[ { "path": ".github/CODEOWNERS", "content": "# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners\n* @Michaelpalacce\n" }, { "path": ".github/ISSUE_TEMPLATE/bug-report.md", "content": "---\nname: Bug report\nabout: Create a report to help us improve\ntitle: ''\nlabels: kind/bug\nassignees: ''\n\n---\n\n# Details\n\n**What steps did you take and what happened:**\n\n\n\n**What did you expect to happen:**\n\n**Anything else you would like to add:**\n\n\n\n**Additional Information:**\n\n\n" }, { "path": ".github/ISSUE_TEMPLATE/feature-request.md", "content": "---\nname: Feature request\nabout: Suggest an idea for this project\ntitle: ''\nlabels: kind/enhancement\nassignees: ''\n\n---\n\n# Details\n\n**Describe the solution you'd like:**\n\n\n\n**Anything else you would like to add:**\n\n\n\n**Additional Information:**\n\n\n" }, { "path": ".github/ISSUE_TEMPLATE/question.md", "content": "---\nname: Question\nabout: Ask a question to the maintainer\ntitle: ''\nlabels: kind/question\nassignees: ''\n\n---\n\n# Details\n\n**Ask your question:**\n\n\n\n\n\n\n\n" }, { "path": ".github/PULL_REQUEST_TEMPLATE.md", "content": "**Description of the change**\n\n\n\n**Benefits**\n\n\n\n**Possible drawbacks**\n\n\n\n**Applicable issues**\n\n\n- fixes #\n\n**Additional information**\n\n\n" }, { "path": ".github/linters/.markdownlint.yaml", "content": "---\ndefault: true\n\n# MD013/line-length - Line length\nMD013:\n # Number of characters\n line_length: 240\n # Number of characters for headings\n heading_line_length: 80\n # Number of characters for code blocks\n code_block_line_length: 80\n # Include code blocks\n code_blocks: true\n # Include tables\n tables: true\n # Include headings\n headings: true\n # Include headings\n headers: true\n # Strict length checking\n strict: false\n # Stern length checking\n stern: false\n" }, { "path": ".github/linters/.prettierignore", "content": "*.sops.*\ngotk-components.yaml\n" }, { "path": ".github/linters/.prettierrc.yaml", "content": "---\ntrailingComma: es5\ntabWidth: 2\nsemi: false\nsingleQuote: false\n" }, { "path": ".github/linters/.tflint.hcl", "content": "" }, { "path": ".github/linters/.yamllint.yaml", "content": "---\nignore: |\n gotk-*.yaml\n *jenkins*\nextends: default\nrules:\n truthy: false\n comments:\n min-spaces-from-content: 1\n line-length: disable\n hyphens: disable\n braces:\n min-spaces-inside: 0\n max-spaces-inside: 1\n brackets:\n min-spaces-inside: 0\n max-spaces-inside: 0\n indentation:\n spaces: consistent\n" }, { "path": ".github/renovate.json5", "content": "{\n extends: [\n ':enableRenovate',\n 'config:recommended',\n ':disableRateLimiting',\n ':dependencyDashboard',\n ':semanticCommits',\n ':separatePatchReleases',\n 'docker:enableMajor',\n ],\n enabled: true,\n semanticCommits: 'enabled',\n dependencyDashboard: true,\n dependencyDashboardTitle: 'Renovate Dashboard',\n suppressNotifications: [\n ],\n rebaseWhen: 'conflicted',\n ignoreDeps: [\n 'ghcr.io/fluxcd/helm-controller',\n 'ghcr.io/fluxcd/image-automation-controller',\n 'ghcr.io/fluxcd/image-reflector-controller',\n 'ghcr.io/fluxcd/kustomize-controller',\n 'ghcr.io/fluxcd/notification-controller',\n 'ghcr.io/fluxcd/source-controller',\n ],\n 'pre-commit': {\n enabled: true,\n },\n flux: {\n managerFilePatterns: [\n '/cluster/.+\\\\.ya?ml$/',\n ],\n },\n 'helm-values': {\n managerFilePatterns: [\n '/cluster/.+\\\\.ya?ml$/',\n ],\n },\n kubernetes: {\n managerFilePatterns: [\n '/cluster/.+\\\\.ya?ml$/',\n ],\n },\n customManagers: [\n {\n customType: 'regex',\n managerFilePatterns: [\n '/cluster/.+\\\\.ya?ml$/',\n ],\n matchStrings: [\n 'reference:\\\\s*(?[^\\\\s:]+):(?[^\\\\s\\\\n]+)',\n ],\n datasourceTemplate: 'docker',\n },\n {\n customType: 'regex',\n managerFilePatterns: [\n '/cluster/.+\\\\.ya?ml$/',\n ],\n matchStrings: [\n 'registryUrl=(?.*?)\\n *chart: (?.*?)\\n *version: (?.*)\\n',\n ],\n datasourceTemplate: 'helm',\n },\n {\n customType: 'regex',\n managerFilePatterns: [\n '/cluster/crds/cert-manager/.+\\\\.ya?ml$/',\n ],\n matchStrings: [\n 'registryUrl=(?.*?) chart=(?.*?)\\n.*\\\\/(?.*?)\\\\/',\n ],\n datasourceTemplate: 'helm',\n },\n ],\n packageRules: [\n {\n matchDatasources: [\n 'helm',\n ],\n separateMinorPatch: true,\n ignoreDeprecated: true,\n },\n {\n matchDatasources: [\n 'docker',\n ],\n enabled: true,\n commitMessageTopic: 'container image {{depName}}',\n commitMessageExtra: 'to {{#if isSingleVersion}}v{{{newVersion}}}{{else}}{{{newValue}}}{{/if}}',\n matchUpdateTypes: [\n 'major',\n 'minor',\n 'patch',\n ],\n },\n {\n matchDatasources: [\n 'docker',\n ],\n matchUpdateTypes: [\n 'major',\n ],\n labels: [\n 'renovate/image',\n 'dep/major',\n ],\n },\n {\n matchDatasources: [\n 'docker',\n ],\n matchUpdateTypes: [\n 'minor',\n ],\n labels: [\n 'renovate/image',\n 'dep/minor',\n ],\n automerge: true,\n },\n {\n matchDatasources: [\n 'docker',\n ],\n matchUpdateTypes: [\n 'patch',\n ],\n labels: [\n 'renovate/image',\n 'dep/patch',\n ],\n automerge: true,\n },\n {\n matchDatasources: [\n 'helm',\n ],\n matchUpdateTypes: [\n 'major',\n ],\n labels: [\n 'renovate/helm',\n 'dep/major',\n ],\n automerge: false,\n },\n {\n matchDatasources: [\n 'helm',\n ],\n matchUpdateTypes: [\n 'minor',\n ],\n labels: [\n 'renovate/helm',\n 'dep/minor',\n ],\n automerge: true,\n },\n {\n matchDatasources: [\n 'helm',\n ],\n matchUpdateTypes: [\n 'patch',\n ],\n labels: [\n 'renovate/helm',\n 'dep/patch',\n ],\n automerge: true,\n },\n ],\n}\n" }, { "path": ".github/workflows/dependency.yaml", "content": "name: 'Dependency Review'\n\non:\n pull_request:\n\n\npermissions:\n contents: read\n\njobs:\n dependency-review:\n runs-on: ubuntu-latest\n steps:\n - name: 'Checkout Repository'\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6\n - name: 'Dependency Review'\n uses: actions/dependency-review-action@v4\n" }, { "path": ".github/workflows/lint.yaml", "content": "---\nname: Lint\n\non: # yamllint disable-line rule:truthy\n workflow_dispatch:\n pull_request:\n branches:\n - master\n\nenv:\n # Currently no way to detect automatically\n DEFAULT_BRANCH: master\n\njobs:\n build:\n name: Lint\n runs-on: ubuntu-latest\n steps:\n - name: Checkout\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6\n with:\n fetch-depth: 0\n - name: Lint\n uses: github/super-linter/slim@v7\n env:\n VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'workflow_dispatch' }}\n DEFAULT_BRANCH: \"${{ env.DEFAULT_BRANCH }}\"\n GITHUB_TOKEN: \"${{ secrets.GITHUB_TOKEN }}\"\n MARKDOWN_CONFIG_FILE: .markdownlint.yaml\n TERRAFORM_TFLINT_CONFIG_FILE: .tflint.hcl\n YAML_CONFIG_FILE: .yamllint.yaml\n KUBERNETES_KUBEVAL_OPTIONS: --ignore-missing-schemas\n" }, { "path": ".gitignore", "content": ".idea\r\nTestingEnv\r\noutput/\r\n.secret\r\ntesting\r\nansible/playbooks/restore/files/backup\r\nvelero-credentials\r\ntemp\r\n*.tfvars\r\n*.tfstate.backup\r\n.terraform\r\ndocker-data" }, { "path": ".gitmodules", "content": "[submodule \"HomeLab-IaC\"]\n\tpath = HomeLab-IaC\n\turl = https://github.com/Michaelpalacce/HomeLab-IaC.git\n" }, { "path": "Helm/apps/changedetection/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/changedetection/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install changedetection\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: changedetection\ntype: application\nversion: 2.0.0\n" }, { "path": "Helm/apps/changedetection/README.md", "content": "This chart is used to install changedetection\n" }, { "path": "Helm/apps/changedetection/templates/deployment.yaml", "content": "---\n{{- with .Values.changedetection }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: changedetection\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: changedetection\n app.kubernetes.io/name: changedetection\nspec:\n strategy:\n rollingUpdate:\n maxUnavailable: 0\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: changedetection\n app.kubernetes.io/name: changedetection\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: data-config\n labels:\n app.kubernetes.io/instance: changedetection\n app.kubernetes.io/name: changedetection\n spec:\n containers:\n - name: browserless\n image: {{ .playwright.image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n ports:\n - name: browserless\n containerPort: {{ .playwright.port }}\n env:\n - name: DEFAULT_LAUNCH_ARGS\n value: \"--window-size=1920.1080\"\n resources: \n limits:\n memory: 2Gi\n volumeMounts:\n - name: shm-empty-playwright\n mountPath: /dev/shm\n livenessProbe:\n failureThreshold: 10\n initialDelaySeconds: 30\n tcpSocket:\n port: {{ .playwright.port }}\n timeoutSeconds: 2\n startupProbe:\n failureThreshold: 20\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .playwright.port }}\n - name: selenium\n image: {{ .selenium.image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n ports:\n - name: selenium\n containerPort: {{ .selenium.port }}\n resources: \n limits:\n memory: 2Gi\n volumeMounts:\n - name: shm-empty\n mountPath: /dev/shm\n livenessProbe:\n failureThreshold: 10\n initialDelaySeconds: 30\n tcpSocket:\n port: {{ .selenium.port }}\n timeoutSeconds: 2\n startupProbe:\n failureThreshold: 20\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .selenium.port }}\n - name: changedetection\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: data-config\n mountPath: /datastore\n env:\n - name: PUID\n value: \"1000\"\n - name: PGID\n value: \"1000\"\n - name: TZ\n value: \"Europe/Sofia\"\n - name: BASE_URL\n value: \"{{ .baseUrl }}\"\n - name: WEBDRIVER_URL\n value: \"http://localhost:{{ .selenium.port }}/wd/hub\"\n - name: PLAYWRIGHT_DRIVER_URL\n value: \"ws://localhost:{{ .playwright.port }}/?stealth=1&--disable-web-security=true\"\n livenessProbe:\n failureThreshold: 10\n initialDelaySeconds: 30\n tcpSocket:\n port: {{ .port }}\n timeoutSeconds: 2\n startupProbe:\n failureThreshold: 20\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n\n restartPolicy: Always\n volumes:\n - name: data-config\n persistentVolumeClaim:\n claimName: changedetection-pvc\n - name: shm-empty\n emptyDir:\n medium: Memory\n - name: shm-empty-playwright\n emptyDir:\n medium: Memory\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: changedetection\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: changedetection\n app.kubernetes.io/name: changedetection\n ports:\n - name: changedetection\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/changedetection/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: changedetection-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Monitors changes to websites\n gethomepage.dev/group: Automation\n gethomepage.dev/icon: changedetection\n gethomepage.dev/name: ChangeDetection.io\n gethomepage.dev/widget.type: changedetectionio\n gethomepage.dev/widget.url: https://changedetection.sgenov.dev\n gethomepage.dev/widget.key: 24f82bd47ffef64b0b533239ad38d945 # yeah, it's public, but it's not so secret\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"changedetection.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: changedetection\n port: {{ .Values.changedetection.port }}\n" }, { "path": "Helm/apps/changedetection/templates/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: changedetection-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.configSize }}\n" }, { "path": "Helm/apps/changedetection/values.yaml", "content": "---\nchangedetection:\n image: dgtlmoon/changedetection.io:0.55.3\n port: 5000\n baseUrl: changedetection.sgenov.dev\n resources:\n requests:\n cpu: 10m\n memory: 125Mi\n selenium:\n image: selenium/standalone-chrome-debug:3.141.59\n port: 4444\n playwright:\n image: browserless/chrome:1.61-chrome-stable\n port: 3000\n\nstorage:\n configSize: 1Gi\n" }, { "path": "Helm/apps/cyberchef/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/cyberchef/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install cyberchef\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: cyberchef\ntype: application\nversion: 3.0.0\n" }, { "path": "Helm/apps/cyberchef/README.md", "content": "This chart is used to install cyberchef. \n" }, { "path": "Helm/apps/cyberchef/templates/deployment.yaml", "content": "---\n{{- with .Values.cyberchef }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: cyberchef\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: cyberchef\n app.kubernetes.io/name: cyberchef\nspec:\n strategy:\n rollingUpdate:\n maxUnavailable: 0\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: cyberchef\n app.kubernetes.io/name: cyberchef\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: cyberchef\n app.kubernetes.io/name: cyberchef\n spec:\n containers:\n - name: cyberchef\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 30\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n failureThreshold: 5\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n restartPolicy: Always\n{{- end }}\n" }, { "path": "Helm/apps/cyberchef/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: cyberchef-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Swiss Army Knife of the internet\n gethomepage.dev/group: Tools\n gethomepage.dev/icon: cyberchef\n gethomepage.dev/name: CyberChef\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"cyberchef.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: cyberchef\n port: {{ .Values.cyberchef.port }}\n" }, { "path": "Helm/apps/cyberchef/templates/service.yaml", "content": "---\n{{- with .Values.cyberchef }}\napiVersion: v1\nkind: Service\nmetadata:\n name: cyberchef\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: cyberchef\n app.kubernetes.io/name: cyberchef\n ports:\n - name: cyberchef\n protocol: TCP\n port: {{ .port }}\n{{- end }}\n" }, { "path": "Helm/apps/cyberchef/values.yaml", "content": "---\ncyberchef:\n image: mpepping/cyberchef:v10.24.0\n port: 8000\n resources:\n requests:\n cpu: 10m\n memory: 50Mi\n" }, { "path": "Helm/apps/diagrams/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/diagrams/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install diagrams\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: diagrams\ntype: application\nversion: 4.0.0\n" }, { "path": "Helm/apps/diagrams/README.md", "content": "This chart is used to install diagrams.\n\nDiagrams or draw.io is a free online diagram software for making flowcharts, \nprocess diagrams, org charts, UML, etc\n\n" }, { "path": "Helm/apps/diagrams/templates/deployment.yaml", "content": "---\n{{- with .Values.diagrams }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: diagrams\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: diagrams\n app.kubernetes.io/name: diagrams\nspec:\n replicas: 1\n strategy:\n rollingUpdate:\n maxUnavailable: 0\n selector:\n matchLabels:\n app.kubernetes.io/instance: diagrams\n app.kubernetes.io/name: diagrams\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: diagrams\n app.kubernetes.io/name: diagrams\n spec:\n containers:\n - name: diagrams\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n restartPolicy: Always\n{{- end }}\n" }, { "path": "Helm/apps/diagrams/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: diagrams-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Make diagrams in your browser\n gethomepage.dev/group: Tools\n gethomepage.dev/icon: draw-io\n gethomepage.dev/name: Diagrams\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"diagrams.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: diagrams\n port: {{ .Values.diagrams.port }}\n" }, { "path": "Helm/apps/diagrams/templates/service.yaml", "content": "---\n{{- with .Values.diagrams }}\napiVersion: v1\nkind: Service\nmetadata:\n name: diagrams\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: diagrams\n app.kubernetes.io/name: diagrams\n ports:\n - name: diagrams\n protocol: TCP\n port: {{ .port }}\n{{- end }}\n" }, { "path": "Helm/apps/diagrams/values.yaml", "content": "---\ndiagrams:\n image: jgraph/drawio:29.7.9\n port: 8080\n resources:\n requests:\n cpu: 10m\n memory: 10Mi\n" }, { "path": "Helm/apps/firefly/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/firefly/CHANGELOG.md", "content": "#### [v4.0.0]\n- Better Selector\n\n#### [v3.0.0]\n* Added firefly-iii-bot\n\n#### [V2.0.0]\n* Added simplesecrets\n\n#### [V1.1.0]\n* New Version\n* Removed NodePort\n\n#### [V1.0.0]\n* Initial Deployment\n" }, { "path": "Helm/apps/firefly/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install firefly\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: firefly\ntype: application\nversion: 4.0.0\n" }, { "path": "Helm/apps/firefly/README.md", "content": "This chart is used to install firefly\n" }, { "path": "Helm/apps/firefly/templates/deployment.yaml", "content": "---\n{{- with .Values.firefly }}\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: firefly\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: firefly\n app.kubernetes.io/name: firefly\nspec:\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: firefly\n app.kubernetes.io/name: firefly\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: data\n labels:\n app.kubernetes.io/instance: firefly\n app.kubernetes.io/name: firefly\n spec:\n containers:\n - name: firefly\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n privileged: false\n allowPrivilegeEscalation: false\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: data\n mountPath: /var/www/html/storage\n env:\n - name: PUID\n value: \"1000\"\n - name: PGID\n value: \"1000\"\n - name: TZ\n value: \"Europe/Sofia\"\n\n - name: DB_USERNAME\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: username\n - name: DB_PASSWORD\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: password\n - name: DB_DATABASE\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: dbname\n - name: DB_HOST\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: host\n - name: DB_PORT\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: port\n - name: DB_CONNECTION\n value: pgsql\n\n - name: APP_KEY\n valueFrom:\n secretKeyRef:\n name: app\n key: key\n - name: APP_URL\n value: \"{{ .appUrl }}\"\n - name: TRUSTED_PROXIES\n value: \"**\"\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 30\n timeoutSeconds: 5\n httpGet:\n path: /login\n port: {{ .port }}\n startupProbe:\n failureThreshold: 10\n timeoutSeconds: 5\n httpGet:\n path: /login\n port: {{ .port }}\n\n restartPolicy: Always\n volumes:\n - name: data\n persistentVolumeClaim:\n claimName: firefly-pvc\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: firefly\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: firefly\n app.kubernetes.io/name: firefly\n ports:\n - name: web\n protocol: TCP\n port: 80\n targetPort: 8080\n\n{{- end }}\n" }, { "path": "Helm/apps/firefly/templates/firefly-bot-deployment.yaml", "content": "---\n{{- with .Values.fireflybot }}\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: fireflybot\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: fireflybot\n app.kubernetes.io/name: fireflybot\nspec:\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: fireflybot\n app.kubernetes.io/name: fireflybot\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: sessions\n labels:\n app.kubernetes.io/instance: fireflybot\n app.kubernetes.io/name: fireflybot\n spec:\n containers:\n - name: fireflybot\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n privileged: false\n allowPrivilegeEscalation: false\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n volumeMounts:\n - name: sessions\n mountPath: /home/node/app/sessions\n envFrom:\n - secretRef:\n name: bot-env\n\n restartPolicy: Always\n volumes:\n - name: sessions\n persistentVolumeClaim:\n claimName: firefly-bot-pvc\n\n{{- end }}\n" }, { "path": "Helm/apps/firefly/templates/firefly-pvc.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: firefly-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.configSize }}\n\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: firefly-bot-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.botSessionSize }}\n" }, { "path": "Helm/apps/firefly/templates/gateway-api.yaml", "content": "# ---\n# apiVersion: gateway.networking.k8s.io/v1\n# kind: HTTPRoute\n# metadata:\n# name: firefly-external\n# namespace: {{ $.Release.Namespace }}\n# spec:\n# parentRefs:\n# - name: external\n# namespace: istio-gateway\n# hostnames:\n# - \"firefly.sgenov.dev\"\n# rules:\n# - matches:\n# - path:\n# type: PathPrefix\n# value: /\n# backendRefs:\n# - name: firefly\n# port: 80\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: firefly-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"firefly.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: firefly\n port: 80\n" }, { "path": "Helm/apps/firefly/values.yaml", "content": "---\nfirefly:\n image: fireflyiii/core:version-6.2.10\n port: 8080\n appUrl: https://firefly.sgenov.dev\n resources:\n requests:\n cpu: 500m\n memory: 2Gi\n\nfireflybot:\n image: cyxou/firefly-iii-telegram-bot:v2.3.1\n resources:\n requests:\n cpu: 200m\n memory: 500Mi\n\nstorage:\n configSize: 5Gi\n botSessionSize: 2Gi\n" }, { "path": "Helm/apps/foldingathome/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/foldingathome/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install foldingathome\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: foldingathome\ntype: application\nversion: 3.1.0\n" }, { "path": "Helm/apps/foldingathome/README.md", "content": "This chart is used to install foldingathome\n" }, { "path": "Helm/apps/foldingathome/templates/gateway-api.