64 19365a06f558a5c5dc7f5654fa99a8318e4a77f4 -https://github.com/openshift/service-ca-operator image-amd64 9fff46a576033685f66fbb1121eb0a2f134a29be -https://github.com/openshift/oc image-arm64 96ed0f43f0b5adf771ce3bd4fbc86809e93139f8 +https://github.com/openshift/service-ca-operator image-amd64 de05110fb2993491ff7f40455deb2f70cb95423b +https://github.com/openshift/oc image-arm64 aea5a82b408a8b83dd7d6f8b8ee9a83585dc87fd https://github.com/openshift/coredns image-arm64 9a71d9a6b788437e755b5ed3bfad78c63fa7c6f4 https://github.com/openshift/csi-external-snapshotter image-arm64 28f6e06357f2840c241b9cfe09d301516e681c87 https://github.com/openshift/router image-arm64 b70b28c0380056950793382f42b9b2eaf9330945 https://github.com/openshift/kube-rbac-proxy image-arm64 d12e274605248f6c59373240a7eae7a7a357dcb3 https://github.com/openshift/ovn-kubernetes image-arm64 e2082ef4a1aaad8fa5acc7b24880394b60a4e8ae https://github.com/openshift/kubernetes image-arm64 19365a06f558a5c5dc7f5654fa99a8318e4a77f4 -https://github.com/openshift/service-ca-operator image-arm64 9fff46a576033685f66fbb1121eb0a2f134a29be +https://github.com/openshift/service-ca-operator image-arm64 de05110fb2993491ff7f40455deb2f70cb95423b diff --git a/scripts/auto-rebase/last_rebase.sh b/scripts/auto-rebase/last_rebase.sh index 3e4f841e54..e509111867 100755 --- a/scripts/auto-rebase/last_rebase.sh +++ b/scripts/auto-rebase/last_rebase.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release:4.22.0-0.nightly-2026-09-09-183927" "registry.ci.openshift.org/ocp-arm64/release-arm64:4.22.0-0.nightly-arm64-2026-09-10-031406" +./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release:4.22.0-0.nightly-2026-09-13-081542" "registry.ci.openshift.org/ocp-arm64/release-arm64:4.22.0-0.nightly-arm64-2026-09-14-021803" diff --git a/scripts/auto-rebase/last_rebase_cert_manager.sh b/scripts/auto-rebase/last_rebase_cert_manager.sh index 37e30003b9..f6aa23eda7 100755 --- a/scripts/auto-rebase/last_rebase_cert_manager.sh +++ b/scripts/auto-rebase/last_rebase_cert_manager.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase_cert_manager.sh to "registry.redhat.io/redhat/redhat-operator-index:v4.20" +./scripts/auto-rebase/rebase_cert_manager.sh to "registry.redhat.io/redhat/redhat-operator-index:v4.22" diff --git a/scripts/auto-rebase/rebase_job_entrypoint.sh b/scripts/auto-rebase/rebase_job_entrypoint.sh index eba0e50f00..8c2ba36bfa 100755 --- a/scripts/auto-rebase/rebase_job_entrypoint.sh +++ b/scripts/auto-rebase/rebase_job_entrypoint.sh @@ -76,7 +76,7 @@ fi rhoai_release="registry.redhat.io/rhoai/odh-operator-bundle:v2.25" # SR-IOV Operator is available through OLM and is not part of the OCP release. sriov_release="registry.redhat.io/openshift4/ose-sriov-network-operator-bundle:v4.21" -opm_release="registry.redhat.io/redhat/redhat-operator-index:v4.20" +opm_release="registry.redhat.io/redhat/redhat-operator-index:v4.22" APP_ID=$(cat /secrets/pr-creds/app_id) \ KEY=/secrets/pr-creds/key.pem \ ORG=${ORG:-openshift} \