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: foldingathome-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"foldingathome.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: foldingathome\n port: {{ .Values.foldingathome.port }}\n" }, { "path": "Helm/apps/foldingathome/templates/statefulset.yaml", "content": "\n---\n{{- with .Values.foldingathome }}\n\napiVersion: apps/v1\nkind: StatefulSet\nmetadata:\n name: foldingathome\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: foldingathome\n app.kubernetes.io/name: foldingathome\nspec:\n serviceName: foldingathome\n replicas: {{ .replicas }}\n selector:\n matchLabels:\n app.kubernetes.io/instance: foldingathome\n app.kubernetes.io/name: foldingathome\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: app-config\n labels:\n app.kubernetes.io/instance: foldingathome\n app.kubernetes.io/name: foldingathome\n spec:\n affinity:\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n app.kubernetes.io/instance: foldingathome\n app.kubernetes.io/name: foldingathome\n topologyKey: kubernetes.io/hostname\n restartPolicy: Always\n containers:\n - name: foldingathome\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 12 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: app-config\n mountPath: /config\n env:\n - name: PUID\n value: \"1000\"\n - name: PGID\n value: \"1000\"\n - name: TZ\n value: \"Europe/Sofia\"\n - name: MACHINE_NAME\n valueFrom:\n fieldRef:\n fieldPath: metadata.name\n envFrom:\n - secretRef:\n name: app\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 60\n timeoutSeconds: 5\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n failureThreshold: 5\n initialDelaySeconds: 10\n tcpSocket:\n port: {{ .port }}\n\n volumeClaimTemplates:\n - metadata:\n name: app-config\n spec:\n accessModes:\n - ReadWriteOnce\n resources:\n requests:\n storage: {{ $.Values.storage.configSize | default \"1Gi\" }}\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: foldingathome\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: foldingathome\n app.kubernetes.io/name: foldingathome\n ports:\n - name: foldingathome\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n\n" }, { "path": "Helm/apps/foldingathome/values.yaml", "content": "---\nfoldingathome:\n image: lscr.io/linuxserver/foldingathome:8.5.5\n port: 7396\n replicas: 0 # One for each server\n resources:\n requests:\n cpu: 200m\n memory: 200Mi\n limits:\n cpu: 2\n memory: 1Gi\n\nstorage:\n configSize: 1Gi\n" }, { "path": "Helm/apps/freshrss/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/freshrss/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install freshrss\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: freshrss\ntype: application\nversion: 3.1.0\n" }, { "path": "Helm/apps/freshrss/README.md", "content": "This chart is used to install freshrss\n" }, { "path": "Helm/apps/freshrss/templates/deployment.yaml", "content": "---\n{{- with .Values.freshrss }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: freshrss\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: freshrss\n app.kubernetes.io/name: freshrss\nspec:\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: freshrss\n app.kubernetes.io/name: freshrss\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: app-config\n labels:\n app.kubernetes.io/instance: freshrss\n app.kubernetes.io/name: freshrss\n spec:\n containers:\n - name: freshrss\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: app-config\n mountPath: /config\n env:\n - name: PUID\n value: \"1000\"\n - name: PGID\n value: \"1000\"\n - name: TZ\n value: \"Europe/Sofia\"\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 60\n timeoutSeconds: 5\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n failureThreshold: 5\n initialDelaySeconds: 10\n tcpSocket:\n port: {{ .port }}\n restartPolicy: Always\n volumes:\n - name: app-config\n persistentVolumeClaim:\n claimName: freshrss-pvc\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: freshrss\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: freshrss\n app.kubernetes.io/name: freshrss\n ports:\n - name: freshrss\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/freshrss/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: freshrss-external\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: external\n namespace: istio-gateway\n hostnames:\n - \"freshrss.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: freshrss\n port: {{ .Values.freshrss.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: freshrss-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"freshrss.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: freshrss\n port: {{ .Values.freshrss.port }}\n" }, { "path": "Helm/apps/freshrss/templates/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: freshrss-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.configSize }}\n" }, { "path": "Helm/apps/freshrss/values.yaml", "content": "---\nfreshrss:\n image: lscr.io/linuxserver/freshrss:1.28.1\n port: 80\n resources:\n requests:\n cpu: 200m\n memory: 200Mi\n\nstorage:\n configSize: 1Gi\n" }, { "path": "Helm/apps/homebox/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/homebox/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install homebox\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: homebox\ntype: application\nversion: 2.0.0\n" }, { "path": "Helm/apps/homebox/README.md", "content": "This chart is used to install homebox\n" }, { "path": "Helm/apps/homebox/templates/deployment.yaml", "content": "---\n{{- with .Values.homebox }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: homebox\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: homebox\n app.kubernetes.io/name: homebox\nspec:\n replicas: {{ .replicas }}\n selector:\n matchLabels:\n app.kubernetes.io/instance: homebox\n app.kubernetes.io/name: homebox\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: data\n labels:\n app.kubernetes.io/instance: homebox\n app.kubernetes.io/name: homebox\n spec:\n containers:\n - name: homebox\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n env:\n - name: HBOX_LOG_LEVEL\n value: \"info\"\n - name: HBOX_LOG_FORMAT\n value: \"json\"\n - name: HBOX_WEB_MAX_UPLOAD_SIZE\n value: \"100\"\n - name: HBOX_ALLOW_REGISTRATION\n value: \"true\"\n volumeMounts:\n - mountPath: /data\n name: data\n livenessProbe:\n failureThreshold: 2\n initialDelaySeconds: 60\n periodSeconds: 10\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n failureThreshold: 10\n periodSeconds: 5\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n\n restartPolicy: Always\n volumes:\n - name: data\n persistentVolumeClaim:\n claimName: data-pvc\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: homebox\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: homebox\n app.kubernetes.io/name: homebox\n ports:\n - name: homebox\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/homebox/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: homebox-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Home Inventory\n gethomepage.dev/group: Storage\n gethomepage.dev/icon: homebox\n gethomepage.dev/name: Homebox\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"homebox.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: homebox\n port: {{ .Values.homebox.port }}\n" }, { "path": "Helm/apps/homebox/templates/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: data-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.dataSize }}\n" }, { "path": "Helm/apps/homebox/values.yaml", "content": "---\nhomebox:\n image: ghcr.io/hay-kot/homebox:v0.10.3\n port: 7745\n replicas: 1\n resources:\n requests:\n cpu: 10m\n memory: 50Mi\n\nstorage:\n dataSize: 2Gi\n" }, { "path": "Helm/apps/it-tools/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/it-tools/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install it-tools\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: it-tools\ntype: application\nversion: 2.0.0\n" }, { "path": "Helm/apps/it-tools/README.md", "content": "This chart is used to install it-tools.\n" }, { "path": "Helm/apps/it-tools/templates/deployment.yaml", "content": "---\n{{- with .Values.ittools }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: it-tools\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: it-tools\n app.kubernetes.io/name: it-tools\nspec:\n replicas: {{ .replicas }}\n strategy:\n rollingUpdate:\n maxUnavailable: 0\n selector:\n matchLabels:\n app.kubernetes.io/instance: it-tools\n app.kubernetes.io/name: it-tools\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: it-tools\n app.kubernetes.io/name: it-tools\n spec:\n containers:\n - name: it-tools\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n add:\n - CHOWN\n - SETGID\n - SETUID\n drop:\n - ALL\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n restartPolicy: Always\n{{- end }}\n" }, { "path": "Helm/apps/it-tools/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: it-tools-external\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: external\n namespace: istio-gateway\n hostnames:\n - \"it-tools.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: it-tools\n port: {{ .Values.ittools.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: it-tools-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Usefull tools for IT professionals\n gethomepage.dev/group: Tools\n gethomepage.dev/icon: it-tools\n gethomepage.dev/name: IT Tools\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"it-tools.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: it-tools\n port: {{ .Values.ittools.port }}\n" }, { "path": "Helm/apps/it-tools/templates/pdb.yaml", "content": "---\napiVersion: policy/v1\nkind: PodDisruptionBudget\nmetadata:\n name: it-tools\nspec:\n minAvailable: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: it-tools\n app.kubernetes.io/name: it-tools\n" }, { "path": "Helm/apps/it-tools/templates/service.yaml", "content": "---\n{{- with .Values.ittools }}\napiVersion: v1\nkind: Service\nmetadata:\n name: it-tools\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: it-tools\n app.kubernetes.io/name: it-tools\n ports:\n - name: it-tools\n protocol: TCP\n port: {{ .port }}\n{{- end }}\n" }, { "path": "Helm/apps/it-tools/values.yaml", "content": "---\nittools:\n replicas: 1\n image: ghcr.io/corentinth/it-tools:nightly # The project doesn't have good docker tag hygiene\n port: 80\n resources:\n requests:\n cpu: 10m\n memory: 10Mi\n" }, { "path": "Helm/apps/linkwarden/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/linkwarden/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install linkwarden\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: linkwarden\ntype: application\nversion: 1.0.0\n" }, { "path": "Helm/apps/linkwarden/README.md", "content": "This chart is used to install linkwarden\n" }, { "path": "Helm/apps/linkwarden/templates/deployment.yaml", "content": "---\n{{- with .Values.linkwarden }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: linkwarden\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: linkwarden\n app.kubernetes.io/name: linkwarden\nspec:\n replicas: {{ .replicas }}\n selector:\n matchLabels:\n app.kubernetes.io/instance: linkwarden\n app.kubernetes.io/name: linkwarden\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: data-config\n labels:\n app.kubernetes.io/instance: linkwarden\n app.kubernetes.io/name: linkwarden\n spec:\n containers:\n - name: linkwarden\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n env:\n - name: \"NEXT_PUBLIC_DISABLE_REGISTRATION\"\n value: \"true\"\n - name: \"DATABASE_URL\"\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: fqdn-uri\n envFrom:\n - secretRef:\n name: app\n securityContext:\n privileged: false\n allowPrivilegeEscalation: false\n capabilities:\n drop: \n - \"ALL\"\n add:\n - CHOWN\n - SETUID\n - SETGID\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: data-config\n mountPath: /data/data\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 60\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n failureThreshold: 10\n initialDelaySeconds: 10\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n\n restartPolicy: Always\n volumes:\n - name: data-config\n persistentVolumeClaim:\n claimName: linkwarden-pvc\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: linkwarden\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: linkwarden\n app.kubernetes.io/name: linkwarden\n ports:\n - name: linkwarden\n protocol: TCP\n port: {{ .port }}\n{{- end }}\n" }, { "path": "Helm/apps/linkwarden/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: linkwarden-external\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: external\n namespace: istio-gateway\n hostnames:\n - \"linkwarden.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: linkwarden\n port: {{ .Values.linkwarden.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: linkwarden-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Bookmarks\n gethomepage.dev/group: Knowledge\n gethomepage.dev/icon: linkwarden\n gethomepage.dev/name: Linkwarden\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"linkwarden.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: linkwarden\n port: {{ .Values.linkwarden.port }}\n" }, { "path": "Helm/apps/linkwarden/templates/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: linkwarden-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.configSize }}\n" }, { "path": "Helm/apps/linkwarden/values.yaml", "content": "---\nlinkwarden:\n replicas: 1\n image: ghcr.io/linkwarden/linkwarden:v2.14.1\n port: 3000\n resources:\n requests:\n cpu: 10m\n memory: 256Mi\n\nstorage:\n configSize: 25Gi\n" }, { "path": "Helm/apps/mazanoke/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/mazanoke/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install mazanoke\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: mazanoke\ntype: application\nversion: 2.0.0\n" }, { "path": "Helm/apps/mazanoke/README.md", "content": "This chart is used to install mazanoke.\n" }, { "path": "Helm/apps/mazanoke/templates/deployment.yaml", "content": "---\n{{- with .Values.mazanoke }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: mazanoke\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: mazanoke\n app.kubernetes.io/name: mazanoke\nspec:\n replicas: 1\n strategy:\n rollingUpdate:\n maxUnavailable: 0\n selector:\n matchLabels:\n app.kubernetes.io/instance: mazanoke\n app.kubernetes.io/name: mazanoke\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: mazanoke\n app.kubernetes.io/name: mazanoke\n spec:\n containers:\n - name: mazanoke\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n add:\n - CHOWN\n - NET_BIND_SERVICE\n - SETGID\n - SETUID\n drop:\n - ALL\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n restartPolicy: Always\n{{- end }}\n" }, { "path": "Helm/apps/mazanoke/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: mazanoke-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Image Optimzier\n gethomepage.dev/group: Tools\n gethomepage.dev/icon: https://raw.githubusercontent.com/civilblur/mazanoke/refs/heads/main/favicon.ico\n gethomepage.dev/name: Mazanoke\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"mazanoke.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: mazanoke\n port: {{ .Values.mazanoke.port }}\n" }, { "path": "Helm/apps/mazanoke/templates/service.yaml", "content": "---\n{{- with .Values.mazanoke }}\napiVersion: v1\nkind: Service\nmetadata:\n name: mazanoke\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: mazanoke\n app.kubernetes.io/name: mazanoke\n ports:\n - name: mazanoke\n protocol: TCP\n port: {{ .port }}\n{{- end }}\n" }, { "path": "Helm/apps/mazanoke/values.yaml", "content": "---\nmazanoke:\n image: ghcr.io/civilblur/mazanoke:v1.1.5\n port: 80\n resources:\n requests:\n cpu: 10m\n memory: 10Mi\n" }, { "path": "Helm/apps/mealie/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/mealie/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install mealie\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: mealie\ntype: application\nversion: 2.0.0\n" }, { "path": "Helm/apps/mealie/README.md", "content": "This chart is used to install mealie\n" }, { "path": "Helm/apps/mealie/templates/deployment.yaml", "content": "---\n{{- with .Values.mealie }}\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: mealie\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: mealie\n app.kubernetes.io/name: mealie\nspec:\n strategy:\n rollingUpdate:\n maxUnavailable: 0\n replicas: {{ .replicas }}\n selector:\n matchLabels:\n app.kubernetes.io/instance: mealie\n app.kubernetes.io/name: mealie\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: data\n labels:\n app.kubernetes.io/instance: mealie\n app.kubernetes.io/name: mealie\n spec:\n containers:\n - name: mealie\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n add:\n - CHOWN\n - SETUID\n - SETGID\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n env:\n - name: PUID\n value: \"1000\"\n - name: GUID\n value: \"1000\"\n - name: TZ\n value: \"Europe/Sofia\"\n - name: MAX_WORKERS\n value: \"1\"\n - name: WEB_CONCURRENCY\n value: \"1\"\n - name: BASE_URL\n value: \"{{ .baseUrl }}\"\n\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: data\n mountPath: /app/data\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 60\n successThreshold: 1\n tcpSocket:\n port: {{ .port }}\n timeoutSeconds: 2\n startupProbe:\n failureThreshold: 10\n successThreshold: 1\n tcpSocket:\n port: {{ .port }}\n timeoutSeconds: 2\n\n restartPolicy: Always\n volumes:\n - name: data\n persistentVolumeClaim:\n claimName: data-pvc\n{{- end }}\n" }, { "path": "Helm/apps/mealie/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: mealie-external\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: external\n namespace: istio-gateway\n hostnames:\n - \"mealie.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: mealie\n port: {{ .Values.mealie.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: mealie-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"mealie.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: mealie\n port: {{ .Values.mealie.port }}\n" }, { "path": "Helm/apps/mealie/templates/service.yaml", "content": "{{- with .Values.mealie }}\n\napiVersion: v1\nkind: Service\nmetadata:\n name: mealie\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: mealie\n app.kubernetes.io/name: mealie\n ports:\n - name: web\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/mealie/templates/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: data-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.dataSize }}\n" }, { "path": "Helm/apps/mealie/values.yaml", "content": "---\nmealie:\n replicas: 1\n image: ghcr.io/mealie-recipes/mealie:v3.16.0\n port: 9000\n baseUrl: https://mealie.sgenov.dev\n resources:\n requests:\n cpu: 10m\n memory: 50Mi\n\nstorage:\n dataSize: 2Gi\n" }, { "path": "Helm/apps/media/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/media/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install different media services\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: media\ntype: application\nversion: 9.0.0\n" }, { "path": "Helm/apps/media/README.md", "content": "This chart is used to install different media components.\n\nSince I use sonarr a lot, and it's the only one struggling really, there is an automatic backup solution in place, that will copy over files\nto an emptyDir, rather than using longhorn... this is a fix since longhorn is actually not the best, since it uses NFS ..." }, { "path": "Helm/apps/media/templates/flaresolverr.yaml", "content": "---\n{{- with .Values.flaresolverr }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: flaresolverr\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: flaresolverr\n app.kubernetes.io/name: flaresolverr\nspec:\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: flaresolverr\n app.kubernetes.io/name: flaresolverr\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: flaresolverr\n app.kubernetes.io/name: flaresolverr\n spec:\n containers:\n - name: flaresolverr\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n privileged: false\n allowPrivilegeEscalation: false\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n env:\n - name: LOG_LEVEL\n value: INFO\n ports:\n - name: web\n containerPort: {{ .port }}\n livenessProbe:\n failureThreshold: 2\n initialDelaySeconds: 30\n timeoutSeconds: 2\n httpGet:\n path: /\n port: {{ .port }}\n startupProbe:\n failureThreshold: 5\n timeoutSeconds: 2\n httpGet:\n path: /\n port: {{ .port }}\n\n restartPolicy: Always\n\n---\napiVersion: v1\nkind: Service\nmetadata:\n name: flaresolverr\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: flaresolverr\n app.kubernetes.io/name: flaresolverr\n ports:\n - name: flaresolverr\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/media/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: flaresolverr-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"flaresolverr.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: flaresolverr\n port: {{ .Values.flaresolverr.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: sonarr-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"sonarr.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: sonarr\n port: {{ .Values.sonarr.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: kavita-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"kavita.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: kavita\n port: {{ .Values.kavita.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: prowlarr-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"prowlarr.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: prowlarr\n port: {{ .Values.prowlarr.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: radarr-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"radarr.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: radarr\n port: {{ .Values.radarr.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: overseerr-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"overseerr.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: overseerr\n port: {{ .Values.overseerr.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: transmission-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"transmission.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: transmission\n port: {{ .Values.transmission.port }}\n" }, { "path": "Helm/apps/media/templates/kavita.yaml", "content": "---\n{{- with .Values.kavita }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: kavita\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: kavita\n app.kubernetes.io/name: kavita\nspec:\n strategy:\n type: Recreate\n replicas: {{ .replicas }}\n selector:\n matchLabels:\n app.kubernetes.io/instance: kavita\n app.kubernetes.io/name: kavita\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: config-data\n labels:\n app.kubernetes.io/instance: kavita\n app.kubernetes.io/name: kavita\n spec:\n containers:\n - name: kavita\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n add:\n - CHOWN\n - SETGID\n - SETUID\n drop:\n - ALL\n privileged: false\n allowPrivilegeEscalation: false\n env:\n - name: PUID\n value: \"1000\"\n - name: GUID\n value: \"1000\"\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: config-data\n mountPath: /config\n - name: books-data-nfs\n mountPath: /books\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 30\n timeoutSeconds: 2\n httpGet:\n path: /login\n port: {{ .port }}\n startupProbe:\n failureThreshold: 10\n timeoutSeconds: 2\n httpGet:\n path: /login\n port: {{ .port }}\n restartPolicy: Always\n volumes:\n - name: config-data\n persistentVolumeClaim:\n claimName: kavita-config-pvc\n - name: books-data-nfs\n nfs:\n path: \"/volume1/k3s/media/books\"\n server: \"192.168.1.39\"\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: kavita\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: kavita\n app.kubernetes.io/name: kavita\n ports:\n - name: kavita\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/media/templates/media-pvc.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: transmission-config-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.transmission.config }}\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: kavita-config-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.kavita.config }}\n\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: overseer-config-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.overseer.config }}\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: sonarr-config-pvc\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.sonarr.config }}\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: radarr-config-pvc\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.radarr.config }}\n---\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: prowlarr-config-pvc\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.prowlarr.config }}\n" }, { "path": "Helm/apps/media/templates/overseer.yaml", "content": "---\n{{- with .Values.overseerr }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: overseerr\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: overseerr\n app.kubernetes.io/name: overseerr\nspec:\n replicas: {{ .replicas }}\n selector:\n matchLabels:\n app.kubernetes.io/instance: overseerr\n app.kubernetes.io/name: overseerr\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: config-data\n labels:\n app.kubernetes.io/instance: overseerr\n app.kubernetes.io/name: overseerr\n spec:\n containers:\n - name: overseerr\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n add:\n - CHOWN\n - SETGID\n - SETUID\n drop:\n - ALL\n privileged: false\n allowPrivilegeEscalation: false\n env:\n - name: PUID\n value: \"1000\"\n - name: GUID\n value: \"1000\"\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: config-data\n mountPath: /config\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 30\n timeoutSeconds: 2\n httpGet:\n path: /login\n port: {{ .port }}\n startupProbe:\n failureThreshold: 10\n timeoutSeconds: 2\n httpGet:\n path: /login\n port: {{ .port }}\n\n restartPolicy: Always\n volumes:\n - name: config-data\n persistentVolumeClaim:\n claimName: overseer-config-pvc\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: overseerr\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: overseerr\n app.kubernetes.io/name: overseerr\n ports:\n - name: overseerr\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/media/templates/prowlarr.yaml", "content": "---\n{{- with .Values.prowlarr }}\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: prowlarr\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: prowlarr\n app.kubernetes.io/name: prowlarr\nspec:\n replicas: {{ .replicas }}\n strategy:\n type: Recreate\n selector:\n matchLabels:\n app.kubernetes.io/instance: prowlarr\n app.kubernetes.io/name: prowlarr\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: config\n labels:\n app.kubernetes.io/instance: prowlarr\n app.kubernetes.io/name: prowlarr\n spec:\n containers:\n - name: prowlarr\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n add:\n - CHOWN\n - SETGID\n - SETUID\n drop:\n - ALL\n privileged: false\n allowPrivilegeEscalation: false\n env:\n - name: PUID\n value: \"1000\"\n - name: GUID\n value: \"1000\"\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: config\n mountPath: /config\n livenessProbe:\n failureThreshold: 10\n initialDelaySeconds: 30\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n failureThreshold: 10\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n restartPolicy: Always\n volumes:\n - name: config\n persistentVolumeClaim:\n claimName: prowlarr-config-pvc\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: prowlarr\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: prowlarr\n app.kubernetes.io/name: prowlarr\n ports:\n - name: prowlarr\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/media/templates/radarr.yaml", "content": "---\n{{- with .Values.radarr }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: radarr\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: radarr\n app.kubernetes.io/name: radarr\nspec:\n replicas: 1\n strategy:\n type: Recreate\n selector:\n matchLabels:\n app.kubernetes.io/instance: radarr\n app.kubernetes.io/name: radarr\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: config\n labels:\n app.kubernetes.io/instance: radarr\n app.kubernetes.io/name: radarr\n spec:\n containers:\n - name: radarr\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n add:\n - CHOWN\n - SETGID\n - SETUID\n drop:\n - ALL\n privileged: false\n allowPrivilegeEscalation: false\n env:\n - name: PUID\n value: \"1000\"\n - name: GUID\n value: \"1000\"\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: config\n mountPath: /config\n - name: downloads-data\n mountPath: /downloads\n - name: movies-data-nfs\n mountPath: /tv\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 30\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n failureThreshold: 10\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n restartPolicy: Always\n volumes:\n - name: config\n persistentVolumeClaim:\n claimName: radarr-config-pvc\n - name: movies-data-nfs\n nfs:\n path: \"/volume1/k3s/media/movies\"\n server: \"192.168.1.39\"\n - name: downloads-data\n nfs:\n path: \"/volume1/k3s/media/downloads\"\n server: \"192.168.1.39\"\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: radarr\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: radarr\n app.kubernetes.io/name: radarr\n ports:\n - name: radarr\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/media/templates/sonarr.yaml", "content": "---\n{{- with .Values.sonarr }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: sonarr\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: sonarr\n app.kubernetes.io/name: sonarr\nspec:\n replicas: 1\n strategy:\n type: Recreate\n selector:\n matchLabels:\n app.kubernetes.io/instance: sonarr\n app.kubernetes.io/name: sonarr\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: config\n labels:\n app.kubernetes.io/instance: sonarr\n app.kubernetes.io/name: sonarr\n spec:\n containers:\n - name: sonarr\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n add:\n - CHOWN\n - SETGID\n - SETUID\n drop:\n - ALL\n privileged: false\n allowPrivilegeEscalation: false\n env:\n - name: PUID\n value: \"1000\"\n - name: GUID\n value: \"1000\"\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: config\n mountPath: /config\n - name: downloads-data\n mountPath: /downloads\n - name: shows-data-nfs\n mountPath: /shows\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 30\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n failureThreshold: 10\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n restartPolicy: Always\n volumes:\n - name: shows-data-nfs\n nfs:\n path: \"/volume1/k3s/media/shows\"\n server: \"192.168.1.39\"\n - name: downloads-data\n nfs:\n path: \"/volume1/k3s/media/downloads\"\n server: \"192.168.1.39\"\n - name: config\n persistentVolumeClaim:\n claimName: sonarr-config-pvc\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: sonarr\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: sonarr\n app.kubernetes.io/name: sonarr\n ports:\n - name: sonarr\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/media/templates/transmission.yaml", "content": "---\n{{- with .Values.transmission }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: transmission\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: transmission\n app.kubernetes.io/name: transmission\nspec:\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: transmission\n app.kubernetes.io/name: transmission\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: transmission-data\n labels:\n app.kubernetes.io/instance: transmission\n app.kubernetes.io/name: transmission\n spec:\n containers:\n - name: transmission\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n add:\n - CHOWN\n - SETGID\n - SETUID\n drop:\n - ALL\n privileged: false\n allowPrivilegeEscalation: false\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n env:\n - name: USER\n value: {{ .username }}\n - name: PASS\n value: {{ .password }}\n - name: PUID\n value: \"1000\"\n - name: GUID\n value: \"1000\"\n ports:\n - name: web\n containerPort: {{ .port }}\n - name: torrent-tcp\n protocol: TCP\n containerPort: 51413\n - name: torrent-udp\n protocol: UDP\n containerPort: 51413\n volumeMounts:\n - name: transmission-data\n mountPath: /config\n - name: downloads-data\n mountPath: /downloads\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 30\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n failureThreshold: 10\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n\n restartPolicy: Always\n volumes:\n - name: transmission-data\n persistentVolumeClaim:\n claimName: transmission-config-pvc\n - name: downloads-data\n nfs:\n path: \"/volume1/k3s/media/downloads\"\n server: \"192.168.1.39\"\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: transmission\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: transmission\n app.kubernetes.io/name: transmission\n ports:\n - name: transmission\n protocol: TCP\n port: {{ .port }}\n\n\n{{- end }}\n" }, { "path": "Helm/apps/media/values.yaml", "content": "---\nstorage:\n transmission:\n config: 1Gi\n downloads: 200Gi\n kavita:\n config: 5Gi\n overseer:\n config: 5Gi\n radarr:\n config: 5Gi\n sonarr:\n config: 5Gi\n prowlarr:\n config: 10Gi\n\nflaresolverr:\n image: ghcr.io/flaresolverr/flaresolverr:v3.4.6\n port: 8191\n resources:\n requests:\n cpu: 512m\n memory: 1Gi\n\ntransmission:\n image: lscr.io/linuxserver/transmission:4.1.1\n port: 9091\n username: username\n password: password\n resources:\n requests:\n cpu: 250m\n memory: 1Gi\n limits:\n cpu: 2\n memory: 2Gi\nprowlarr:\n replicas: 1\n image: ghcr.io/linuxserver/prowlarr:2.3.5\n port: 9696\n resources:\n requests:\n cpu: 500m\n memory: 1Gi\n limits:\n cpu: 2\n memory: 2Gi\n\nradarr:\n image: ghcr.io/linuxserver/radarr:6.1.1\n port: 7878\n resources:\n requests:\n cpu: 10m\n memory: 50Mi\n\noverseerr:\n image: lscr.io/linuxserver/overseerr:1.35.0\n port: 5055\n replicas: 1\n resources:\n requests:\n cpu: 10m\n memory: 50Mi\n\nsonarr:\n image: lscr.io/linuxserver/sonarr:4.0.17\n port: 8989\n resources:\n requests:\n cpu: 1\n memory: 1Gi\n limits:\n cpu: 2\n\nkavita:\n image: ghcr.io/linuxserver/kavita:0.9.0\n port: 5000\n replicas: 1\n resources:\n requests:\n cpu: 100m\n memory: 500Mi\n" }, { "path": "Helm/apps/n8n/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/n8n/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install n8n\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: n8n\ntype: application\nversion: 2.0.0\n" }, { "path": "Helm/apps/n8n/README.md", "content": "This chart is used to install n8n\n" }, { "path": "Helm/apps/n8n/templates/deployment.yaml", "content": "---\n{{- with .Values.n8n }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: n8n\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: n8n\n app.kubernetes.io/name: n8n\nspec:\n replicas: {{ .replicas }}\n strategy:\n rollingUpdate:\n maxUnavailable: 0\n selector:\n matchLabels:\n app.kubernetes.io/instance: n8n\n app.kubernetes.io/name: n8n\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: n8n\n app.kubernetes.io/name: n8n\n spec:\n containers:\n - name: n8n\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n env:\n - name: N8N_BASIC_AUTH_ACTIVE\n value: \"true\"\n - name: N8N_BASIC_AUTH_USER\n valueFrom:\n secretKeyRef:\n name: app\n key: username\n - name: N8N_BASIC_AUTH_PASSWORD\n valueFrom:\n secretKeyRef:\n name: app\n key: password\n - name: DB_POSTGRESDB_HOST\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: host\n - name: DB_POSTGRESDB_DATABASE\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: dbname\n - name: DB_POSTGRESDB_PORT\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: port\n - name: DB_POSTGRESDB_USER\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: user\n - name: DB_POSTGRESDB_PASSWORD\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: password\n - name: DB_TYPE\n valueFrom:\n secretKeyRef:\n name: app\n key: type\n - name: N8N_PORT\n value: \"{{ .port }}\"\n - name: N8N_ENCRYPTION_KEY\n valueFrom:\n secretKeyRef:\n name: app\n key: encryption_key\n - name: N8N_PAYLOAD_SIZE_MAX\n valueFrom:\n secretKeyRef:\n name: app\n key: maxFileSizeMb\n\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: data\n mountPath: /home/node\n - name: nas\n mountPath: /nas\n\n restartPolicy: Always\n volumes:\n - name: data\n persistentVolumeClaim:\n claimName: n8n-pvc\n - name: nas\n nfs:\n path: \"{{ .nasPath }}\"\n server: \"{{ .nasIp }}\"\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: n8n\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: n8n\n app.kubernetes.io/name: n8n\n ports:\n - name: n8n\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/n8n/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: n8n-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Low-code automation\n gethomepage.dev/group: Automation\n gethomepage.dev/icon: n8n\n gethomepage.dev/name: N8N\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"n8n.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: n8n\n port: {{ .Values.n8n.port }}\n" }, { "path": "Helm/apps/n8n/templates/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: n8n-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.n8n.dataSize }}\n" }, { "path": "Helm/apps/n8n/values.yaml", "content": "---\nn8n:\n image: n8nio/n8n:2.19.2\n dataSize: 10Gi\n port: 5678\n replicas: 1\n nasIp: 192.168.1.39\n nasPath: /volume1/k3s\n resources:\n requests:\n cpu: 10m\n memory: 250Mi\n" }, { "path": "Helm/apps/nodered/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/nodered/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install nodered\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: nodered\ntype: application\nversion: 3.0.0\n" }, { "path": "Helm/apps/nodered/README.md", "content": "This chart is used to install nodered\n" }, { "path": "Helm/apps/nodered/templates/deployment.yaml", "content": "---\n{{- with .Values.nodered }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: nodered\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: nodered\n app.kubernetes.io/name: nodered\nspec:\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: nodered\n app.kubernetes.io/name: nodered\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: data-config\n labels:\n app.kubernetes.io/instance: nodered\n app.kubernetes.io/name: nodered\n spec:\n containers:\n - name: nodered\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: data-config\n mountPath: /data\n - name: nas\n mountPath: /nas\n livenessProbe:\n periodSeconds: 60\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n initialDelaySeconds: 60\n tcpSocket:\n port: {{ .port }}\n\n restartPolicy: Always\n volumes:\n - name: data-config\n persistentVolumeClaim:\n claimName: nodered-pvc\n - name: nas\n nfs:\n path: \"/volume1/k3s\"\n server: \"192.168.1.39\"\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: nodered\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: nodered\n app.kubernetes.io/name: nodered\n ports:\n - name: nodered\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/nodered/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: nodered-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Low-code automation\n gethomepage.dev/group: Automation\n gethomepage.dev/icon: node-red\n gethomepage.dev/name: NodeRed\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"nodered.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: nodered\n port: {{ .Values.nodered.port }}\n" }, { "path": "Helm/apps/nodered/templates/nodered-pvc.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: nodered-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.configSize }}\n" }, { "path": "Helm/apps/nodered/values.yaml", "content": "---\nnodered:\n image: nodered/node-red:3.1.15-16\n port: 1880\n resources:\n requests:\n cpu: 100m\n memory: 512Mi\n limits:\n memory: 2Gi\nstorage:\n configSize: 5Gi\n" }, { "path": "Helm/apps/openbooks/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/openbooks/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install openbooks\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: openbooks\ntype: application\nversion: 3.0.0\n" }, { "path": "Helm/apps/openbooks/README.md", "content": "This chart is used to install openbooks\n" }, { "path": "Helm/apps/openbooks/templates/deployment.yaml", "content": "---\n{{- with .Values.openbooks }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: openbooks\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: openbooks\n app.kubernetes.io/name: openbooks\nspec:\n strategy:\n rollingUpdate:\n maxUnavailable: 0\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: openbooks\n app.kubernetes.io/name: openbooks\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: openbooks\n app.kubernetes.io/name: openbooks\n spec:\n containers:\n - name: openbooks\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n privileged: false\n allowPrivilegeEscalation: false\n args:\n - --persist\n - -n stefan-g-home\n - -d /config\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: data-config\n mountPath: /config\n livenessProbe:\n failureThreshold: 2\n initialDelaySeconds: 30\n timeoutSeconds: 2\n httpGet:\n path: /\n port: {{ .port }}\n startupProbe:\n failureThreshold: 5\n timeoutSeconds: 2\n httpGet:\n path: /\n port: {{ .port }}\n\n restartPolicy: Always\n volumes:\n - name: data-config\n persistentVolumeClaim:\n claimName: openbooks-pvc\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: openbooks\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: openbooks\n app.kubernetes.io/name: openbooks\n ports:\n - name: openbooks\n protocol: TCP\n port: {{ .port }}\n{{- end }}\n" }, { "path": "Helm/apps/openbooks/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: openbooks-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: IRC Book Downloader\n gethomepage.dev/group: Media\n gethomepage.dev/icon: https://raw.githubusercontent.com/evan-buss/openbooks/master/server/app/public/favicon-32x32.png\n gethomepage.dev/name: OpenBooks\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"openbooks.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: openbooks\n port: {{ .Values.openbooks.port }}\n" }, { "path": "Helm/apps/openbooks/templates/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: openbooks-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.configSize }}\n" }, { "path": "Helm/apps/openbooks/values.yaml", "content": "---\nopenbooks:\n image: ghcr.io/evan-buss/openbooks:4.5.0\n port: 80\n resources:\n requests:\n cpu: 10m\n memory: 256Mi\n\nstorage:\n configSize: 1Gi\n" }, { "path": "Helm/apps/reactiveresume/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/reactiveresume/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install reactiveresume\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: reactiveresume\ntype: application\nversion: 3.0.0\n" }, { "path": "Helm/apps/reactiveresume/README.md", "content": "This chart installs reactiveresume\n" }, { "path": "Helm/apps/reactiveresume/templates/deployment.yaml", "content": "---\n{{- with .Values.reactiveresume }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: reactiveresume\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: reactiveresume\n app.kubernetes.io/name: reactiveresume\nspec:\n replicas: 1\n strategy:\n rollingUpdate:\n maxUnavailable: 0\n selector:\n matchLabels:\n app.kubernetes.io/instance: reactiveresume\n app.kubernetes.io/name: reactiveresume\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: reactiveresume\n app.kubernetes.io/name: reactiveresume\n spec:\n containers:\n {{- with .api }}\n - name: api\n image: {{ .image }}\n securityContext:\n capabilities:\n drop:\n - ALL\n envFrom:\n - secretRef:\n name: app\n env:\n - name: PUBLIC_FLAG_DISABLE_SIGNUPS\n value: \"true\"\n - name: POSTGRES_HOST\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: host\n - name: POSTGRES_PORT\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: port\n - name: POSTGRES_DB\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: dbname\n - name: POSTGRES_PASSWORD\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: password\n - name: POSTGRES_USER\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: user\n imagePullPolicy: IfNotPresent\n volumeMounts:\n - name: uploads\n mountPath: /app/server/dist/assets/uploads\n livenessProbe:\n initialDelaySeconds: 30\n failureThreshold: 5\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n failureThreshold: 10\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n ports:\n - containerPort: {{ .port }}\n name: api\n protocol: TCP\n {{- end }}\n\n {{- with .frontend }}\n - name: frontend\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n env:\n - name: PUBLIC_FLAG_DISABLE_SIGNUPS\n value: \"true\"\n - name: PUBLIC_URL\n valueFrom:\n secretKeyRef:\n name: app\n key: PUBLIC_URL\n - name: PUBLIC_SERVER_URL\n valueFrom:\n secretKeyRef:\n name: app\n key: PUBLIC_SERVER_URL\n livenessProbe:\n initialDelaySeconds: 30\n failureThreshold: 5\n timeoutSeconds: 2\n httpGet:\n path: /\n port: {{ .port }}\n startupProbe:\n failureThreshold: 10\n timeoutSeconds: 2\n httpGet:\n path: /\n port: {{ .port }}\n ports:\n - containerPort: {{ .port }}\n name: frontend\n protocol: TCP\n {{- end }}\n volumes:\n - name: uploads\n persistentVolumeClaim:\n claimName: reactiveresume-uploads-pvc\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: reactiveresume\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: reactiveresume\n app.kubernetes.io/name: reactiveresume\n ports:\n - name: frontend\n protocol: TCP\n port: {{ .frontend.port }}\n - name: api\n protocol: TCP\n port: {{ .api.port }}\n{{- end }}\n" }, { "path": "Helm/apps/reactiveresume/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: reactiveresume-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Build your own CV\n gethomepage.dev/group: Personal\n gethomepage.dev/icon: https://raw.githubusercontent.com/AmruthPillai/Reactive-Resume/5513b909e79d2560b3ba313facb984d2457ef602/apps/artboard/public/favicon.svg\n gethomepage.dev/name: Reactive Resume\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"resume.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: reactiveresume\n port: 3000\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: reactiveresume-api-internal\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"resume-api.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: reactiveresume\n port: 3100\n" }, { "path": "Helm/apps/reactiveresume/templates/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: reactiveresume-uploads-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.uploadSize }}\n" }, { "path": "Helm/apps/reactiveresume/values.yaml", "content": "---\nreactiveresume:\n api:\n image: amruthpillai/reactive-resume:server-3.6.18\n port: 3100\n frontendUrl: https://reactiveresume.sgenov.dev\n frontend:\n image: amruthpillai/reactive-resume:client-3.6.18\n port: 3000\n\nstorage:\n uploadSize: 5Gi\n" }, { "path": "Helm/apps/storage/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/storage/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install storage\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: storage\ntype: application\nversion: 2.0.0\n" }, { "path": "Helm/apps/storage/README.md", "content": "This chart is used to install syncthing and server emulator\n" }, { "path": "Helm/apps/storage/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: syncthing-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: File synchronization\n gethomepage.dev/group: Storage\n gethomepage.dev/icon: syncthing\n gethomepage.dev/name: Syncthing\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"syncthing.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: syncthing\n port: {{ .Values.syncthing.port }}\n" }, { "path": "Helm/apps/storage/templates/storage-pvc.yaml", "content": "\n{{- with .Values.syncthing }}\n\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: syncthing-config-pvc\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ $.Values.storage.syncthingConfigSize }}\n{{- end }}\n" }, { "path": "Helm/apps/storage/templates/syncthing.yaml", "content": "---\n{{- with .Values.syncthing }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: syncthing\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: syncthing\n app.kubernetes.io/name: syncthing\nspec:\n replicas: {{ .replicas }}\n strategy:\n rollingUpdate:\n maxUnavailable: 0\n selector:\n matchLabels:\n app.kubernetes.io/instance: syncthing\n app.kubernetes.io/name: syncthing\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: app-config\n labels:\n app.kubernetes.io/instance: syncthing\n app.kubernetes.io/name: syncthing\n spec:\n containers:\n - name: syncthing\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n add:\n - CHOWN\n - SETGID\n - SETUID\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n - name: tcp\n containerPort: 22000\n protocol: TCP\n - name: udp\n containerPort: 22000\n protocol: UDP\n - name: udp2\n containerPort: 21027\n protocol: UDP\n volumeMounts:\n - name: app-config\n mountPath: /config\n - name: data-volume\n mountPath: /data\n\n restartPolicy: Always\n volumes:\n - name: app-config\n persistentVolumeClaim:\n claimName: syncthing-config-pvc\n - name: data-volume\n nfs:\n path: \"/volume1/k3s/syncthing\"\n server: {{ $.Values.storage.nasIp }}\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: syncthing\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: syncthing\n app.kubernetes.io/name: syncthing\n ports:\n - name: syncthing\n protocol: TCP\n port: {{ .port }}\n{{- end }}\n" }, { "path": "Helm/apps/storage/values.yaml", "content": "---\nsyncthing:\n image: lscr.io/linuxserver/syncthing:2.0.16\n replicas: 1\n port: 8384\n resources:\n requests:\n cpu: 10m\n memory: 50Mi\n\nstorage:\n syncthingConfigSize: 1Gi\n nasIp: 192.168.1.39\n" }, { "path": "Helm/apps/uptimekuma/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/uptimekuma/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install uptimekuma\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: uptimekuma\ntype: application\nversion: 4.0.0\n" }, { "path": "Helm/apps/uptimekuma/README.md", "content": "This chart is used to install uptimekuma\n" }, { "path": "Helm/apps/uptimekuma/templates/deployment.yaml", "content": "---\n{{- with .Values.uptimekuma }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: uptimekuma\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: uptimekuma\n app.kubernetes.io/name: uptimekuma\nspec:\n replicas: {{ .replicas }}\n strategy:\n type: Recreate\n selector:\n matchLabels:\n app.kubernetes.io/instance: uptimekuma\n app.kubernetes.io/name: uptimekuma\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: app-data\n labels:\n app.kubernetes.io/instance: uptimekuma\n app.kubernetes.io/name: uptimekuma\n spec:\n containers:\n - name: uptimekuma\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n add:\n - SETUID\n - SETGID\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n volumeMounts:\n - name: app-data\n mountPath: /app/data\n livenessProbe:\n failureThreshold: 5\n tcpSocket:\n port: {{ .port }}\n startupProbe:\n failureThreshold: 5\n initialDelaySeconds: 10\n tcpSocket:\n port: {{ .port }}\n\n restartPolicy: Always\n volumes:\n - name: app-data\n persistentVolumeClaim:\n claimName: uptimekuma-pvc\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: uptimekuma\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: uptimekuma\n app.kubernetes.io/name: uptimekuma\n ports:\n - name: uptimekuma\n protocol: TCP\n port: {{ .port }}\n\n{{- end }}\n" }, { "path": "Helm/apps/uptimekuma/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: uptimekuma-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Uptime Monitor\n gethomepage.dev/group: Monitoring\n gethomepage.dev/icon: uptime-kuma\n gethomepage.dev/name: Uptime Kuma\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"uptimekuma.sgenov.dev\"\n - \"uptime.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: uptimekuma\n port: {{ .Values.uptimekuma.port }}\n" }, { "path": "Helm/apps/uptimekuma/templates/uptime-kuma-pvc.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: uptimekuma-pvc\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.size }}\n" }, { "path": "Helm/apps/uptimekuma/values.yaml", "content": "---\nuptimekuma:\n image: louislam/uptime-kuma:1.23.17-debian\n replicas: 1\n port: 3001\n resources:\n requests:\n cpu: 10m\n memory: 512Mi\n\nstorage:\n size: 10Gi\n" }, { "path": "Helm/apps/vikunja/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/vikunja/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install vikunja\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: vikunja\ntype: application\nversion: 4.0.0\n" }, { "path": "Helm/apps/vikunja/README.md", "content": "This chart installs vikunja\n" }, { "path": "Helm/apps/vikunja/templates/deployment.yaml", "content": "---\n{{- with .Values.vikunja }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: vikunja\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: vikunja\n app.kubernetes.io/name: vikunja\nspec:\n replicas: 1\n revisionHistoryLimit: 3\n selector:\n matchLabels:\n app.kubernetes.io/instance: vikunja\n app.kubernetes.io/name: vikunja\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: data\n labels:\n app.kubernetes.io/instance: vikunja\n app.kubernetes.io/name: vikunja\n name: vikunja\n spec:\n containers:\n - name: vikunja\n image: {{ .image }}\n securityContext:\n capabilities:\n drop:\n - ALL\n env:\n - name: VIKUNJA_SERVICE_FRONTENDURL\n value: \"{{ .frontendUrl }}\"\n - name: VIKUNJA_DATABASE_TYPE\n value: \"postgres\"\n - name: VIKUNJA_SERVICE_JWTSECRET\n valueFrom:\n secretKeyRef:\n name: app\n key: JWT_SECRET\n - name: VIKUNJA_MAILER_ENABLED\n value: \"false\"\n - name: VIKUNJA_DATABASE_HOST\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: host\n - name: VIKUNJA_DATABASE_USER\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: username\n - name: VIKUNJA_DATABASE_PASSWORD\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: password\n - name: VIKUNJA_DATABASE_DATABASE\n valueFrom:\n secretKeyRef:\n name: cluster-postgres-app\n key: dbname\n imagePullPolicy: IfNotPresent\n volumeMounts:\n - name: data\n mountPath: /app/vikunja/files\n livenessProbe:\n failureThreshold: 10\n initialDelaySeconds: 30\n tcpSocket:\n port: {{ .port }}\n timeoutSeconds: 2\n startupProbe:\n failureThreshold: 20\n timeoutSeconds: 2\n tcpSocket:\n port: {{ .port }}\n ports:\n - containerPort: {{ .port }}\n name: api\n protocol: TCP\n volumes:\n - name: data\n persistentVolumeClaim:\n claimName: vikunja-pvc\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: vikunja\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: vikunja\n app.kubernetes.io/name: vikunja\n ports:\n - name: api\n protocol: TCP\n port: {{ .port }}\n{{- end }}\n" }, { "path": "Helm/apps/vikunja/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: vikunja-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Tasks\n gethomepage.dev/group: Knowledge\n gethomepage.dev/icon: vikunja\n gethomepage.dev/name: Vikunja\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"vikunja.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: vikunja\n port: {{ .Values.vikunja.port }}\n" }, { "path": "Helm/apps/vikunja/templates/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: vikunja-pvc\n namespace: {{ $.Release.Namespace }}\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.dataSize }}\n" }, { "path": "Helm/apps/vikunja/values.yaml", "content": "---\nvikunja:\n image: vikunja/vikunja:0.24.6\n port: 3456\n frontendUrl: https://vikunja.sgenov.dev\n\nstorage:\n dataSize: 5Gi\n" }, { "path": "Helm/apps/wallabag/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/wallabag/CHANGELOG.md", "content": "#### [v2.0.0]\n- Using Gateway API\n\n#### [v1.3.0]\n* Moved Env to simplesecret\n* Improved security\n\n#### [v1.2.1]\n* Added probes for wallabag so it will automatically fix itself if failed\n\n#### [v1.2.0]\n* Added ingress\n\n#### [V1.1.0]\n* Moved resources to values.yaml\n\n#### [V1.0.0]\n* Initial Deployment\n" }, { "path": "Helm/apps/wallabag/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install wallabag\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: wallabag\ntype: application\nversion: 2.0.0\n" }, { "path": "Helm/apps/wallabag/README.md", "content": "This chart is used to install wallabag.\n" }, { "path": "Helm/apps/wallabag/templates/database.yaml", "content": "---\n{{- with .Values.postgres }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: postgres\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: postgres\n app.kubernetes.io/name: postgres\nspec:\n strategy:\n type: Recreate\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: postgres\n app.kubernetes.io/name: postgres\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: postgresql-data\n labels:\n app.kubernetes.io/instance: postgres\n app.kubernetes.io/name: postgres\n spec:\n securityContext:\n fsGroup: 999\n containers:\n - name: postgresql\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n envFrom:\n - secretRef:\n name: db\n securityContext:\n runAsUser: 999 # postgres UID in the image\n runAsGroup: 999\n allowPrivilegeEscalation: false\n privileged: false\n capabilities:\n drop: \n - \"ALL\"\n add:\n - CHOWN\n - SETUID\n - SETGID\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: db\n containerPort: {{ .port }}\n volumeMounts:\n - mountPath: /var/lib/postgresql/data\n subPath: data\n name: postgresql-data\n - name: shm-empty\n mountPath: /dev/shm\n livenessProbe:\n exec:\n command:\n - /bin/bash\n - -c\n - pg_isready\n - -U\n - $POSTGRES_USER\n - -d\n - $POSTGRES_DB\n failureThreshold: 2\n periodSeconds: 10\n successThreshold: 1\n timeoutSeconds: 2\n startupProbe:\n exec:\n command:\n - /bin/bash\n - -c\n - pg_isready\n - -U\n - $POSTGRES_USER\n - -d\n - $POSTGRES_DB\n failureThreshold: 10\n periodSeconds: 10\n successThreshold: 1\n timeoutSeconds: 2\n\n restartPolicy: Always\n volumes:\n - name: postgresql-data\n persistentVolumeClaim:\n claimName: postgresql-pvc\n - name: shm-empty\n emptyDir:\n medium: Memory\n\n---\n\napiVersion: v1\nkind: Service\nmetadata:\n name: postgres\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: postgres\n app.kubernetes.io/name: postgres\n ports:\n - name: postgres\n protocol: TCP\n port: {{ .port }}\n{{- end }}\n" }, { "path": "Helm/apps/wallabag/templates/deployment.yaml", "content": "---\n{{- with .Values.wallabag }}\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: wallabag\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: wallabag\n app.kubernetes.io/name: wallabag\nspec:\n replicas: {{ .replicas }}\n selector:\n matchLabels:\n app.kubernetes.io/instance: wallabag\n app.kubernetes.io/name: wallabag\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: wallabag\n app.kubernetes.io/name: wallabag\n spec:\n restartPolicy: Always\n containers:\n - name: wallabag\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n privileged: false\n allowPrivilegeEscalation: false\n envFrom:\n - secretRef:\n name: app\n optional: false\n env:\n - name: PUID\n value: \"1000\"\n - name: GUID\n value: \"1000\"\n - name: SYMFONY__ENV__DOMAIN_NAME\n value: {{ .domainName }}\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n livenessProbe:\n failureThreshold: 10\n initialDelaySeconds: 60\n timeoutSeconds: 5\n httpGet:\n port: {{ .port }}\n path: /login\n startupProbe:\n failureThreshold: 10\n periodSeconds: 5\n httpGet:\n port: {{ .port }}\n path: /login\n{{- end }}\n" }, { "path": "Helm/apps/wallabag/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: wallabag-external\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: external\n namespace: istio-gateway\n hostnames:\n - \"wallabag.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: wallabag\n port: {{ .Values.wallabag.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: wallabag-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Self-Hosted Pocket\n gethomepage.dev/group: Knowledge\n gethomepage.dev/icon: wallabag\n gethomepage.dev/name: Wallabag\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"wallabag.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: wallabag\n port: {{ .Values.wallabag.port }}\n" }, { "path": "Helm/apps/wallabag/templates/pdb.yaml", "content": "---\napiVersion: policy/v1\nkind: PodDisruptionBudget\nmetadata:\n name: wallabag\nspec:\n minAvailable: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: wallabag\n app.kubernetes.io/name: wallabag\n" }, { "path": "Helm/apps/wallabag/templates/service.yaml", "content": "---\n{{- with .Values.wallabag }}\n\napiVersion: v1\nkind: Service\nmetadata:\n name: wallabag\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: wallabag\n app.kubernetes.io/name: wallabag\n ports:\n - name: wallabag\n protocol: TCP\n port: {{ .port }}\n{{- end }}\n" }, { "path": "Helm/apps/wallabag/templates/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: postgresql-pvc\n labels:\n app.kubernetes.io/instance: postgres\n app.kubernetes.io/name: postgres\n app.kubernetes.io/component: database\n app.kubernetes.io/part-of: wallabag\n app.kubernetes.io/managed-by: helm\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: longhorn\n resources:\n requests:\n storage: {{ .Values.storage.postgresqlSize }}\n" }, { "path": "Helm/apps/wallabag/values.yaml", "content": "---\nwallabag:\n image: wallabag/wallabag:2.6.14\n replicas: 1\n port: 80\n domainName: https://wallabag.sgenov.dev\n resources:\n requests:\n cpu: 100m\n memory: 500Mi\n\npostgres:\n image: postgres:16.13\n port: 5432\n resources:\n requests:\n cpu: 10m\n memory: 256Mi\n\nstorage:\n postgresqlSize: 5Gi\n" }, { "path": "Helm/apps/website/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*.orig\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "Helm/apps/website/CHANGELOG.md", "content": "#### [v4.0.0]\n- Using Gateway API\n\n#### [v3.0.0]\n- Better selectors\n- Better probes\n\n#### [V2.0.0]\n* Migrated to ghcr.io\n\n#### [V1.1.0]\n* Updated security\n\n#### [V1.0.0]\n* Initial Deployment\n" }, { "path": "Helm/apps/website/Chart.yaml", "content": "---\napiVersion: v2\nappVersion: 1.0.0\ndescription: This chart is used to install website\nmaintainers:\n - email: sgenov94@gmail.com\n name: Stefan Genov\nname: website\ntype: application\nversion: 4.0.0\n" }, { "path": "Helm/apps/website/README.md", "content": "This chart is used to install my personal website https://github.com/Michaelpalacce/personal-website-vue\n" }, { "path": "Helm/apps/website/templates/deployment.yaml", "content": "---\n{{- with .Values.website }}\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: website\n namespace: {{ $.Release.Namespace }}\n labels:\n app.kubernetes.io/instance: website\n app.kubernetes.io/name: website\nspec:\n replicas: {{ .replicas }}\n selector:\n matchLabels:\n app.kubernetes.io/instance: website\n app.kubernetes.io/name: website\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: website\n app.kubernetes.io/name: website\n spec:\n restartPolicy: Always\n securityContext:\n fsGroup: 1000\n fsGroupChangePolicy: OnRootMismatch\n priorityClassName: critical-priority\n affinity:\n podAntiAffinity:\n preferredDuringSchedulingIgnoredDuringExecution:\n - podAffinityTerm:\n labelSelector:\n matchLabels:\n app.kubernetes.io/name: website\n namespaces:\n - {{ $.Release.Namespace }}\n topologyKey: kubernetes.io/hostname\n weight: 1\n containers:\n - name: website\n image: {{ .image }}\n imagePullPolicy: IfNotPresent\n securityContext:\n capabilities:\n drop:\n - ALL\n privileged: false\n allowPrivilegeEscalation: false\n{{- if .resources }}\n resources:\n{{ toYaml .resources | indent 22 }}\n{{- end }}\n ports:\n - name: web\n containerPort: {{ .port }}\n envFrom:\n - secretRef:\n name: website\n optional: false\n env:\n - name: CV_PATH\n value: \"/cv/CV.pdf\"\n volumeMounts:\n - name: cv\n mountPath: /cv\n livenessProbe:\n failureThreshold: 2\n initialDelaySeconds: 10\n timeoutSeconds: 2\n httpGet:\n path: /\n port: {{ .port }}\n startupProbe:\n failureThreshold: 5\n timeoutSeconds: 2\n httpGet:\n path: /\n port: {{ .port }}\n volumes:\n - name: cv\n nfs:\n path: \"/volume1/k3s/CV\"\n server: \"192.168.1.39\"\n\n{{- end }}\n" }, { "path": "Helm/apps/website/templates/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: website-external\n namespace: {{ $.Release.Namespace }}\nspec:\n parentRefs:\n - name: external\n namespace: istio-gateway\n hostnames:\n - \"sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: website\n port: {{ .Values.website.port }}\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: website-internal\n namespace: {{ $.Release.Namespace }}\n annotations:\n # nginx.ingress.kubernetes.io/proxy-body-size: \"100m\"\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: My Website\n gethomepage.dev/group: Personal\n gethomepage.dev/icon: https://sgenov.dev/favicon.ico\n gethomepage.dev/name: Website\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"sgenov.dev\"\n - \"website.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: website\n port: {{ .Values.website.port }}\n" }, { "path": "Helm/apps/website/templates/pdb.yaml", "content": "---\napiVersion: policy/v1\nkind: PodDisruptionBudget\nmetadata:\n name: website\nspec:\n minAvailable: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: website\n app.kubernetes.io/name: website\n" }, { "path": "Helm/apps/website/templates/service.yaml", "content": "---\n{{- with .Values.website }}\napiVersion: v1\nkind: Service\nmetadata:\n name: website\n namespace: {{ $.Release.Namespace }}\nspec:\n selector:\n app.kubernetes.io/instance: website\n app.kubernetes.io/name: website\n ports:\n - name: website\n protocol: TCP\n port: {{ .port }}\n{{- end }}\n" }, { "path": "Helm/apps/website/values.yaml", "content": "---\nwebsite:\n image: ghcr.io/michaelpalacce/website:v2.25.0\n port: 80\n replicas: 3\n resources:\n requests:\n cpu: 500m\n memory: 512Mi\n" }, { "path": "README.md", "content": "# Preface\n\"\"\n\nThis repository contains basic HELM local charts for application installation as well as FluxCD2 HelmReleases for GitOps.\nI'm not going to move away from the local helm charts where possible as they make this repository pretty beginner-friendly.\n\nAlso, big warning, this repo is things I've done on the side with time taken away from my family.\n\n# :open_book: Check out the Documentation\n* [Documentation](./docs)\n\n# Main tools used\n1. **FluxCD 2** - GitOps for my HomeLab.\n2. **Renovate** - Checks for updates to actions, helm charts, helm releases, docker containers.\n3. **Istio + Gateway API** - Reverse proxy + SSL termination for services\n4. **cert-manager + reflector** - cert-manager generates certificates for my services and reflector duplicates the generated ssl\ncertificate secret to all the namespaces. The secret is called `ingress`.\n5. **Longhorn** - K8S native storage.\n6. **Ansible** - Used to provision the architecture\n7. **Velero** - K8S and PVC backup. Free and open source by VMware \n8. **MetalLB** - LoadBalancer for bare-metal k8s clusters\n9. **tofu-controller** - Gitops for Terraform \n\n# GitOps :construction:\nGitOps is applied wherever possible using Flux2.\nCI/CD is done by bootstrapping flux into my cluster. Flux polls GitHub for changes and applies them automatically on my server.\nIt is currently pretty stable.\n\n# Image updates\nImage updates are done via Renovate Bot :robot:. Renovate bot does periodic scans for new image versions and submits pull request for each change.\n\n# Accessing services ( istio, cert-manager )\nApps are currently exposed by Istio with Gateway API and have SSL certificates provided by cert-manager.\nA wildcard certificate is issued for my domain `*.sgenov.dev` and when the secret is created\nit is replicated in all namespace as `ingress` to be consumed by the ingress resources. This replication is\nneeded because `Let's encrypt` rate limits certificate requests. \n\n## :desktop_computer: Exposing Apps\nAs a legacy approach I used to expose my apps via NodePort. This ability is removed but can be easily enabled by\nremoving the commented out nodePort values in the Helm Charts, and I also try to add this functionality to future apps\nand services I install.\n\n# Control Plane Load Balancing\n\nI use DNS load balancing for the control plane. This is done by creating an A record for the control plane and pointing it to the IPs of the control plane nodes.\nThis is done because I don't have a load balancer in my homelab and I don't want to expose the control plane on a single node.\n\n# Storage ( Longhorn )\nLonghorn is a great replicated storage option with a great UI for better visualisation. It's fast and tailor made for \nk8s. Developed by the same people responsible for k3s/rancher and other great tools. [Official site](https://longhorn.io/)\n\n# Backup ( Velero ) \nVelero allows me to back up selected namespaces and ( with the help of restic ) ship the data to different sources.\nIn my case I'm using the velero AWS plugin.\n\nThe velero backup runs on a schedule every day during the evening hours and I pay around ~ $7 each month, mainly due to Wasabi pricing for\n1TB as a minimum. \n\nCheck the docs for more information about velero, but overall I try to backup everything. \n\n# Infrastructure as code\n\n`tofu-controller` is a tool by the team behind FluxCD2 and allows me to continuously reconcile a git repo and apply changes when a change or drift is detected. I'm not handling VM creation yet, as that has proven to be a nuisance with the Terraform provider. Security is the main focus of this. \n\n# What if I don't want to use Flux\nWell it's absolutely fine. You can go to `Helm/apps` and install any app you want ( e.g. `helm install media media -n media --create-namespace` ).\nHowever things like ingress, cert-management, longhorn are handled only via Flux. Information on the helm chart that is\nused can be found in the `helm-release.yaml` for the specific service. Let's look at an example:\n~~~yaml\n---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: longhorn-system # What to call the deployment \n namespace: longhorn-system # Where to install the helm chart \nspec:\n interval: 10m # How often do we poll for changes\n install:\n createNamespace: true # Same as --create-namespace\n chart:\n spec:\n chart: longhorn # Which chart to use\n version: 1.2.4 # Which version of the chart\n interval: 10m\n# Where to find information for this chart ( in my case I have a HelmRepository defined in cluster/homelab/helm/longhorn-system\n sourceRef: \n kind: HelmRepository \n name: longhorn-system\n namespace: flux-system\n# Overwriting some values\n values:\n ingress:\n enabled: true\n host: longhorn.sgenov.dev\n ingressClassName: nginx\n tls: true\n tlsSecret: ingress\n\n service:\n ui:\n type: NodePort\n nodePort: 30030\n~~~\n\nThis would be the same as:\n1. Creating a new file with the content:\n \n `values.yaml`:\n ~~~yaml\n ingress:\n enabled: true\n host: longhorn.sgenov.dev\n ingressClassName: nginx\n tls: true\n tlsSecret: ingress\n \n service:\n ui:\n type: NodePort\n nodePort: 30030\n ~~~\n2. Running: `helm repo add longhorn https://charts.longhorn.io; helm repo update` to add the longhorn helm repo\n3. Running: `helm install longhorn/longhorn --name longhorn --create-namespace -n longhorn-system -f values.yaml`\n" }, { "path": "TODOS.md", "content": "# TODOs\n\n## Fixes\n\n- [ ] Fix paperless-ngx redis:latest... broadcom...\n\n## Security\n\n- [ ] Network Policies For External Services\n\n## Infrastructure\n\n- [ ] Strip down the K3S Nodes of unused services and packages\n\n## Service Specifics\n\n## Upgrades\n\n- [ ] Migrate to newest postgresql\n- [ ] postgresql instances should be a statefulset\n" }, { "path": "ansible/hosts/group_vars/master/k3s-config.yaml", "content": "---\nk3s_control_node: true\n\nk3s_server:\n node-ip: \"{{ ansible_default_ipv4.address }}\"\n kubelet-arg:\n - \"image-gc-high-threshold=75\"\n - \"image-gc-low-threshold=60\"\n tls-san:\n - \"{{ k3s_registration_address }}\"\n docker: false\n disable:\n - traefik\n - local-storage\n - servicelb\n disable-network-policy: false\n disable-cloud-controller: true\n write-kubeconfig-mode: \"644\"\n cluster-cidr: \"10.40.0.0/16\"\n service-cidr: \"10.96.0.0/16\"\n etcd-expose-metrics: true\n" }, { "path": "ansible/hosts/group_vars/workers/k3s-config.yaml", "content": "---\nk3s_control_node: false\n\nk3s_agent:\n node-ip: \"{{ ansible_default_ipv4.address }}\"\n kubelet-arg:\n - \"image-gc-high-threshold=75\"\n - \"image-gc-low-threshold=60\"\n" }, { "path": "ansible/hosts/inventory", "content": "[master]\n192.168.1.78\n192.168.1.83\n192.168.1.242\n\n[workers]\n192.168.1.55\n192.168.1.89\n192.168.1.247\n192.168.1.79\n\n[extra]\n# 192.168.1.20\n# 192.168.1.42\n# 192.168.1.22\n\n\n# This group has all the servers\n[all:children]\nmaster\nworkers\nextra\n\n#Variables for all the servers\n[all:vars]\nansible_connection=ssh\nansible_user=stefan\nansible_ssh_common_args='-o StrictHostKeyChecking=no'\n" }, { "path": "ansible/playbooks/install/files/allContainerLogs", "content": "/var/logs/containers/*.log {\n rotate 2\n copytruncate\n missingok\n notifempty\n compress\n maxsize 10M\n dateext\n dateformat -%Y%m%d-%s\n create 0644 root root\n}" }, { "path": "ansible/playbooks/install/files/cleanUpOrphanedPods.py", "content": "import subprocess\nimport select\nimport re\nimport shutil\n\nf = subprocess.Popen(['tail', '-F', '/var/log/syslog'], stdout=subprocess.PIPE, stderr=subprocess.PIPE)\np = select.poll()\np.register(f.stdout)\n\nwhile True:\n if p.poll(1):\n line = f.stdout.readline().decode('utf-8')\n result = re.search('orphaned pod \\\\\\\\\"([0-9a-zA-Z-]*)\\\\\\\\\"', line)\n if result:\n toDelete = '/var/lib/kubelet/pods/' + result.group(1)\n try:\n shutil.rmtree(toDelete)\n print(toDelete + \" was deleted\")\n except:\n print(toDelete + \" could not be deleted\")\n" }, { "path": "ansible/playbooks/install/files/cniLogs", "content": "/var/logs/calico/cni/*.log {\n rotate 2\n copytruncate\n missingok\n notifempty\n compress\n maxsize 10M\n dateext\n dateformat -%Y%m%d-%s\n create 0644 root root\n}" }, { "path": "ansible/playbooks/install/files/multipath.conf", "content": "blacklist {\n devnode \"^sd[a-z0-9]+\"\n}" }, { "path": "ansible/playbooks/install/files/podLogs", "content": "/var/logs/pods/*/*/*.log {\n rotate 2\n copytruncate\n missingok\n notifempty\n compress\n maxsize 10M\n dateext\n dateformat -%Y%m%d-%s\n create 0644 root root\n}" }, { "path": "ansible/playbooks/install/main.yml", "content": "---\n- hosts: all\n name: Setup sudoers\n gather_facts: false\n become: true\n tags:\n - preflight\n - preflight-sudoers\n vars_files:\n - \"./vars/main.yml\"\n tasks:\n - name: Show current Ansible user\n debug:\n var: ansible_user\n - name: Enable passwordless sudo for user\n copy:\n dest: \"/etc/sudoers.d/10-{{ ansible_user }}\"\n content: \"{{ ansible_user }} ALL=(ALL) NOPASSWD:ALL\"\n owner: root\n group: root\n mode: \"0440\"\n- hosts: all\n name: Setup Logs and log sizes\n gather_facts: false\n become: true\n tags:\n - preflight\n - preflight-logs\n vars_files:\n - \"./vars/main.yml\"\n tasks:\n - name: Logrotate\n copy:\n dest: \"{{ item.dest }}\"\n src: \"{{ item.src }}\"\n with_items:\n - dest: /etc/logrotate.d/allContainerLogs\n src: allContainerLogs\n - dest: /etc/logrotate.d/cniLogs\n src: cniLogs\n - dest: /etc/logrotate.d/podLogs\n src: podLogs\n\n - name: Check if logrotate is daily\n stat: path=/etc/cron.daily/logrotate\n register: logrotate_stat\n\n - name: Move logrotate to hourly if daily\n command: mv /etc/cron.daily/logrotate /etc/cron.hourly/logrotate\n when: logrotate_stat.stat.exists\n\n - name: Ensure persistent journal is enabled\n lineinfile:\n path: /etc/systemd/journald.conf\n regexp: \"^#?SystemMaxUse=\"\n line: \"SystemMaxUse={{ journalctl_vaccum_size }}\"\n state: present\n notify: restart systemd-journald\n\n - name: Reload systemd-journald configuration\n command: systemctl daemon-reload\n handlers:\n - name: restart systemd-journald\n service:\n name: systemd-journald\n state: restarted\n\n- hosts: all\n name: Setup limits\n gather_facts: false\n become: true\n tags:\n - preflight\n - preflight-limits\n vars_files:\n - \"./vars/main.yml\"\n tasks:\n - name: Set soft nofile limit for all users\n lineinfile:\n path: /etc/security/limits.conf\n insertafter: EOF\n line: \"* soft nofile 65535\"\n state: present\n\n - name: Set hard nofile limit for all users\n lineinfile:\n path: /etc/security/limits.conf\n insertafter: EOF\n line: \"* hard nofile 65535\"\n state: present\n\n - name: Ensure pam_limits is enabled\n lineinfile:\n path: /etc/pam.d/common-session\n regexp: \"^#?session required pam_limits.so\"\n line: \"session required pam_limits.so\"\n state: present\n\n - name: Reload the limits configuration\n shell: ulimit -n 65535\n\n- hosts: all\n name: Setup Storage dependencies\n become: true\n gather_facts: false\n tags:\n - preflight\n - preflight-storage-dependencies\n vars_files:\n - \"./vars/main.yml\"\n tasks:\n - name: Ensure dependencies are installed\n apt:\n name: \"{{ packages }}\"\n state: present\n vars:\n packages:\n - open-iscsi\n - nfs-common\n - jq\n\n- hosts:\n - master\n - workers\n become: true\n any_errors_fatal: true\n tags:\n - setup\n - setup-k3s\n vars_files:\n - \"./vars/main.yml\"\n roles:\n - xanmanning.k3s\n\n- hosts: master\n name: Setup master k3s and fetch config\n become: true\n tags:\n - setup\n - setup-init-master\n vars_files:\n - \"./vars/main.yml\"\n tasks:\n - name: Setup k3s\n shell: \"{{ item }}\"\n with_items:\n - mkdir -p ~/.kube\n - cp /etc/rancher/k3s/k3s.yaml ~/.kube/config\n\n - name: Copy output to local files\n fetch:\n src: \"{{ item.src }}\"\n dest: \"{{ item.dest }}\"\n flat: true\n with_items:\n - src: /etc/rancher/k3s/k3s.yaml\n dest: \"{{ output_dir }}/config\"\n\n- name: Fix Config URL\n hosts: localhost\n connection: local\n gather_facts: false\n become: true\n tags:\n - setup\n - setup-fix-kubeconfig\n vars_files:\n - \"./vars/main.yml\"\n tasks:\n - replace:\n path: ./output/config\n regexp: \"127.0.0.1\"\n replace: \"{{ k3s_registration_address }}\"\n backup: true\n\n- hosts: all\n name: Fix Multipath\n become: true\n tags:\n - setup\n - setup-multipath\n tasks:\n - name: Make sure multipath conf file is missing\n file:\n path: /etc/multipath.conf\n state: absent\n\n - name: Copy Multipath File\n copy:\n src: ./files/multipath.conf\n dest: /etc/multipath.conf\n\n - name: Restart multipath service\n systemd:\n state: restarted\n name: multipathd\n- hosts: all\n name: Load Kernel Modules\n become: true\n tags:\n - setup\n - setup-kernel\n tasks:\n - name: Enable kernel modules now\n community.general.modprobe:\n name: \"{{ item }}\"\n state: present\n loop: [br_netfilter, ip_vs, ip_vs_rr]\n - name: Enable kernel modules on boot\n ansible.builtin.copy:\n mode: 0644\n dest: \"/etc/modules-load.d/{{ item }}.conf\"\n content: \"{{ item }}\"\n loop: [br_netfilter, ip_vs, ip_vs_rr, dm_crypt]\n\n- hosts: all\n become: true\n tags:\n - unattended_upgrades\n systemctl\n roles:\n - role: hifis.toolkit.unattended_upgrades\n unattended_automatic_reboot: true\n\n- hosts: all\n become: true\n tags:\n - qemu\n tasks:\n - name: Install qemu-guest-agent\n apt:\n name: \"{{ packages }}\"\n state: present\n vars:\n packages:\n - qemu-guest-agent\n - name: Start and enable qemu-guest-agent\n systemd_service:\n name: qemu-guest-agent\n enabled: true\n state: started\n" }, { "path": "ansible/playbooks/install/requirements.yml", "content": "---\ncollections:\n - name: kubernetes.core\n version: 6.3.0\n - name: community.general\n version: 12.5.0\n - name: hifis.toolkit\n version: 6.3.2\nroles:\n - src: xanmanning.k3s\n" }, { "path": "ansible/playbooks/install/vars/main.yml", "content": "---\narch: amd64 # architecture\n\noutput_dir: ./output # Where to output files generated by the playbook\n\njournalctl_vaccum_size: 200M # After what size should journalctl logs be cleaned up\n\nk3s_release_version: \"v1.34.1+k3s1\"\nk3s_install_hard_links: true # For system-upgrader\nk3s_become: true\nk3s_debug: false\nk3s_etcd_datastore: true\nk3s_use_unsupported_config: true\nk3s_registration_address: 192.168.1.78 # Master node ip\n" }, { "path": "cluster/homelab/age.agekey.public", "content": "age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn" }, { "path": "cluster/homelab/apps/adminer/deployment.yaml", "content": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: adminer\n labels:\n app.kubernetes.io/instance: adminer\n app.kubernetes.io/name: adminer\nspec:\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: adminer\n app.kubernetes.io/name: adminer\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: adminer\n app.kubernetes.io/name: adminer\n spec:\n containers:\n - name: adminer\n image: adminer:latest\n imagePullPolicy: IfNotPresent\n ports:\n - name: http\n containerPort: 8080\n resources:\n requests:\n cpu: 100m\n memory: 100Mi\n limits:\n cpu: 200m\n memory: 200Mi\n" }, { "path": "cluster/homelab/apps/adminer/gateway-api.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: adminer-internal\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"adminer.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: adminer\n port: 80\n" }, { "path": "cluster/homelab/apps/adminer/kustomization.yaml", "content": "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: adminer\nresources:\n - namespace.yaml\n - deployment.yaml\n - service.yaml\n - gateway-api.yaml\n" }, { "path": "cluster/homelab/apps/adminer/namespace.yaml", "content": "apiVersion: v1\nkind: Namespace\nmetadata:\n name: adminer\n" }, { "path": "cluster/homelab/apps/adminer/service.yaml", "content": "apiVersion: v1\nkind: Service\nmetadata:\n name: adminer\nspec:\n selector:\n app.kubernetes.io/instance: adminer\n app.kubernetes.io/name: adminer\n ports:\n - name: http\n protocol: TCP\n port: 80\n targetPort: http\n" }, { "path": "cluster/homelab/apps/bentopdf/deployment.yaml", "content": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: bentopdf\n labels:\n app.kubernetes.io/instance: bentopdf\n app.kubernetes.io/name: bentopdf\nspec:\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: bentopdf\n app.kubernetes.io/name: bentopdf\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: bentopdf\n app.kubernetes.io/name: bentopdf\n spec:\n restartPolicy: Always\n containers:\n - name: bentopdf\n image: ghcr.io/alam00000/bentopdf:2.8.4\n imagePullPolicy: IfNotPresent\n resources:\n limits:\n cpu: 512m\n memory: 512Mi\n ports:\n - name: web\n containerPort: 8080\n securityContext:\n capabilities:\n drop:\n - \"ALL\"\n add:\n - CHOWN\n - SETUID\n - SETGID\n env:\n - name: PUID\n value: \"1000\"\n - name: PGID\n value: \"1000\"\n - name: TZ\n value: \"Europe/Sofia\"\n livenessProbe:\n failureThreshold: 10\n initialDelaySeconds: 30\n tcpSocket:\n port: 8080\n timeoutSeconds: 2\n startupProbe:\n failureThreshold: 20\n timeoutSeconds: 2\n tcpSocket:\n port: 8080\n" }, { "path": "cluster/homelab/apps/bentopdf/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: bentopdf-internal\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: PDF Tools\n gethomepage.dev/group: Tools\n gethomepage.dev/icon: https://bentopdf.sgenov.dev/favicon.ico\n gethomepage.dev/name: BentoPDF\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"bentopdf.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: bentopdf\n port: 8080\n" }, { "path": "cluster/homelab/apps/bentopdf/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: bentopdf\nresources:\n - namespace.yaml\n - deployment.yaml\n - service.yaml\n - gateway-api.yaml\n" }, { "path": "cluster/homelab/apps/bentopdf/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: bentopdf\n" }, { "path": "cluster/homelab/apps/bentopdf/service.yaml", "content": "apiVersion: v1\nkind: Service\nmetadata:\n name: bentopdf\nspec:\n selector:\n app.kubernetes.io/instance: bentopdf\n app.kubernetes.io/name: bentopdf\n ports:\n - name: web\n protocol: TCP\n port: 8080\n" }, { "path": "cluster/homelab/apps/cert-manager/issuer.yaml", "content": "---\napiVersion: cert-manager.io/v1\nkind: ClusterIssuer\nmetadata:\n name: letsencrypt\n namespace: cert-manager\nspec:\n acme:\n email: stefantigro@gmail.com\n server: https://acme-v02.api.letsencrypt.org/directory\n privateKeySecretRef:\n name: issuer-account-key\n solvers:\n - dns01:\n cloudflare:\n email: stefantigro@gmail.com\n apiTokenSecretRef:\n name: cloudflare\n key: apikey\n---\napiVersion: cert-manager.io/v1\nkind: ClusterIssuer\nmetadata:\n name: letsencrypt-staging\n namespace: cert-manager\nspec:\n acme:\n email: stefantigro@gmail.com\n server: https://acme-staging-v02.api.letsencrypt.org/directory\n privateKeySecretRef:\n name: issuer-account-key\n solvers:\n - dns01:\n cloudflare:\n email: stefantigro@gmail.com\n apiTokenSecretRef:\n name: cloudflare\n key: apikey\n" }, { "path": "cluster/homelab/apps/cert-manager/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - issuer.yaml\n - wildcard-certificate.yaml\n" }, { "path": "cluster/homelab/apps/cert-manager/wildcard-certificate.yaml", "content": "---\napiVersion: cert-manager.io/v1\nkind: Certificate\nmetadata:\n name: ingress\n namespace: cert-manager\nspec:\n secretTemplate:\n annotations:\n reflector.v1.k8s.emberstack.com/reflection-auto-enabled: \"true\"\n reflector.v1.k8s.emberstack.com/reflection-allowed: \"true\"\n secretName: ingress\n issuerRef:\n name: letsencrypt\n kind: ClusterIssuer\n commonName: \"*.sgenov.dev\"\n dnsNames:\n - \"*.sgenov.dev\"\n---\napiVersion: cert-manager.io/v1\nkind: Certificate\nmetadata:\n name: adygenova-cert\n namespace: cert-manager\nspec:\n secretTemplate:\n annotations:\n reflector.v1.k8s.emberstack.com/reflection-auto-enabled: \"true\"\n reflector.v1.k8s.emberstack.com/reflection-allowed: \"true\"\n secretName: adygenova-cert\n issuerRef:\n name: letsencrypt\n kind: ClusterIssuer\n commonName: \"*.adygenova.com\"\n dnsNames:\n - \"*.adygenova.com\"\n---\napiVersion: cert-manager.io/v1\nkind: Certificate\nmetadata:\n name: replacedby-cert\n namespace: cert-manager\nspec:\n secretTemplate:\n annotations:\n reflector.v1.k8s.emberstack.com/reflection-auto-enabled: \"true\"\n reflector.v1.k8s.emberstack.com/reflection-allowed: \"true\"\n secretName: replacedby-cert\n issuerRef:\n name: letsencrypt\n kind: ClusterIssuer\n commonName: \"*.replacedby.net\"\n dnsNames:\n - \"*.replacedby.net\"\n" }, { "path": "cluster/homelab/apps/changedetection/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: changedetection\n namespace: changedetection\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/changedetection\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n values:\n image: dgtlmoon/changedetection.io:0.55.3\n" }, { "path": "cluster/homelab/apps/changedetection/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/apps/changedetection/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: changedetection\n" }, { "path": "cluster/homelab/apps/cyberchef/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: cyberchef\n namespace: cyberchef\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/cyberchef\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n values:\n cyberchef:\n image: mpepping/cyberchef:v10.24.0\n" }, { "path": "cluster/homelab/apps/cyberchef/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/apps/cyberchef/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: cyberchef\n" }, { "path": "cluster/homelab/apps/diagrams/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: diagrams\n namespace: diagrams\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/diagrams\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/diagrams/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/apps/diagrams/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: diagrams\n" }, { "path": "cluster/homelab/apps/firefly/cnpg.yaml", "content": "apiVersion: postgresql.cnpg.io/v1\nkind: Cluster\nmetadata:\n name: cluster-postgres\n annotations:\n backup.velero.io/backup-volumes: pgdata\nspec:\n instances: 1\n\n imageName: ghcr.io/cloudnative-pg/postgresql:18.1\n\n storage:\n size: 10Gi\n\n podSecurityContext:\n runAsNonRoot: true\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n add:\n - NET_BIND_SERVICE\n - CHOWN\n - FOWNER\n privileged: false\n readOnlyRootFilesystem: true\n runAsNonRoot: true\n" }, { "path": "cluster/homelab/apps/firefly/gateway-api.sensitive.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: firefly-internal\n annotations:\n gethomepage.dev/enabled: ENC[AES256_GCM,data:t+20kQ==,iv:p8Opyq1QUKUvAKSyU+qD1uUEoMBqXtlNJoajE2acRUo=,tag:Ue6njGAknFa4urpgXZnPmg==,type:str]\n gethomepage.dev/description: ENC[AES256_GCM,data:q/XSINQkdZQZWwduDQ==,iv:LGHKlrlyZxMy00Q/KSz3L54bMsxG4DLpIDUMKBqcY9s=,tag:XpwDkSMfKedBQ69DiqK2aQ==,type:str]\n gethomepage.dev/group: ENC[AES256_GCM,data:O75eHVHlgMs=,iv:5fdD2j9bKz3yh/qSE6El42LOg+XxFd9mdyMxu/H7B+o=,tag:ix2dZV5lVIgUDj192vCY2w==,type:str]\n gethomepage.dev/icon: ENC[AES256_GCM,data:178Nv5PrxA==,iv:l91hn6pM+xLZtCsKREP2davQ66mjXyDVyXsUMkOR/a0=,tag:2YXL3dUuAuyqh/A0qMHERg==,type:str]\n gethomepage.dev/name: ENC[AES256_GCM,data:ZUZi6zDny0vMSOc=,iv:9TtR1NcZ4osTVvJGQCK45fTD6W/WjPyycyPrD+tIPkY=,tag:uPJFwM2D0PcK3nJ0azTKuw==,type:str]\n gethomepage.dev/widget.type: ENC[AES256_GCM,data:Ms3+Oq/frQ==,iv:jSuKAhhGw1J8iseGw4fR2ZTCjvxFWLAfK7zwY/l+RQo=,tag:vO+KfSAYJZSPUVuYBB+oMQ==,type:str]\n gethomepage.dev/widget.url: ENC[AES256_GCM,data:xqqZ1Uz+xeB129mlwLMwPJv+8PU3kanHBg==,iv:WTcVvoYbwTRmxI+DgRn4QiL3Mpwjsx+OuW5v7B+XYM4=,tag:Y/04+cnaltjOyKVWCMqAWQ==,type:str]\n gethomepage.dev/widget.key: ENC[AES256_GCM,data:aQQ34DvJ3RHXbvnVMANchlXl68t1PMNlGpPP2jtrfFI23bOf972aQFqhcx7UHIPZxPmoEte25qkx8WbAxu1M0/rSBhUJ6SUsAzDEkak+pOdF68XnMEEr83uzmijrO0KJRawV4uyBDtaOW3EAOxGtbEUmi7F9EuqoNbR1n7UhCD2bcJL5A62E6XzoDAqDmgjWyhEV3R7thP8zzwvwDY8AFSMcS9WTMagGfqOh9ymCFpPrf4ESJDYukp0DUCMsd96u+xgDiTfZJVQ2vl32ixYVyWb8R4eOJFe3CYvw9LWB5XoWfds5AcCcVAyPOcim+6k3YCyXR3hKoW/ePhQl88YNXcpkoG8MU8Yg014EJhuvIHodWc1PLY0veNaGT0gJUU+nESOyqDqFFn/lcIAiG+KVDqAEjWmjYh1XRWCjG52Y3f9I3Lc8bjmoO8Y3eC35GY8mPjO0bNxL5/X1VHMogv260NINTLJMX1vBD4eQZ4V9dg9jqX1rs7HIdZmKsKsd7cCfI/BTx+S3Cd46nJFogpzmczm89kUvfwD4VZKnH0paHW0qD0sWgFUuN+pUAEl/0HmkNsjS9uYXD+e1fveoptP/RfQaWWSGzX78XZ8TYMzSQs5YV3vCOXrqFYgAJi9b7iSDWeVc1Q8lZ0bipOrJAzO7gKAfNoQ2dIx/+gduE4FZjug2SE1+pBfo7UEDneWT8mFtHAipgL4gg1do/ppmZ5CvXJ6dg996gDYaGsxprj6YRJVZR1DABrZfqomOEd8XlfTIhl55Dg57uWg0Cea+H9dK8m61NaqoES8EJ2Q74SWuPjjEBXoVhtltSm80f43FJT7f5mVIoE0bztiYMCWTr6Y3cqf1TdfBVT2vl0Omltqc6Q50C8bPzai0q1r0a51YDSzundSrOWxoKRilkn5cWEUTSonnjzwWrla0VMIwvbGLS5yYKP6s+CKFavEktCcq37o4x6Qa0wPmXeIQnHfVCzACy/vrTlrjwqbrwLj2dX3T5jdRtjtyOVj+pQYiOSVv3eYT2sqGnM7JT7CMD0sEtKii1W2pGWaXNtqLRhl8hZAAxN6lsBSMGjI27Gegdn5g77FecKOvg04/VtQySvREFKYqkzgR+dSsMxuZPXYJrxucOD0OqXJTl948FLznfl1NFKUoUFAz8EzuEkcbEweIanP6vRXGfAnFI5w3ecuClr/OIZN5B7cbffXAwIrVKUJuqySYwYmvyxaoWhgcCNVToL4Hf4NzTHrtf4OgvaCZmTjkZhlj+T7pKuVsBXHTlPFqSKKRv3w1TtsvdxBL+PfQAHWtbn2rRs6c4dpr,iv:qPV5l7n6VRzT9qmHIcERaLbwqFF7uvJKE61XriktbUU=,tag:FId4jYC6/ee1eOmrLFaz/Q==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRSVVWWE9CaFk3RncxTUpW\n UEkxblNraVlMdjVodzFiNzJ1K012TzhZNUY4CjVLSVVpbGhuRWFVcEdQV3QwSjgr\n MXlySHZNanlXMmF6TmMwSXQ5V2JaR3MKLS0tIDQzMUVNeDdjZk44anBzYTBNakUy\n OU5OV3FCOG9oUmkxanFOb1ROR2ZhMTAKAWjRBhvleX72BbS01DeDX+cQzE2U5lAd\n UmBCmNE6S5R4gP7cWO1WDSNRjYEGT0XMv5zr3whX2U2QQJvsxqCTeA==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2026-01-19T21:02:02Z\"\n mac: ENC[AES256_GCM,data:DKD3lc5HNFyuUynHzwO6nco+jCovKuSdu7andnOi/atznqSQAPAGfdUswG81ZqP3vBEhBFnnbHBZZTpGe+PP+NKvTrhzAEQQ/R4UvUJ2KouDPYGTKL86I4suiq/xx3JezTnF7H32Tfer80UeaCLX37zeyTYaQ1eiU3Lfu9J/3cg=,iv:hxd1k9BVsQx39h6yHm/PdUTxzL4BVW2HIFrhfoEcYmU=,tag:pWUVZt9RQimRgyRlNxyvug==,type:str]\n encrypted_regex: ^(rules|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/firefly/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: firefly\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/firefly\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/firefly/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: firefly\nresources:\n - helm-release.yaml\n - namespace.yaml\n - secret.sops.yaml\n - gateway-api.sensitive.yaml\n - cnpg.yaml\n" }, { "path": "cluster/homelab/apps/firefly/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: firefly\n" }, { "path": "cluster/homelab/apps/firefly/secret.sops.yaml", "content": "kind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: bot-env\ndata:\n BOT_TOKEN: ENC[AES256_GCM,data:xuvnXdR1NZweB+BfkqWze92Vw81b2A055f7a7WszRyjVqm+GaPnDTr42XauyphIgbxbzhq26CZ6eDhFus75K0Q==,iv:5EOSLAZvQH4NfbY9pP5rExuB1i8YRomZk5BV3cZ0xGw=,tag:Un5a/PKYvGmTol0ISYNQog==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkR1hQTk9pWFZMYlQzKzNG\n WnlMcGYxZEhNOTB2TnEzOFhxTVY4SDhubVZBCmN6c1BLbmYxTU1zUHJOMTlIeDU2\n T2tuT0M3ZXlxSW5pWTRtOUdBYjZlUFEKLS0tIFVBT3F4a1RwejJpdE9uWENLWWxE\n UHZSNFUzQ1ZvN3Q1ODJEWmRJMHRhNkUKI3gsgABTCJo6KKiimfT7W7xOFzwnjUwR\n 33TH2eoZhjsEKCnjiLfp7VES+DQXwNOyaH08BHhQx1zBvZZDDW9XGA==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2026-01-19T21:02:34Z\"\n mac: ENC[AES256_GCM,data:xLm9Mks2x8EH9CT8PHiNG8RVpe7LdtplZKoWqzeYKNgrGckAyDgY1E65N8Y3rMAN9lDOGlfp3xzBHQOeEKwQzgiN29uJaa1QV8AGb73Osg54fEys0hy1o0FftGKnL9IzoU7i77tF2zrPdqY8zpd7CCS7kL+7dn1p1aWqoxW+wWQ=,iv:b7/We1YriVr1X0bsHq0Xfz3YJ+jT3pp35TcTDU7r79w=,tag:Xp9MmUCZgoheyPW3wsMadg==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n---\nkind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: app\ndata:\n key: ENC[AES256_GCM,data:2SIGAGsK/RSNQcu3UR58bwKpc9cK7sJXOh2yMlZxNhOWuQSpCEBMT8N4tic=,iv:owyv8n8511tLV6C30N+Nj3RrwOaLvIgK+vYE9pf1YZc=,tag:bopeYUOEajH0C/LSGm+bKQ==,type:str]\n API_KEY: ENC[AES256_GCM,data:PtcrOqfl6stqDpsTham9hSX5vcJlHu4v7Px7Ko9hR16gCgHuWk+nSk2kud8J60FgtqLOQ6G23YBssQ3TEEPduHLv+XifafDX0TYjHh61+LSiQzpPpdyWGX5tqcULMKBBR+sUafTIBH9eUCj99LCe69P22rcI70b+sMte/dk3IGjCvswdObCLZeODodHghYscnGCDlxvWuh4Q8H8NZj8waALQ8DcudOA9+1dEZyfMT3vRK6+dyW1c1WC1lhI6ylhw81FcXVOs8Wju9vMNHQZ1JMdyNgbeFTiP9DhjALPyJBt8huUGhblzJw9N9Gefrd4u/X51pdgY66JT+Ny87cbeQMiHVDz6fclh9wc9GdM7dWbIUQjQq3ZsSb1bYZPnH1e0ggndUBptxjuGJcRLS/uhVKMTYjkb8V5UgMo9EFPAGQZv7uyffnP0Ztd/EUhCEoU2O1ctdmJ2aPbpd2Ig/QTcKKVec0dyhJ5LG+x3cOMGtxu15ROsb/LG8zDYVAwmRPy1+jc6equFxp50IJWQ0ZxmnMARVZPhLnap/ndyt6dOwefOGKnj9jw4lp01UUzEvwSA+jhFt57h6QLvSeGEM69L9P+HBYsOBqTwDE+nDvPbSKRgeRc7oR9A2RoNZElxVe1UMb1DwTyBXSoxgIWvzBgkTaHgS+G5lncEkIbtAxl7WvvZ3sN6UCE9n3WA373UPMA6CecIgmD+CkoAGOY9UqmGZ1SQXNlRbgPQEolk+WS/j237YwV4PwBNQNZ6EpYFmGZ6yQ7jurgAIwCOu0lpbzBs6MuUAbdbriMZWYyWK89ogp3vXYY9ymM6bwasy0DlYmlCz5IuKepruP+vN8nj+HhbA5i9ODZIiq+sA2L8h97hOovqL6JEQuLWOIC0WUesgFTcAZgpn6IyT8BKQNxNR6s4n07Y2B1bA+kdLx/tB+/A/utWRGJrs9gZayYAlJfJFMRPJQr3+I+YaZbX+UTuEJM/dVY/C8QsxWdSowQMkYyBisw8IHlIMYRcC34VtPWOB0o43Cy4Soc9YAwdMJPJWaLidoxDELfQ858fV/zmVYzeE79pCLRenzsjmH9arrn2q+Ok1VqqC63Qmlvxbu8Qw1JDBuvYbCbsjfIPQs8jeizf2psEl2hbyO+ZKclW6jnxvhRXwQLK7NA7y9cGBFunQi7uad0zscwQ8etNhYbBjrlVklb4saW2zwj7KL1E1o5hdUb2V4UtaIhYayY83sQiASeLLLfHTzGcYR0sZf4GQNXZ88sSO/fCvJGTCUoSCeiIGEyPCeTTXrLQyWZ4Jf/jmeaMd8n1nUk/L8NNGqaEnLgacjxxC+PJ7FGfsw4mlrOhlNkEmhvbTt7U6WJ1JICjV8ePin1Qb6tz6aIHtPOTWQCFirdZ2LFFwJhR1Et5cGvjrmaLtCNL1dNVPruAnLfDh81TRV0mIOvb6lw89wRM8OqDjRVMJ3KCSshC1aDOOEi5wZLBNzwtkOvzJdZvwtsLYWHYa50pE6fV9IFe5v62i2R5mbdUPsglhPJjwsQpZjoBUC4ktWpLjbFOe8+27dpSEzBm+Ht8KrcZvvRjIl2ERgtrhjoOrdwZZ/h87qDDoU8dyqVBAQJjkVFBKnXEcOkftvdTd2+XvdlZEejq1eqwOmpMBpvC1KK1d+bK6qbZXGgmdXxyy0NRuUftXB/kb24qCWqg1ev5Qu1wayHdEvWG4T4WWCHCKD15iTK9tAQd2ymnGjE+2nlQLvuATgZLxLMI,iv:4r3cUqQtQam0l5SUgtDUgSpdY1Rd8kbqNU9oclSMHl4=,tag:iM4TNQTpzgpsQkkc++YVGg==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkR1hQTk9pWFZMYlQzKzNG\n WnlMcGYxZEhNOTB2TnEzOFhxTVY4SDhubVZBCmN6c1BLbmYxTU1zUHJOMTlIeDU2\n T2tuT0M3ZXlxSW5pWTRtOUdBYjZlUFEKLS0tIFVBT3F4a1RwejJpdE9uWENLWWxE\n UHZSNFUzQ1ZvN3Q1ODJEWmRJMHRhNkUKI3gsgABTCJo6KKiimfT7W7xOFzwnjUwR\n 33TH2eoZhjsEKCnjiLfp7VES+DQXwNOyaH08BHhQx1zBvZZDDW9XGA==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2026-01-19T21:02:34Z\"\n mac: ENC[AES256_GCM,data:xLm9Mks2x8EH9CT8PHiNG8RVpe7LdtplZKoWqzeYKNgrGckAyDgY1E65N8Y3rMAN9lDOGlfp3xzBHQOeEKwQzgiN29uJaa1QV8AGb73Osg54fEys0hy1o0FftGKnL9IzoU7i77tF2zrPdqY8zpd7CCS7kL+7dn1p1aWqoxW+wWQ=,iv:b7/We1YriVr1X0bsHq0Xfz3YJ+jT3pp35TcTDU7r79w=,tag:Xp9MmUCZgoheyPW3wsMadg==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/foldingathome/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: foldingathome\n namespace: foldingathome\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/foldingathome\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/foldingathome/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - namespace.yaml\n - helm-release.yaml\n - secret.sops.yaml\n" }, { "path": "cluster/homelab/apps/foldingathome/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: foldingathome\n" }, { "path": "cluster/homelab/apps/foldingathome/secret.sops.yaml", "content": "apiVersion: v1\nkind: Secret\ntype: Opaque\nmetadata:\n name: app\n namespace: foldingathome\ndata:\n ACCOUNT_TOKEN: ENC[AES256_GCM,data:LcKIHKwY1R5a8caYEKOuWQqdQ5Eind01SB7JQ++u7aiZzMGKbnh10d5LKj7MuNYYtAgravRRX72i+RlE,iv:QHRc+xJOtsDXAgGNKKD7boYK58tubA9k52uItz7y1cQ=,tag:uLZOK1mAaRzRK/pnI+oIJg==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5aXJGYTRXQ0FWSTFIbzdM\n ckJvbTlsbUkzMHRxNFhZRG1ZTjcrb2VTMlZRCldrZVMvaGdBa0psZTN3cEJIYUdo\n MTVYMEl2bTNLUXIwQ3cxSlByWnRMejgKLS0tIERQOHBDUlN4c1AvbmxiaTlvVkJl\n L2E4aHBKdWNzODFFVmZ5SWRCSTZLUUUKmNROIHloB2wL/WV2ef+4Zccjrxoq6AOr\n 2oZav4A65XSSWkx7rOCJb+M9L017I0l3C4yLXup3fK5fTM0sC6oMNw==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-12-14T10:03:19Z\"\n mac: ENC[AES256_GCM,data:QAKqLDW8xT/M3IgXAZM5K5unKn+0VwVPwtmHzh9+oTPqjosPrq+6jFLLMhxIPtMyafM1bz+2hfzQ2V7+atpT4ZZc7pj/iRgG4Q+uu7cpIZ1bnwzG8+yancJfJoRywL3a9CG3YBP0K7JMYqU9/WkOkGIZMe+7ENxoeYr0c6phsrM=,iv:YzRQxBzMEngdrGzaBodP16KNnf4xtd1bjhK4+nLUTk0=,tag:EEG53rEB1VUYvU7DEWThcw==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/freshrss/cnpg.yaml", "content": "apiVersion: postgresql.cnpg.io/v1\nkind: Cluster\nmetadata:\n name: cluster-postgres\n annotations:\n backup.velero.io/backup-volumes: pgdata\nspec:\n instances: 1\n\n imageName: ghcr.io/cloudnative-pg/postgresql:18.1\n\n storage:\n size: 10Gi\n\n podSecurityContext:\n runAsNonRoot: true\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n add:\n - NET_BIND_SERVICE\n - CHOWN\n - FOWNER\n privileged: false\n readOnlyRootFilesystem: true\n runAsNonRoot: true\n" }, { "path": "cluster/homelab/apps/freshrss/gateway-api.sops.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: freshrss-internal\n annotations:\n gethomepage.dev/enabled: ENC[AES256_GCM,data:gCd/qg==,iv:PrIwNYNYihjU1sxKguhm4Of2EJ5RV+rFXm7c7C9lPCo=,tag:quSplKJRnCtYMgaJQckoaA==,type:str]\n gethomepage.dev/description: ENC[AES256_GCM,data:rxXU1oRTZiLDnA==,iv:qoKeesKlrezQ1hqNmKeumpZuWFJPBp9Vk8CEne/gRJs=,tag:vyLyCia/wUgF2Oakm+APdA==,type:str]\n gethomepage.dev/group: ENC[AES256_GCM,data:sidRrC3PVkr9,iv:U+8XzY0udoXlr2L/DT/QtzVCSk+YgCoA9jvHUw8elDQ=,tag:84+WOUIXdhTB9KvCH/QPzA==,type:str]\n gethomepage.dev/icon: ENC[AES256_GCM,data:8S0y5kyMb9I=,iv:3xptRnbFzc1+cyYKS/MQcP+CN8becz2F5zvXC6mPCuc=,tag:4+qbmrqZ8BmvENX9ZuxToA==,type:str]\n gethomepage.dev/name: ENC[AES256_GCM,data:YmFMnEQpOrLQ,iv:AiwUeoeqoXdfTLGjRzYkPzMITN2bX+RJ4PsDd0zl8uk=,tag:EPR16Pr7fFAUwMqj0iokeg==,type:str]\n gethomepage.dev/widget.type: ENC[AES256_GCM,data:bXt+imc9Hjo=,iv:nltD3/EI1UGaHN3P7VUkIVyWC3jGybGsN/4IWirEWAM=,tag:t+jwIrzlMMRso3hd6s4O6A==,type:str]\n gethomepage.dev/widget.url: ENC[AES256_GCM,data:KFnW5e895Wt29jBPdqJVrrM/VdevCyfoNx5Z,iv:3yr7y+GvAutZY0N8eOmQE2ioXIVEKWn/cLVU2Yl4qKw=,tag:xBfMUIjB0CJl9cMTU2Snsw==,type:str]\n gethomepage.dev/widget.username: ENC[AES256_GCM,data:V9bKaz6Q,iv:Xdnft/QvqqM++LO5GSOGiUc6wQ1TMfO5AnDAmGbsE0o=,tag:c8hofYDlKUja/NRY1HMbGw==,type:str]\n gethomepage.dev/widget.password: ENC[AES256_GCM,data:yMhsd5gilYq0kAxsgGADfPPJ3A==,iv:NRram8s+gVjelwuM0CGI1mOHnO3r7sepop5BPeHEUYg=,tag:i9xqK4Vpoc/nN6NcDS1/RA==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArL0VRWkF2YmtVQU1JaXBT\n YlRrOUMyRVJoVkIxMTNUT0Q1dkd6cnV5VlhrCkl2U0VqZW9aZnlqeExpanEra09R\n MmpOVGVpQW00czVTTENrVGt1TXJta0kKLS0tIGtrUHg1ekVqczJoNWp6NEVVTWFM\n S3JjZ3Evc3MwbzQreGp4S0pkSnlMSm8K0q8CXCy/wrUXoZeC6aA90D/n36JDaXda\n cZrooeCRbadIFwWGV+fyvpcN/WKCLupSlJ4IOhDn62zZzBOx6Nb6Pg==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2026-01-19T17:43:05Z\"\n mac: ENC[AES256_GCM,data:l4q97MmKjDtpMv0VIOB2p71FjlQ8iYk5aKQVyG2UohySS6EUsYWomajZLyrotX1EtX9dwN9XQgMhA0JAC0TYOfQ6wf6bfa203++Z0Z3L00Ba0fEQjEQuFmdtkMglochuYZyRxyP/YPppdCRX6CZnNZsf6FXTzBTfKHKQC6fX6Bo=,iv:Wox9C2HYSsq3J+JTCZ3rVWCSqJ9mOHte9ldpsmG2qcQ=,tag:fTGHRcvoggHiEbAYaDrFDA==,type:str]\n encrypted_regex: ^(rules|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/freshrss/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: freshrss\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/freshrss\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/freshrss/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: freshrss\nresources:\n - namespace.yaml\n - helm-release.yaml\n - gateway-api.sops.yaml\n - cnpg.yaml\n" }, { "path": "cluster/homelab/apps/freshrss/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: freshrss\n" }, { "path": "cluster/homelab/apps/garden/deployment.yaml", "content": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: garden\n labels:\n app.kubernetes.io/instance: garden\n app.kubernetes.io/name: garden\nspec:\n replicas: 3\n selector:\n matchLabels:\n app.kubernetes.io/instance: garden\n app.kubernetes.io/name: garden\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: garden\n app.kubernetes.io/name: garden\n spec:\n restartPolicy: Always\n priorityClassName: critical-priority\n affinity:\n podAntiAffinity:\n preferredDuringSchedulingIgnoredDuringExecution:\n - podAffinityTerm:\n labelSelector:\n matchLabels:\n app.kubernetes.io/instance: garden\n app.kubernetes.io/name: garden\n topologyKey: kubernetes.io/hostname\n weight: 1\n containers:\n - name: garden\n image: ghcr.io/michaelpalacce/garden:v4.1.1769964525\n imagePullPolicy: IfNotPresent\n resources: # Initial run requires a few more resources\n limits:\n cpu: 500m\n memory: 51Mi\n ports:\n - name: web\n containerPort: 80\n securityContext:\n capabilities:\n drop:\n - \"ALL\"\n add:\n - CHOWN\n - SETUID\n - SETGID\n env:\n - name: PUID\n value: \"1000\"\n - name: PGID\n value: \"1000\"\n - name: TZ\n value: \"Europe/Sofia\"\n livenessProbe:\n failureThreshold: 10\n initialDelaySeconds: 10\n tcpSocket:\n port: 80\n timeoutSeconds: 2\n startupProbe:\n failureThreshold: 20\n timeoutSeconds: 2\n tcpSocket:\n port: 80\n" }, { "path": "cluster/homelab/apps/garden/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: garden-external\nspec:\n parentRefs:\n - name: external\n namespace: istio-gateway\n hostnames:\n - \"garden.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: garden\n port: 80\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: garden-internal\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Personal Gaden / Second Brain / Blog\n gethomepage.dev/group: Personal\n gethomepage.dev/name: Garden\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"garden.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: garden\n port: 80\n" }, { "path": "cluster/homelab/apps/garden/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: garden\nresources:\n - namespace.yaml\n - deployment.yaml\n - service.yaml\n - gateway-api.yaml\n - pdb.yaml\n" }, { "path": "cluster/homelab/apps/garden/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: garden\n" }, { "path": "cluster/homelab/apps/garden/pdb.yaml", "content": "---\napiVersion: policy/v1\nkind: PodDisruptionBudget\nmetadata:\n name: garden\nspec:\n minAvailable: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: garden\n app.kubernetes.io/name: garden\n" }, { "path": "cluster/homelab/apps/garden/service.yaml", "content": "apiVersion: v1\nkind: Service\nmetadata:\n name: garden\nspec:\n selector:\n app.kubernetes.io/instance: garden\n app.kubernetes.io/name: garden\n ports:\n - name: garden\n protocol: TCP\n port: 80\n" }, { "path": "cluster/homelab/apps/go-ddns-controller/configMaps.sops.yaml", "content": "kind: ConfigMap\napiVersion: v1\nmetadata:\n name: cloudflare-config\n namespace: go-ddns-controller-system\ndata:\n config: ENC[AES256_GCM,data:ByjuPiSK+tPXtb+UqYPt/BNh0JX6MkOzEFpxKH3ujW0gqLECWvwSqUflV5ovB3g26E5GoWSi5ni3ZGwfZ1nLffj6ITZ3qPm8oEpT/BygRct6PS0l7CBP5NeHQLYhrZYydOZ5t0lTwBp1XiQO194O2HY2KmMiNDReG4cS1zIhDBWXK3dgce5Uw/LEHC9+Kuh0u99cRuHr64xWrE6aCFKOr9Za2BMk7Gd0oMTUVQ3HLltWYMo9nT7ioNoVcLSdblwPVmC+hui+fWKUKm8Ty0xPNOVCStdYo7MdeiCC3s8yr1wuju4cnp37NixRCsN9f62atJ9cLbw69cYNNln+vFP5mkgUTwndxAXt6iERBhe+xpAZRCIhrCH3rAkGehNCZOwNvoDIYnAOjNBtY4i8CeP5FIIrWKoJmWTvC1dy/CJ6hPkFBTs7H0D38+jatFaij0HgI/+nfeJWa+3RvtlfwMTnSYTrbqqdiD6LEhLeHednJfZAgZdrnc5RYhEHgNbEqZdEQfxl0UfKeu8YC7xgXThWUVDbxuaVdEk533LW2RGobymcAIsNjk1gDFA9w8opAbg8z/ax/HdEQJd5COLGbeCXRkS+8cgY7SxXsAgpuUbS5XSZhWtcsr8HubwV4FkyTg8nTe1WPxIpl6llCTzDjPOCN5iCFbDDtdi9JMn5ysDMkRAx71Axj6+cSjRFT5mVCczyb2IZbec/0IKN17sYcRf3ZaXGS3J18QUkgIolhBK/myazTCNjuAEYo13UP9UmF9fLV0HfKadOHRe9iymGcTYfrpP4BiQRa9c/5TbyyqnbUfUUVwj7TCcBHDzqs8qQwuLhE7iuxGQtHYFbTJrt6G3uvoL+bXRHfxcArwoJT5aW6I7DgvmFsNSemtPrVTDTNXMcuJ7ULPJhrGXEVNgDyDNml3r0jZAZNiE6SwvMoofw+Vt3HvboRcPfqUBu5K0z7tKTUQM38Y3AD7sb0xlIws/xXEmmD31lBC7hzySROmHciZHMfX6nHT54Ne66/jp48cpf8gsW1eaeg6cG9FMwE2HqqPtkAWp+c9JHKa3dPYgvzU+FIE3v7BUPM6F3FoL/bq8sCONF4QH8TF9LyIeScUVEZToKy6tmEGbT6oHokRXQSf9mc3ZUEzVsaWzkTkn2XlzDfmuYdgecvFLqy7cQj0TKi8Tn1+PduuUolpB1wPMyuKniYc6/YEb1BR//F51EburURGITW4gTVclEvfDXjucUySzAe+tahQJVoBfq5M/wOVZgxOgT60mil06cVj78jIPNkeYbH57n5sPZHdGIwZZBAdhL5c0CHre9kOUpxNtYlNlFNsjyI16rQ/kS1YykgIY6AmBHwqqb39FKeDl/EisCNrLMDbVBfu0O7HmJAM78xxRscXGjZwVsr0JmGeNjS8Ndb3VcaSJTOkPE38f0C0Y5Z2rSkMDfYMHt7HDzQ4BD8cvFN3hZVIy+EoGLHOxleh4gtQvuS8TpbfDrNg94UwwY0KWgSZJ/ZTc0QdqAIq1+D3mSuWXd+Tq3IYX9aLdry7LtXDrA1LOuAZI44uFsP4Vv1ogMbXWqzCsnhaKoL+zbGUbTmsS7TEwK7aElKzzfvW/9miFNwQqtYqCvzuzHkhLtHN8mdznbQ6acpcg3pEyDlToMH1cAQ0Ma3wwk45R64Y6AJASs,iv:c+YDZfQnJqdEmVJo8ocfmz9qSAUGJIiCgR6rrPhkDlM=,tag:0/e2HSxSwQxMdi+2Dyx9rw==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwbVAxOU9EekpINmVDbmg4\n aGM4aGlpbkVzNVp3akFwdGtCVllvbzNVOFNzCmVmUG85OTBiMFY3b05kNzFrd0kv\n UWJNLzlpWmQ5enNBa1dHVXo3dTdQZk0KLS0tIHVoWTF1cm1oUXRhRWZiQmtqYnc1\n WU50WnI0K0oyeDJTek9JY2ozZVR6aHcKhO6jXhMH04+g97aVYqGhpNW/0aMnfP84\n F9ibzn8HSYA4pzaMth16BhE6SSXZzGq8wYiyOYRasawS6EfaaT+LuA==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-12-24T17:08:07Z\"\n mac: ENC[AES256_GCM,data:A4V58CbIin6h7K87gu8d5XFrhgE1+VNkGsbZw73Ok080Vd4jp1qInuBL47SIwO+KK9bne50GeAi5ECtnn+qmBRV24s4oEn1qblj5WAjarpim/Uj4171yj0i7GoHkhy43cSXF4tKl5DS6kCQHK0UlFJCgCkCnLcK7NqgdEVV+gaU=,iv:0RFXBrK6hnAcUONyTypZ/gSzhu2f1LsMVXV6xTdkd38=,tag:oKfvTpmjdznBV8V5xiMdYg==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n---\nkind: ConfigMap\napiVersion: v1\nmetadata:\n name: webhook-config\n namespace: go-ddns-controller-system\ndata:\n config: \"\"\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwbVAxOU9EekpINmVDbmg4\n aGM4aGlpbkVzNVp3akFwdGtCVllvbzNVOFNzCmVmUG85OTBiMFY3b05kNzFrd0kv\n UWJNLzlpWmQ5enNBa1dHVXo3dTdQZk0KLS0tIHVoWTF1cm1oUXRhRWZiQmtqYnc1\n WU50WnI0K0oyeDJTek9JY2ozZVR6aHcKhO6jXhMH04+g97aVYqGhpNW/0aMnfP84\n F9ibzn8HSYA4pzaMth16BhE6SSXZzGq8wYiyOYRasawS6EfaaT+LuA==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-12-24T17:08:07Z\"\n mac: ENC[AES256_GCM,data:A4V58CbIin6h7K87gu8d5XFrhgE1+VNkGsbZw73Ok080Vd4jp1qInuBL47SIwO+KK9bne50GeAi5ECtnn+qmBRV24s4oEn1qblj5WAjarpim/Uj4171yj0i7GoHkhy43cSXF4tKl5DS6kCQHK0UlFJCgCkCnLcK7NqgdEVV+gaU=,iv:0RFXBrK6hnAcUONyTypZ/gSzhu2f1LsMVXV6xTdkd38=,tag:oKfvTpmjdznBV8V5xiMdYg==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/go-ddns-controller/git-repo-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: go-ddns-controller\n namespace: go-ddns-controller-system\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: ./charts/go-ddns-controller\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: go-ddns-controller\n namespace: flux-system\n values:\n image:\n repository: ghcr.io/michaelpalacce/go-ddns-controller\n tag: v1.1.3\n controller:\n replicas: 3\n resources:\n limits:\n cpu: 100m\n memory: 512Mi\n requests:\n cpu: 10m\n memory: 64Mi\n" }, { "path": "cluster/homelab/apps/go-ddns-controller/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: go-ddns-controller-system\nresources:\n - namespace.yaml\n - git-repo-release.yaml\n - secret.sops.yaml\n - configMaps.sops.yaml\n - notifier.yaml\n - provider.yaml\n" }, { "path": "cluster/homelab/apps/go-ddns-controller/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: go-ddns-controller-system\n" }, { "path": "cluster/homelab/apps/go-ddns-controller/notifier.yaml", "content": "apiVersion: ddns.stefangenov.site/v1alpha1\nkind: Notifier\nmetadata:\n labels:\n app.kubernetes.io/name: go-ddns-controller\n app.kubernetes.io/managed-by: kustomize\n name: webhook-notifier\n namespace: go-ddns-controller-system\nspec:\n name: Webhook\n secretName: webhook\n configMap: webhook-config\n" }, { "path": "cluster/homelab/apps/go-ddns-controller/provider.yaml", "content": "apiVersion: ddns.stefangenov.site/v1alpha1\nkind: Provider\nmetadata:\n labels:\n app.kubernetes.io/name: go-ddns-controller\n app.kubernetes.io/managed-by: kustomize\n name: cloudflare-provider\n namespace: go-ddns-controller-system\nspec:\n name: Cloudflare\n secretName: cloudflare\n configMap: cloudflare-config\n notifierRefs:\n - name: webhook-notifier\n" }, { "path": "cluster/homelab/apps/go-ddns-controller/secret.sops.yaml", "content": "kind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: webhook\n namespace: go-ddns-controller-system\nstringData:\n url: https://discord.com/api/webhooks/1175178233185046619/nHQnEuID5QxLD2uqRatDpyT0TD9GhBJfAOQS548S6HW2hrCMyQw0P6smN34-dB9WVdY2\n---\nkind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: cloudflare\n namespace: go-ddns-controller-system\nstringData:\n apiToken: i6goSPMYlroTEdJoPhn2VyjPSxiInQg1hh-UpNOL\n" }, { "path": "cluster/homelab/apps/gotenberg/helm-release.yaml", "content": "apiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: gotenberg\n namespace: gotenberg\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: gotenberg\n version: 1.21.0\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: maikumori\n namespace: flux-system\n values:\n image:\n repository: gotenberg/gotenberg\n tag: 8.32.0\n" }, { "path": "cluster/homelab/apps/gotenberg/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - namespace.yaml\n - helm-release.yaml\n" }, { "path": "cluster/homelab/apps/gotenberg/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: gotenberg\n" }, { "path": "cluster/homelab/apps/homebox/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: homebox\n namespace: homebox\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: ./Helm/apps/homebox\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/homebox/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/apps/homebox/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: homebox\n" }, { "path": "cluster/homelab/apps/homepage/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: homepage-internal\n namespace: homepage\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"homepage.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: homepage\n port: 3000\n" }, { "path": "cluster/homelab/apps/homepage/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: homepage\n namespace: homepage\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: homepage\n version: 2.1.0\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: homepage\n namespace: flux-system\n values:\n image:\n repository: ghcr.io/gethomepage/homepage\n tag: v1.12.3\n\n # Enable RBAC. RBAC is necessary to use Kubernetes integration\n enableRbac: true\n\n serviceAccount:\n # Specify a different service account name\n name: homepage\n # Create service account. Needed when RBAC is enabled.\n create: true\n service:\n main:\n ports:\n http:\n port: 3000\n\n controller:\n strategy: RollingUpdate\n rollingUpdate:\n maxSurge: 25%\n maxUnavailable: 25%\n\n # Enable the ingress to expose Homepage to the network.\n ingress:\n main:\n enabled: false\n\n # All the config files for Homepage can be specified under their relevant config block.\n config:\n # To use an existing ConfigMap uncomment this line and specify the name\n useExistingConfigMap: homepage-config\n\n persistence:\n logs:\n enabled: true\n type: emptyDir\n mountPath: /app/config/logs\n\n env:\n - name: HOMEPAGE_ALLOWED_HOSTS\n # This value must be set\n # ref: https://gethomepage.dev/installation/#homepage_allowed_hosts\n value: homepage.sgenov.dev\n # resources:\n # requests:\n # memory: 10Mi\n # cpu: 10m\n # limits:\n # memory: 200Mi\n # cpu: 500m\n" }, { "path": "cluster/homelab/apps/homepage/homepage-config.sops.yaml", "content": "apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: homepage-config\n namespace: homepage\ndata:\n kubernetes.yaml: ENC[AES256_GCM,data:mBALaNiFgQE3ZplU8GbWaelfUUIbE3x3dzEmqw==,iv:BBF8cTL0h2J8bC1GiCVP/SKkEhg6gU1FsSesqQxtPLc=,tag:SYWPS5po3G8G8roc8YqYHQ==,type:str]\n settings.yaml: ENC[AES256_GCM,data:gizV0E2Z3BDVpXXw/m2xcdqb4bkxpdE0y/p5FkjdRzwh7KFWchRhqelLvEZCYzGXsArSK2qm9Ts19RIZ0XHTDrdvN1+FnEupQKm13pvMRe0MDqVAv2+WNOvQ5+jFVxMjQcdRetF4xfx/Qk66xFh0Y9FbufgH5eLrCTKeoM9m5L8L7wcgToWOk/iGlAqG3cfGmSSx7MnmkwEw8smARCPRqCu++P8Shke/WC2ssI8H+faKhCUDoYrPrnwdT77kzR7z5YktdmBDq0D6nJSD2VIrk5wdQ2hJEecl6/bYv8l5UdH60d/H2+ic4/9TlYdH9SqZAE8a4DPR7qQavbognRbraikWWSv24YV/U+BhMQb/bPy0Snzt7DmtdrRutgAIvPZtg20Rmbyj6r8hWiVJ4bBn2OoGP7YLrCgGWIDtE3jQFSFp8XXkZfShxkxXK65efRRYo3LgjVGPokNvDzGPU6vgkZnNV3uTgvIy5OxB0wlpKR6jMVPCfdugQPKeod4bBFgtx9ut9/m+rDas8gxdlyRFyLIStY6+zLVh28Fj+UPb5++WCW7h3fFavAETwKqxLTeQCz4oYVu1+G0InXXQxx2w0/PHGKGMDd8V8eLsS2brf5+ucqU9xWbKE9ywAgYIcFjS+XPATUxyMOrL1014rPKeWbZ4I3W1aA8LPemFmo+IfsO8Rn7OilV7LkYRrRBvVY3fMbRVjVqzpCnfpZ+jOIc++l9VUdynRl/9rTFJwiE5yoU+UxUlRa3pG2bejuPV2m1KFMspZE451OXVv8blkY0MDQp21xx4o5WAi0XLBamX/GGGwpHnPHxL8r6l194=,iv:yiwZ+MzaBOqAtJicwyeOThNBOvgo5Au8SQv4/nbhrP4=,tag:RxjtSq2Ir6EZh2H+Ajqi1g==,type:str]\n bookmarks.yaml: ENC[AES256_GCM,data:ync13dJ+NIiLPX18exnzaaFW4Ff5dbC7v2PmWalXevunnPM7OI43/V4HPgqu2XEHXe2fS6M5AYUVyngLRiJ40GI/+xfL2PXRr/QCxt0xU1REcjZCEl63CQiZysGIDclVX+EEGY0yWTTNsaI4MxTOW5ioYen0znT6F+vx7E0IjkoGARpfxE9yLfxI2rr1NeLiufVEcfX1mo1gfHyFiTEUKT0T6P88iKMKFRowTm1Ra6wAwMlhGoxc1ufKUn2dOHpYAmCFiy6vZTXeHn42YttvBEMhINsBRE4ZFVzDm+jMLwQoeVLevkLqCMligGV+0WFUdqfqrxMH26+eGEyTH+Yrd9vGKLztUM5H2uqbOSAec+AyTxSBd70ISabYyIsaaANZufIGMC/XsTRz0+hCLq2xFTR1LR2/Rc1IUOIWD8xf/YxADyBjgcRhQF6032naXrdaeFcVqu9vjRtoCAlgpENFJw==,iv:gw9AgZgimjkE3ZLXXugM+L0od6HykTtNjwTk8NGkcK4=,tag:V0IA1i+QVkKVbmWh/Rx+qA==,type:str]\n services.yaml: ENC[AES256_GCM,data:86Wok2ueEIvi0j6xV3JRN+65uuoQcQWmRvKORi3CKGGbNrgpfszCu6hdkHHEB+c8yTZnrbylII5MGfifWX+H24ZUTZXGM3IzbbaWRfvqn3BWbbYrnUfLnqVYP4ZGOCYtr3FfUPwbRj3R0bZAzq1BKy5nKtVEf94Ot7L5yabu4/h5vKumy2Mg6oTAfcwqJ/GB/2WqCmUu+zSXg4Crb4VPbowFyh2+fN82CA3xvmtYPdEgP0joieVsoarV4yAHfAWMvMGoMlHZq+wJXMKAdaxZm5velvw2zFKh6WCl3OXe5OdbYsJ7QJJDUJb/QqZ7W0xLQuwnP+/g+P0j3gKiSKATdDlCsnIgMoi5dOjsSrWMFnMkfYG6NN5JRXaKUOqvcMuNvZP4QqTrpKIukORXi5Mlrimk+ZAroEel+ZrMmi41mrK0E29T6ZZJA000rvkAu6Bf+hbss/UET3FqJcMbgAf/rlSBwGbsBBag1doUEUlElDZDb+QawtitsekF4DCZb2hw8m8y/cr6qtpWbrCbjQ2nLOnG9DdAS2lv5l+thmbmr/9MgiN5lcIj7aP6DP2QwCfIGrRNXFGoUJkICAjpDqaP5KVhtk5VgORZ87ZQQzA0VeF67Yb5d1IpCVvtUFCYQssUD+Ow45vOTjgbQEJRi9diqieGSDzdAdkHvN5YE0UqmiipEiSMP6WTyCuag41JZtaKyP+vD3pLabhI/UY3jGHuNCBL+2dxxgSLI2B2iVopFXtHqdX53uL/U7ycWi/GLVCWyaatKj5CszNeTVnJJ3oUejmwUzsgOpvMsdpbv94A18wmVS/kB/YushewwALkF0qnJz4rfBzumr8a/kazHssdBaqu73zGAeMfLxbGQ1eY8UasBNhkwgT20l8MB/8YhqFZwDpTS3804c1ILs6krgGu+R0WvFKzjGQ55LoKxDBRVrr8wQruouP8VQjLq+9IIg2Vz0iOZwUoGHrdaHRLXVrksuP4pJJIduRYhWeef5MGtBj5VsSN285ehFoywKnP7ZuqqX6h4jAEHahJRtFZ42q2ivRSF3WOfjW7f6ujfp9atlQ54ZVYU/4L1M7vOwthVgF/Ynsw3Cf7Ahu5httz5uTKiipGh8oiMmjlqwesb/vyMP0ehtY1z9uJDRzgaNIbgKcGs5eJwCuG/X4rU/2c2FUEKd7NSc5ckMkNyJU3Lk3kySJCJsTYmDy+CXuo0foJV/7bxekrr/1QphDN6+JVEeqsA57zI2lxnik3W1la1YgbuwfGJ0o2EVZZTpOHHgaNH/YQ/gWYAkZlITEFAroR6UVaYSL+iZeYH2g/IUaPL5lXTnmKa15gyeiX0FTCnFzJzkLzYzuMuWNagnXzr1OYNOnn4YLhV5DquAlBZxXBdIKYRX6gDzWHIzoqF85OYUTkKipWp37KR8FE1pQomPaIuoC+oaUG+H5+Ex7cCin6RMAsr6uu4NIAWlQlpl/Z8CqT3Rm4EUScGv6C+v3gcHh09dIIDYNGyqpIBRBed+kGRI1TnB19ii68FFetbIQ3D7r5L/Gs9LvN57NDr9LnmV/kB6D3bcIgopYb3qFzvtv33fnWs/SxCZDmYQ8KgLUt06NKuSk+p3Joipgma2z9B+mHAxbgJ6b9K4leRabSSBOGp5Ye5HdpdlrtZBTSu3j204SVgyhqR+hqNsdTxpajTCHVfw3yKqRd7IYcgHWdVECEFevWlgo1tq4zyEbwjprbNCGzBBYlLU2z+2E7/mLZpNhTGHblPBEqGxAMJF2l2FFkr4rtcxDRTEprMawRYV67sHN5smgUhrkMsQCTyb/c4zLZUL2CMrYZVVny7bjjx34DiSzrGex1GfAPjEOJ5e8hGG7qg0cQqGcg5s92mEHXw1crg6ITrB4WIs2Fq8BD7m/swokbF+p/YlEsU0W9mmHjh/Ib5tOS/bhYN7mlY3ZcUBAwcd+JSz6AyXp9+BJf5H9GQCWe3qE98mS3+MZeu77BmpMnidozSnFiUd46UVw=,iv:pSUJPZTjVHBwUXIkBOn0tD8L9WWjO22JxG56SEiQoRI=,tag:UejsdYL0BqKziAjf+wPv7g==,type:str]\n widgets.yaml: ENC[AES256_GCM,data:V0SXnKIrqHizOI4ZcUOnE69fqLurqxKLgQ6/r/ldnhbE18PJQT3hMfEuV9FG3K1nSlv0zkWczSWTQEd2hevt6/+oXKLf82JJ/B1CoaeIkxkUDIKYFo4C0vlmwmblSHYL/uP6IJzf7D+kfXshbEcYubfzqGPnp3YXY11MwgrHMIUnspdml0GsygxHgtSODeM3rTKwacF5desH4GH371+s2XnJ39iuAbUNU70Op0qs4eF7cDqagGyhMlVD9jxZ3wfSFadFva2VcX8qz0GpBdZjNNElavz95JNVdT+NXvSbXbxbmDM0NUI8SbtRW8cKSwJW4z/urO3r0wbhP0TdPrDfDP6yXZCd8HzDPXmKnt3UdK9LQ8kDZKBQiRuhC8UGS6s84D7GMJRvSZajDT5pWSCTfltVK8O0rbS6zNpVp1anwYJf9Ec+vAH1eGBsN0Cbqak38vm5Dyp5vlfcvMF2rhes8xghFwsP0DDe4Gz36mBMH7JMOMS7Lw0XrREHFBGSykB8g176Py6WTSqzWA95OMLcC3udxMeArf4ItdAiBhYkd1+P4l+kgyWPQlcu1MOwJrHxbdqjKWN96p0tQ0NSWFpz5V7aNmVWSmGUasK3gmnvyeDCBfjXW5e8/VMZLjMn0lI/c6MVcOiOVDwlT0kkVVIX1mSeg+T2T+uaT+IB73UZNZyK45LWBt11yjl1LMsuUbBQyZrAu2+MPeWxfk1akJspiC8uaPib1sjAvTr2efjzjvCwoscYdVwHsoCIRJmOwW2Ij21czlLNlHvUPCNcLc0TwNVHo7zX/XhBA126PboTNXYE38l8EWAYTLrGikm0HZXcUnGnv2IxJdFYpGYIIJfp13g2VJigRTI//AEL/oV8Ca0ohEEHxbAjXFgLmO8FZecqom6pcqfo/B0ksY5fd3srFgvZHKLFiDBcAFpqL9+7HGPyuddQGXLDoODkJwohhKXoO/7F7FXgUa0X2RQPrOLO3r9+wAqM+aqL6DVmzx0gRdAJmY7CCsclzlT8jb7VyB8Ok287fE9kLhQ/mSJgn0jmbZ6Eo6UX6AbvNUTYM+yXRF9jkKDVjdXT2RDNNEcfpDzo2i3w05XXHx4azq6eF0pp24BoY1bpMsuFAIDIL8p/j+x444BDlq2I/YjitGjYeT25/M9d1Rtk+BrLZQzKbIZeaKGCkLMgzaQUyk3ONp4VtjuxFz1ZtxHZvoIDyfhG7qdNRmrBgRczFMIaRpOu7uKd+nAOuD2Xz8mpNk9SjFyG/cntketSYsl+DtXyTGXXBZKr+df52TyJo2F7YMXVY3WRkk217s0zigwxQqUb+LK0++JN6fvQ0iTqAiFFztSsIkiDCbPZK30A1Jr8canmgKW3NEhqhEnjmiMAugGQkphixEM3pTRVmpIydnLx3jzqOnwQ2hJBgPGf48GQub5A4VlrvmpKs9e/JRrouDEwKpS8rG+IYycrmAOFI91D3YwJW8zPnVvMC+Po0q9OMPdJYsbDnTbPA1VE/+6c+iRmSM33e196tSGSUO2cgcPpel6Fe0rHzxLq6u/H2fW1vg==,iv:kxNQUSSQsZgvBi7dDFE87I3msWHoXdss3QySzMABW/k=,tag:JQcn+FkkIeGy+ZneapreUw==,type:str]\n docker.yaml: \"\"\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzRk5DeUNab0F4QThlYnJ1\n OGRDRkVRQTdTNWZKbnBNWVNoSCtuT2dBOG5NCmVzVlR5VWF3aUxQREZ2ZGtZVmha\n NzFscExCbFg5eXNnRG1kVWF4S25vcDAKLS0tIG4zVjMzTG43K1dMc2V1V3EzTmJE\n bGdpbDdPQk9ZTWZOOWNPOTJTeFBsWHcKdnvn4//LIMPtpU7QsPxe+Ui457PV5mam\n AUr8KWITUXCWwwzD3S4kHedWuSP84cKhIwb7dZNH2ArpIaDfJvLZrQ==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2026-01-02T07:58:59Z\"\n mac: ENC[AES256_GCM,data:rprg+YNFIuU+97n6hpzJdGSN4skmTAyb6vNGTsGPeeO7hAeexswXqHFIdYpkOqaSpDNQoaI3I8sBLD7nGf38d2hV3A940Bs41OO6JUsKvu7JpiR78XzUCTCcXqtI+SR+dS4k4WG8m7s4BXTbAbIdQHf0DdjZgM4eOxQbQwKuhYE=,iv:lmjKnae4IurmaNgGQIX9wG6jcxbA51BS/Be85KU/N98=,tag:Z9epc5M8OUoksEuvtZhJhQ==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/homepage/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - namespace.yaml\n - homepage-config.sops.yaml\n - helm-release.yaml\n - gateway-api.yaml\n" }, { "path": "cluster/homelab/apps/homepage/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: homepage\n" }, { "path": "cluster/homelab/apps/it-tools/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: it-tools\n namespace: it-tools\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/it-tools\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n values:\n ittools:\n replicas: 3\n" }, { "path": "cluster/homelab/apps/it-tools/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/apps/it-tools/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: it-tools\n" }, { "path": "cluster/homelab/apps/koffan/deployment.yaml", "content": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: koffan\n labels:\n app.kubernetes.io/instance: koffan\n app.kubernetes.io/name: koffan\nspec:\n replicas: 1 # Uses SqLite, so only one\n strategy:\n type: Recreate\n selector:\n matchLabels:\n app.kubernetes.io/instance: koffan\n app.kubernetes.io/name: koffan\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: data\n labels:\n app.kubernetes.io/instance: koffan\n app.kubernetes.io/name: koffan\n spec:\n restartPolicy: Always\n containers:\n - name: koffan\n image: ghcr.io/pansalut/koffan:v2.10.0\n imagePullPolicy: IfNotPresent\n resources:\n requests:\n cpu: 128m\n memory: 128Mi\n limits:\n cpu: 512m\n memory: 512Mi\n ports:\n - name: web\n containerPort: 80\n volumeMounts:\n - name: data\n mountPath: /data\n securityContext:\n capabilities:\n drop:\n - \"ALL\"\n add:\n - CHOWN\n - SETUID\n - SETGID\n env:\n - name: PUID\n value: \"1000\"\n - name: PGID\n value: \"1000\"\n - name: TZ\n value: \"Europe/Sofia\"\n - name: APP_ENV\n value: \"production\"\n - name: PORT\n value: \"80\"\n - name: DB_PATH\n value: \"/data/shopping.db\"\n envFrom:\n - secretRef:\n name: app\n startupProbe:\n exec:\n command:\n - wget\n - --no-verbose\n - --tries=1\n - --spider\n - http://127.0.0.1:80/login\n initialDelaySeconds: 5\n failureThreshold: 30\n periodSeconds: 10\n livenessProbe:\n exec:\n command:\n - wget\n - --no-verbose\n - --tries=1\n - --spider\n - http://127.0.0.1:80/login\n initialDelaySeconds: 15\n periodSeconds: 20\n readinessProbe:\n exec:\n command:\n - wget\n - --no-verbose\n - --tries=1\n - --spider\n - http://127.0.0.1:80/login\n initialDelaySeconds: 5\n periodSeconds: 10\n volumes:\n - name: data\n persistentVolumeClaim:\n claimName: koffan-data\n" }, { "path": "cluster/homelab/apps/koffan/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: koffan-external\nspec:\n parentRefs:\n - name: external\n namespace: istio-gateway\n hostnames:\n - \"koffan.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: web\n port: 80\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: koffan-internal\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Shopping List\n gethomepage.dev/group: Personal\n gethomepage.dev/name: Koffan\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"koffan.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: koffan\n port: 80\n" }, { "path": "cluster/homelab/apps/koffan/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: koffan\nresources:\n - namespace.yaml\n - deployment.yaml\n - service.yaml\n - gateway-api.yaml\n - secret.sops.yaml\n - storage.yaml\n" }, { "path": "cluster/homelab/apps/koffan/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: koffan\n" }, { "path": "cluster/homelab/apps/koffan/secret.sops.yaml", "content": "kind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: app\ndata:\n APP_PASSWORD: ENC[AES256_GCM,data:F6auiB0LASmPXwp4dIRuV1QMbKDGI1cAKzOuito/obH0NGkr18ejhKacuH6Knssr,iv:b30R/IGlh1c5Ntrf3JtVFlQwOmHdVdkfnV1JWhOgFDk=,tag:I1X/eFaD8WX6HytsHGN8og==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0dGZoVVMzVXFOd282K0NQ\n TTdjdnczMW5kMGZHVzNwS1VnYUl4RWUvakdJCkZDQ0V3YTIzRW9CTzl6dW5JTWM3\n YzR1K2UwNGFSalhUWGJzcXUxRlVxdjAKLS0tIGU3TkhvNUxYT2VBcVdNR1lNRXFj\n STlmT1pDeCsvWkl4QmVPd3U2YUpwNHcKLZh9be/LzmsO+ymI2HVwkHL2AnnvITo3\n H0r/qlXZEiblgjyWQGt8LoEid9SMl0wJsxzNGWAemnuGmJpMUnIiQQ==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-12-30T08:03:56Z\"\n mac: ENC[AES256_GCM,data:3d/7Yl99wez6a5fx01g09V2B/3v3UkzCOld7hV6s3VAyPY/w6PxD+TB1aj2wOblHlTJ8eQemw2djHZHstH0Na4CMJ1VIG5U3CP+jbcIiQPoFikVltRrruG+f2FcHHUKSqHcMPya2JbRH2knsikMEh0NoeS+PVdOu8hZ6KX5Qlvc=,iv:t8OWfyNl9uxMPX9ST+zJ44vDHYdIv/8x7ntDePB7Loo=,tag:+gIFW8byRpG2VOc4KQCzBg==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/koffan/service.yaml", "content": "apiVersion: v1\nkind: Service\nmetadata:\n name: koffan\nspec:\n selector:\n app.kubernetes.io/instance: koffan\n app.kubernetes.io/name: koffan\n ports:\n - name: web\n protocol: TCP\n port: 80\n" }, { "path": "cluster/homelab/apps/koffan/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: koffan-data\nspec:\n accessModes:\n - ReadWriteOnce # It's Sqlite, so not a good idea to be many!\n storageClassName: longhorn\n resources:\n requests:\n storage: 1Gi\n" }, { "path": "cluster/homelab/apps/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - adminer\n - bentopdf\n - cert-manager\n - changedetection\n - cyberchef\n - diagrams\n - firefly\n - freshrss\n - foldingathome\n - garden\n - go-ddns-controller\n - gotenberg\n - homepage\n - it-tools\n - mazanoke\n - mealie\n - media\n - n8n\n - nodered\n - openbooks\n - linkwarden\n - observeability\n - paperless-ngx\n - reactiveresume\n - replacedby\n - koffan\n - storage\n - tika\n - uptimekuma\n - vikunja\n - website\n - homebox\n - networking-toolbox\n # - wallabag\n" }, { "path": "cluster/homelab/apps/linkwarden/cnpg.yaml", "content": "apiVersion: postgresql.cnpg.io/v1\nkind: Cluster\nmetadata:\n name: cluster-postgres\n annotations:\n backup.velero.io/backup-volumes: pgdata\nspec:\n instances: 3\n\n imageName: ghcr.io/cloudnative-pg/postgresql:18.1\n\n storage:\n size: 10Gi\n\n podSecurityContext:\n runAsNonRoot: true\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n add:\n - NET_BIND_SERVICE\n - CHOWN\n - FOWNER\n privileged: false\n readOnlyRootFilesystem: true\n runAsNonRoot: true\n" }, { "path": "cluster/homelab/apps/linkwarden/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: linkwarden\nspec:\n interval: 5m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/linkwarden\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n values:\n linkwarden:\n replicas: 3\n" }, { "path": "cluster/homelab/apps/linkwarden/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: linkwarden\nresources:\n - helm-release.yaml\n - namespace.yaml\n - secret.sops.yaml\n - cnpg.yaml\n" }, { "path": "cluster/homelab/apps/linkwarden/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: linkwarden\n" }, { "path": "cluster/homelab/apps/linkwarden/secret.sops.yaml", "content": "apiVersion: v1\nkind: Secret\nmetadata:\n name: app\n namespace: linkwarden\ndata:\n NEXTAUTH_SECRET: ENC[AES256_GCM,data:/k2eA3k1yEqHvFsGHFuundeRLR8SUwcpcEvetEDK0TUSpJEO78lqq4j/bgk=,iv:bMGuh6IL+8bEqxPLS4qwmGpYllNfkOCt9uriumVPJOA=,tag:w/VkMIi++RTMItODLMix2w==,type:str]\n NEXTAUTH_URL: ENC[AES256_GCM,data:oKC9Gq7Ji8QIo5EU1V6rxg/qiLE+YbzrsJD3pX0l1Kau3Zm5y3q82yT+MUtNGZLoSsr7j4uQiNWeUtK+XsOhVA==,iv:f63jEvj5tOaG9eiDOR8UBXNHTc+INe2YohuEQ+THKww=,tag:wxaIe2H2HdOYqW0rh2/e1g==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXaDdBeCs0WERaVjFjcEl5\n bjRGdDZNQmZaSy9UU0VvSmlCcURUU3FCcTNBCklJdW1yYlVOYkNMWGpNMUkyWDZD\n cVZjUGxPM2hCM0lRRURDOVgySkxGQ2sKLS0tIHdPQ0xQMzRpRC9DYVd5UEVUV0Vn\n SnI5c3ZWZXdzR2xPdGRtRmYvekVVVncK/8lqfCwGw4058wMGPj8jiFeOW1bt+Da9\n gckT/pu7STTMPIqHPCzNzMRZUNQbuLjqepwGLv0+qzwi/nfhObO+nQ==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2026-01-19T17:23:38Z\"\n mac: ENC[AES256_GCM,data:+zznqsa5tQd0j4voUsq0eqLAtSa4xoSTrH5e9QKOK+BKRLGm9WRixeJz3kp9TBLqNf0KxfreUMDj/HwlgsGfrDkeGa47wxv0CCurX2wK3nmbjq9dGeL1XQEDdSDSWIhilWHsYz+T8PXrTn96JCwdDBs9nv9Cm0VtgMEdtyOnscc=,iv:IGHcUrKb/3MyeRcGzSULCNOqok3ukeJmDOBT116vRVE=,tag:CEuxbRr6obobVBmXugcBrQ==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/mazanoke/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: mazanoke\n namespace: mazanoke\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/mazanoke\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/mazanoke/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/apps/mazanoke/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: mazanoke\n" }, { "path": "cluster/homelab/apps/mealie/gateway-api.sops.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: mealie-internal\n namespace: mealie\n annotations:\n nginx.ingress.kubernetes.io/proxy-body-size: \"0\"\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Self-hosted Recipes!\n gethomepage.dev/group: Knowledge\n gethomepage.dev/icon: mealie\n gethomepage.dev/name: Mealie\n gethomepage.dev/widget.type: mealie\n gethomepage.dev/widget.url: https://mealie.sgenov.dev\n gethomepage.dev/widget.key: ENC[AES256_GCM,data:6NLdB8Rv5Odp4eZ2osXaxoUJ5MRta3JcPEI5F8vmTVx480PVBiQ5E19Hqsmg/k1BDueZsl7B5EpjaqfikoNcw0nXEwGVh/LGnJk+2w/HI4/MtgIROg7UTn6DkVLbcCAhpXVRm7a0NpBNau+sQnf+HB5TPeMmxp1e7nJvgg922eiMH0kQq2urJszY+FqHaHQltw2W4NuoTxEaT9/UBc/IBTj000N2A8rW0BrWXKuyUhzIECF7BbJy/DNRSRwJDVuOuWsMO/UwUoC/fKG2cJdfYLPWZuF1CgoYS6DJ0SNsFx+5C7A3GijvZKwwOTxa+ZGigBueVeVGmNs=,iv:GnCnhG7VL/mneIpAsBqBXStRBFSgS2ickNicG6pZa64=,tag:7b7GIEAGmWdkIfb4ueqoiQ==,type:str]\n gethomepage.dev/widget.version: \"2\"\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtSmwrR2Z1L2JXd28xUEpq\n K1lhSWo1dEdaUHF2bjdpYjBHMWlySEExTXpjCkkremhKaC82b2RGYi9wcW04WTR6\n L3BxVmxPaXdBVXh1NHc0WFFsWUZQWDQKLS0tIDFwR1hnTUovOTFyVUpacmxJSkRu\n YllZRVlETlhSL0c1T3ZWMDA1RHIrbjgK8AJi7u+479LRLnBz4CWntoODZn6Vn9sN\n s5ry2zh8P38/wSrCvGwCY3ULg5k9NK3iZH+eKqPEkPOKJpK7XcSrPQ==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-11-16T14:07:24Z\"\n mac: ENC[AES256_GCM,data:OUc0vT0MrWjsqrAXu06Gf7nnXWPiqWe1a1J5OR71G3i51JG1IY2IgBmL2xbTQIY61qqOehlTK9PdwvYC0aAnH24LGxrflRcYbzMZNHo94gM1su5lf6bOMw+M1otN96mOeZK53gD0WSSoi5uCLKjxBBSR8OcuzfTPDvREp3Tm+78=,iv:9RYie7V5HRCVmWz9Ys8jojLTnXIMse9Y4NAKjK0JGO8=,tag:0L2L76aHDbqsqQFBncwl0w==,type:str]\n encrypted_regex: (?i)password|webhook_url|token|key\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/mealie/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: mealie\n namespace: mealie\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/mealie\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n values:\n mealie:\n replicas: 3\n" }, { "path": "cluster/homelab/apps/mealie/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n - gateway-api.sops.yaml\n" }, { "path": "cluster/homelab/apps/mealie/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: mealie\n" }, { "path": "cluster/homelab/apps/media/gateway-api.sops.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: sonarr-internal\n namespace: media\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Shows Downloader\n gethomepage.dev/group: Torrents\n gethomepage.dev/icon: sonarr\n gethomepage.dev/name: Sonarr\n gethomepage.dev/widget.type: sonarr\n gethomepage.dev/widget.url: https://sonarr.sgenov.dev\n gethomepage.dev/widget.key: ENC[AES256_GCM,data:bfeU3jlvlGBqdw1MLCMsZQJOjTxUumteaSRA5e8U9Y0=,iv:6ufc5sNocrleBXVzHWTtTkcf51pBZR5sDp1dUwXpMGw=,tag:JreJG5LgDQgpF25paa35yA==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxL1FSdG9yL2VFVFcwQURk\n ZVJCV0JDQXlCSTQvdXFtOS9sWE9tM0JRTmlvCktKVHNBVnAvM1R0SXArRFVjOXM1\n cFpOdytCZGI5akRRR2hPL2tnRUF5VUkKLS0tIDRSSFJxbFIyMGtDNjBPcnhHbzcz\n UFFvWXhRZjQvdmlSZVNXWHBPQWlLTlEKqGbJ34MVRiQqJe9eAFdWki0fUd5TORNH\n govtKf9SiYLuts+hoA2R9PkO83wUhPkBf09+6fJh9R/6xumAS1Rarw==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-11-16T15:25:41Z\"\n mac: ENC[AES256_GCM,data:0VSodsbV0RiQZa7xasf/OwywYDujDai0+/U4TfrG5BL1WxzvDDKkxt3BQ4T++Q0jTZKbFo1WTaZm3LYHLEEA6zEvU70FiMbiz6GL7DV/0LxK3tWjwADmDxsGQ/RDk89xIo7hWH7+4BT34px8gEXqc0fc0bU6yHhsIRtCJ4diJHs=,iv:ns+7lEJqUxICiLiXnXYBjeUqgK7DHbszeamivD7h/Tk=,tag:m1BatitxoO9LjjVvpWBWKg==,type:str]\n encrypted_regex: (?i)password|webhook_url|token|key\n version: 3.11.0\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: kavita-internal\n namespace: media\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Book Reader And Tracker\n gethomepage.dev/group: Media\n gethomepage.dev/icon: kavita\n gethomepage.dev/name: Kavita\n gethomepage.dev/widget.type: kavita\n gethomepage.dev/widget.url: https://kavita.sgenov.dev\n gethomepage.dev/widget.username: stefan\n gethomepage.dev/widget.password: ENC[AES256_GCM,data:yFIFFGLiDf9+CUdPuYxbBCr1uVLmz0pdvLlaW5DarjPhc2WsNOl0IGsF,iv:dcIoXceoga3mDqZKjqGXDqL7Hwd9Ba+m2uHFKcI1m1s=,tag:HLRuyfEXHvW2xFoiFXzWPA==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxL1FSdG9yL2VFVFcwQURk\n ZVJCV0JDQXlCSTQvdXFtOS9sWE9tM0JRTmlvCktKVHNBVnAvM1R0SXArRFVjOXM1\n cFpOdytCZGI5akRRR2hPL2tnRUF5VUkKLS0tIDRSSFJxbFIyMGtDNjBPcnhHbzcz\n UFFvWXhRZjQvdmlSZVNXWHBPQWlLTlEKqGbJ34MVRiQqJe9eAFdWki0fUd5TORNH\n govtKf9SiYLuts+hoA2R9PkO83wUhPkBf09+6fJh9R/6xumAS1Rarw==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-11-16T15:25:41Z\"\n mac: ENC[AES256_GCM,data:0VSodsbV0RiQZa7xasf/OwywYDujDai0+/U4TfrG5BL1WxzvDDKkxt3BQ4T++Q0jTZKbFo1WTaZm3LYHLEEA6zEvU70FiMbiz6GL7DV/0LxK3tWjwADmDxsGQ/RDk89xIo7hWH7+4BT34px8gEXqc0fc0bU6yHhsIRtCJ4diJHs=,iv:ns+7lEJqUxICiLiXnXYBjeUqgK7DHbszeamivD7h/Tk=,tag:m1BatitxoO9LjjVvpWBWKg==,type:str]\n encrypted_regex: (?i)password|webhook_url|token|key\n version: 3.11.0\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: prowlarr-internal\n namespace: media\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Torrent indexer\n gethomepage.dev/group: Torrents\n gethomepage.dev/icon: prowlarr\n gethomepage.dev/name: Prowlarr\n gethomepage.dev/widget.type: prowlarr\n gethomepage.dev/widget.url: https://prowlarr.sgenov.dev\n gethomepage.dev/widget.key: ENC[AES256_GCM,data:kzoEUfFLJiGJDIfhK6PxzjsARStbmjYsM4/quTEnAN0=,iv:TzD2xe4/aHqYRIX6asXnFak9eiJ+pkw14VuCHx+1lX4=,tag:Sr/I7eJLVdYTKaSMlAzYQw==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxL1FSdG9yL2VFVFcwQURk\n ZVJCV0JDQXlCSTQvdXFtOS9sWE9tM0JRTmlvCktKVHNBVnAvM1R0SXArRFVjOXM1\n cFpOdytCZGI5akRRR2hPL2tnRUF5VUkKLS0tIDRSSFJxbFIyMGtDNjBPcnhHbzcz\n UFFvWXhRZjQvdmlSZVNXWHBPQWlLTlEKqGbJ34MVRiQqJe9eAFdWki0fUd5TORNH\n govtKf9SiYLuts+hoA2R9PkO83wUhPkBf09+6fJh9R/6xumAS1Rarw==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-11-16T15:25:41Z\"\n mac: ENC[AES256_GCM,data:0VSodsbV0RiQZa7xasf/OwywYDujDai0+/U4TfrG5BL1WxzvDDKkxt3BQ4T++Q0jTZKbFo1WTaZm3LYHLEEA6zEvU70FiMbiz6GL7DV/0LxK3tWjwADmDxsGQ/RDk89xIo7hWH7+4BT34px8gEXqc0fc0bU6yHhsIRtCJ4diJHs=,iv:ns+7lEJqUxICiLiXnXYBjeUqgK7DHbszeamivD7h/Tk=,tag:m1BatitxoO9LjjVvpWBWKg==,type:str]\n encrypted_regex: (?i)password|webhook_url|token|key\n version: 3.11.0\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: radarr-internal\n namespace: media\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Movies Downloader\n gethomepage.dev/group: Torrents\n gethomepage.dev/icon: radarr\n gethomepage.dev/name: Radarr\n gethomepage.dev/widget.type: radarr\n gethomepage.dev/widget.url: https://radarr.sgenov.dev\n gethomepage.dev/widget.key: ENC[AES256_GCM,data:3iEFMaCr8U1v4lBK96oTTcImID5PpHQ//2R2xcyYBgo=,iv:ruU1zFTrnaIKX4lFePwj8cOEjjDpK+cgsdG0R1BXGVY=,tag:9bywyp9yOU+gAIHwWBtMuQ==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxL1FSdG9yL2VFVFcwQURk\n ZVJCV0JDQXlCSTQvdXFtOS9sWE9tM0JRTmlvCktKVHNBVnAvM1R0SXArRFVjOXM1\n cFpOdytCZGI5akRRR2hPL2tnRUF5VUkKLS0tIDRSSFJxbFIyMGtDNjBPcnhHbzcz\n UFFvWXhRZjQvdmlSZVNXWHBPQWlLTlEKqGbJ34MVRiQqJe9eAFdWki0fUd5TORNH\n govtKf9SiYLuts+hoA2R9PkO83wUhPkBf09+6fJh9R/6xumAS1Rarw==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-11-16T15:25:41Z\"\n mac: ENC[AES256_GCM,data:0VSodsbV0RiQZa7xasf/OwywYDujDai0+/U4TfrG5BL1WxzvDDKkxt3BQ4T++Q0jTZKbFo1WTaZm3LYHLEEA6zEvU70FiMbiz6GL7DV/0LxK3tWjwADmDxsGQ/RDk89xIo7hWH7+4BT34px8gEXqc0fc0bU6yHhsIRtCJ4diJHs=,iv:ns+7lEJqUxICiLiXnXYBjeUqgK7DHbszeamivD7h/Tk=,tag:m1BatitxoO9LjjVvpWBWKg==,type:str]\n encrypted_regex: (?i)password|webhook_url|token|key\n version: 3.11.0\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: overseerr-internal\n namespace: media\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Media Requests\n gethomepage.dev/group: Media\n gethomepage.dev/icon: overseerr\n gethomepage.dev/name: Overseerr\n gethomepage.dev/widget.type: overseerr\n gethomepage.dev/widget.url: https://overseerr.sgenov.dev\n gethomepage.dev/widget.key: ENC[AES256_GCM,data:q1Mwyvee4pxLpc5QkIM/CuQN96X1FMxGQildNhMituLCSyuJYpnTZDE+mIPnIxK0SrujC0bwHdHtaqMU299q1lGIkyM=,iv:iKpFg5XZfTvL/n8ti7BgvbVSuDWbLvkWp3Ay85O2aoQ=,tag:cGLDf1NuOpdWAqnGcmGjZg==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxL1FSdG9yL2VFVFcwQURk\n ZVJCV0JDQXlCSTQvdXFtOS9sWE9tM0JRTmlvCktKVHNBVnAvM1R0SXArRFVjOXM1\n cFpOdytCZGI5akRRR2hPL2tnRUF5VUkKLS0tIDRSSFJxbFIyMGtDNjBPcnhHbzcz\n UFFvWXhRZjQvdmlSZVNXWHBPQWlLTlEKqGbJ34MVRiQqJe9eAFdWki0fUd5TORNH\n govtKf9SiYLuts+hoA2R9PkO83wUhPkBf09+6fJh9R/6xumAS1Rarw==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-11-16T15:25:41Z\"\n mac: ENC[AES256_GCM,data:0VSodsbV0RiQZa7xasf/OwywYDujDai0+/U4TfrG5BL1WxzvDDKkxt3BQ4T++Q0jTZKbFo1WTaZm3LYHLEEA6zEvU70FiMbiz6GL7DV/0LxK3tWjwADmDxsGQ/RDk89xIo7hWH7+4BT34px8gEXqc0fc0bU6yHhsIRtCJ4diJHs=,iv:ns+7lEJqUxICiLiXnXYBjeUqgK7DHbszeamivD7h/Tk=,tag:m1BatitxoO9LjjVvpWBWKg==,type:str]\n encrypted_regex: (?i)password|webhook_url|token|key\n version: 3.11.0\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: transmission-internal\n namespace: media\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Torrent Handler\n gethomepage.dev/group: Torrents\n gethomepage.dev/icon: transmission\n gethomepage.dev/name: Transmission\n gethomepage.dev/widget.type: transmission\n gethomepage.dev/widget.url: https://transmission.sgenov.dev\n gethomepage.dev/widget.username: username\n gethomepage.dev/widget.password: ENC[AES256_GCM,data:GxMPFslgFxA=,iv:ZqAxDXcnkMo/EaCEL0DacDmGWXf+duVGJ4HcMTwsLeA=,tag:EeSOa86hS4qUlJofcBYC+g==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxL1FSdG9yL2VFVFcwQURk\n ZVJCV0JDQXlCSTQvdXFtOS9sWE9tM0JRTmlvCktKVHNBVnAvM1R0SXArRFVjOXM1\n cFpOdytCZGI5akRRR2hPL2tnRUF5VUkKLS0tIDRSSFJxbFIyMGtDNjBPcnhHbzcz\n UFFvWXhRZjQvdmlSZVNXWHBPQWlLTlEKqGbJ34MVRiQqJe9eAFdWki0fUd5TORNH\n govtKf9SiYLuts+hoA2R9PkO83wUhPkBf09+6fJh9R/6xumAS1Rarw==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-11-16T15:25:41Z\"\n mac: ENC[AES256_GCM,data:0VSodsbV0RiQZa7xasf/OwywYDujDai0+/U4TfrG5BL1WxzvDDKkxt3BQ4T++Q0jTZKbFo1WTaZm3LYHLEEA6zEvU70FiMbiz6GL7DV/0LxK3tWjwADmDxsGQ/RDk89xIo7hWH7+4BT34px8gEXqc0fc0bU6yHhsIRtCJ4diJHs=,iv:ns+7lEJqUxICiLiXnXYBjeUqgK7DHbszeamivD7h/Tk=,tag:m1BatitxoO9LjjVvpWBWKg==,type:str]\n encrypted_regex: (?i)password|webhook_url|token|key\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/media/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: media\n namespace: media\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/media\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/media/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n - gateway-api.sops.yaml\n - ./shelfmark/\n" }, { "path": "cluster/homelab/apps/media/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: media\n" }, { "path": "cluster/homelab/apps/media/shelfmark/deployment.yaml", "content": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: shelfmark\n labels:\n app.kubernetes.io/instance: shelfmark\n app.kubernetes.io/name: shelfmark\nspec:\n replicas: 1 # Uses SqLite, so only one\n strategy:\n type: Recreate\n selector:\n matchLabels:\n app.kubernetes.io/instance: shelfmark\n app.kubernetes.io/name: shelfmark\n template:\n metadata:\n annotations:\n backup.velero.io/backup-volumes: data\n labels:\n app.kubernetes.io/instance: shelfmark\n app.kubernetes.io/name: shelfmark\n spec:\n restartPolicy: Always\n containers:\n - name: shelfmark\n image: ghcr.io/calibrain/shelfmark:v1.2.3\n imagePullPolicy: IfNotPresent\n resources:\n requests:\n cpu: 128m\n memory: 128Mi\n limits:\n cpu: 1\n memory: 1Gi\n ports:\n - name: web\n containerPort: 8084\n env:\n - name: PUID\n value: \"1000\"\n - name: PGID\n value: \"1000\"\n - name: TZ\n value: \"Europe/Sofia\"\n - name: CWA_DB_PATH\n value: \"/config/app.db\"\n - name: INGEST_DIR\n value: \"/books/Other\"\n securityContext:\n capabilities:\n drop:\n - \"ALL\"\n add:\n - CHOWN\n - SETUID\n - SETGID\n livenessProbe:\n failureThreshold: 5\n initialDelaySeconds: 30\n timeoutSeconds: 2\n tcpSocket:\n port: 8084\n startupProbe:\n failureThreshold: 10\n timeoutSeconds: 2\n tcpSocket:\n port: 8084\n volumeMounts:\n - name: books-data-nfs\n mountPath: /books # This is where the books will be downloaded and ingested by your book management application\n - name: config\n mountPath: /config\n - name: downloads-data\n mountPath: /downloads\n volumes:\n - name: config\n persistentVolumeClaim:\n claimName: shelfmark-config\n - name: downloads-data\n nfs:\n path: \"/volume1/k3s/media/downloads\"\n server: \"192.168.1.39\"\n - name: books-data-nfs\n nfs:\n path: \"/volume1/k3s/media/books\"\n server: \"192.168.1.39\"\n" }, { "path": "cluster/homelab/apps/media/shelfmark/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: shelfmark-internal\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Books and Audiobooks Downloader\n gethomepage.dev/group: Torrents\n gethomepage.dev/icon: favicon\n gethomepage.dev/name: Shelfmark\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"shelfmark.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: shelfmark\n port: 8084\n" }, { "path": "cluster/homelab/apps/media/shelfmark/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: media\nresources:\n - deployment.yaml\n - service.yaml\n - gateway-api.yaml\n - storage.yaml\n" }, { "path": "cluster/homelab/apps/media/shelfmark/service.yaml", "content": "apiVersion: v1\nkind: Service\nmetadata:\n name: shelfmark\nspec:\n selector:\n app.kubernetes.io/instance: shelfmark\n app.kubernetes.io/name: shelfmark\n ports:\n - name: web\n protocol: TCP\n port: 8084\n" }, { "path": "cluster/homelab/apps/media/shelfmark/storage.yaml", "content": "---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: shelfmark-config\nspec:\n accessModes:\n - ReadWriteOnce # It's Sqlite, so not a good idea to be many!\n storageClassName: longhorn\n resources:\n requests:\n storage: 1Gi\n" }, { "path": "cluster/homelab/apps/n8n/cnpg.yaml", "content": "apiVersion: postgresql.cnpg.io/v1\nkind: Cluster\nmetadata:\n name: cluster-postgres\n annotations:\n backup.velero.io/backup-volumes: pgdata\nspec:\n instances: 1\n\n imageName: ghcr.io/cloudnative-pg/postgresql:18.1\n\n storage:\n size: 10Gi\n\n podSecurityContext:\n runAsNonRoot: true\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n add:\n - NET_BIND_SERVICE\n - CHOWN\n - FOWNER\n privileged: false\n readOnlyRootFilesystem: true\n runAsNonRoot: true\n" }, { "path": "cluster/homelab/apps/n8n/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: n8n\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/n8n\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n values:\n n8n:\n replicas: 1\n" }, { "path": "cluster/homelab/apps/n8n/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: n8n\nresources:\n - helm-release.yaml\n - secret.sops.yaml\n - namespace.yaml\n - cnpg.yaml\n" }, { "path": "cluster/homelab/apps/n8n/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: n8n\n" }, { "path": "cluster/homelab/apps/n8n/secret.sops.yaml", "content": "kind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: app\ndata:\n username: ENC[AES256_GCM,data:J5v0auXQKy8=,iv:cPS0FnTR9RmUFn8mNOD1vJZFjOQy1R5Cn1Rf7mcdyr0=,tag:pDwNONHnnXZE1aqadI3Pcg==,type:str]\n password: ENC[AES256_GCM,data:naJ50Z5z4aM=,iv:+gAKRlfLvuf9yInTV7qVuKsVdNGCsZAmhgpEeO1fnmU=,tag:q2A+YG1SK9GKnjW8mx7tZg==,type:str]\n encryption_key: ENC[AES256_GCM,data:2UsEOImit7ahSSeq64wjkQ==,iv:Fia1/5E1mfhlEJJpdhLQXi0qIQlP0sNDCOTFkwPfrKw=,tag:VwtqBnw55iesY/DWrHVUzw==,type:str]\n maxFileSizeMb: ENC[AES256_GCM,data:kh0DFA==,iv:H0yvXfwUWXj8kDcks6uwVr8UdtdZ8K36OM4D9Ygyylw=,tag:9UJSpTYCXicdCNZDvZQYpQ==,type:str]\n type: ENC[AES256_GCM,data:y+z8y0xkHcsbofXTvUhpnA==,iv:nWEU6WIR6bNWd0bww5c9sGfGAfTSN08D3bnlJdTUrHg=,tag:Q4VOKDeW2VRSNSzfR3ZB4Q==,type:str]\n host: ENC[AES256_GCM,data:HuF7TW87812O4JV8whD8fQ==,iv:NgkAjb5G38svEDdZkkhwo3FXgv9bDC3I5VdVR1ti89U=,tag:Aqv1GFG11fl5xKhqYDR1gA==,type:str]\n port: ENC[AES256_GCM,data:i8fqnkYu7eY=,iv:KZHINX2pdNkT+DybWTcoZUEb7HPWQ2zQGnmpw2+f9dI=,tag:jpn/MMDIP3KyGM+P/VpWZQ==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVUdSeDN5ZThGRWhURXdB\n NGZkNnlzeDJpUXdHcW04U1IzdENKSHY3L2drClpyRnhIcExFWXpLYnNLU0lmcWRJ\n dEF1eWtLTm10OHZJcUloTHc2M3NZZWMKLS0tIHFUT2tmZURJZ2hiNjBjRUw0czJ6\n SHhERGFkZHhkTSs4SEFEZUFSdFRNbk0KApOph5mFVaxVSrsK7s5anOuQ4XcHdjXX\n tG/ROAVjiTuOihQoOHE3cjc4CaYPIVqw3oSR6te/gP8EdEjCJ3kDag==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2026-01-18T19:42:18Z\"\n mac: ENC[AES256_GCM,data:9noguTP8TDOmRh/09zMWLAlRzc0opftrfKXmTSQWbRnOhINC1wQktdziNlH0C8lWlCJ5TVxj5b+P85UWsvXbQLvScxZeiLlZb0iUAUdAu/VIDA4NAdbPcpUpnzSXeIqe7NUtT8CLpi1qTj+NYIkr6dLvf4CN4+2lnNhw30j6SPk=,iv:BWRV+UNd/OGWQP3zy0+Faxkk+BqWX04PGKAwhNxmiF0=,tag:YXFKEedjk+PO+76JKvorlw==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/networking-toolbox/deployment.yaml", "content": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: networkingtoolbox\n labels:\n app.kubernetes.io/instance: networkingtoolbox\n app.kubernetes.io/name: networkingtoolbox\nspec:\n replicas: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: networkingtoolbox\n app.kubernetes.io/name: networkingtoolbox\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: networkingtoolbox\n app.kubernetes.io/name: networkingtoolbox\n spec:\n containers:\n - name: networkingtoolbox\n image: ghcr.io/lissy93/networking-toolbox:1.6.0\n imagePullPolicy: IfNotPresent\n ports:\n - name: http\n containerPort: 3000\n env:\n - name: NODE_ENV\n value: \"production\"\n - name: PORT\n value: \"3000\"\n - name: HOST\n value: \"0.0.0.0\"\n resources:\n requests:\n cpu: 100m\n memory: 100Mi\n limits:\n cpu: 200m\n memory: 200Mi\n livenessProbe:\n exec:\n command:\n - wget\n - -qO-\n - http://127.0.0.1:3000/health\n initialDelaySeconds: 15\n periodSeconds: 20\n readinessProbe:\n exec:\n command:\n - wget\n - -qO-\n - http://127.0.0.1:3000/health\n initialDelaySeconds: 5\n periodSeconds: 10\n" }, { "path": "cluster/homelab/apps/networking-toolbox/gateway-api.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: networkingtoolbox-internal\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"networkingtoolbox.sgenov.dev\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: networkingtoolbox\n port: 3000\n" }, { "path": "cluster/homelab/apps/networking-toolbox/kustomization.yaml", "content": "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: networkingtoolbox\nresources:\n - namespace.yaml\n - deployment.yaml\n - service.yaml\n - gateway-api.yaml\n" }, { "path": "cluster/homelab/apps/networking-toolbox/namespace.yaml", "content": "apiVersion: v1\nkind: Namespace\nmetadata:\n name: networkingtoolbox\n" }, { "path": "cluster/homelab/apps/networking-toolbox/service.yaml", "content": "apiVersion: v1\nkind: Service\nmetadata:\n name: networkingtoolbox\nspec:\n selector:\n app.kubernetes.io/instance: networkingtoolbox\n app.kubernetes.io/name: networkingtoolbox\n ports:\n - name: http\n protocol: TCP\n port: 3000\n targetPort: http\n" }, { "path": "cluster/homelab/apps/nodered/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: nodered\n namespace: nodered\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/nodered\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/nodered/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/apps/nodered/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: nodered\n" }, { "path": "cluster/homelab/apps/observeability/helm-release.sensitive.sops.yaml", "content": "apiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: observeability\n namespace: observeability\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: kube-prometheus-stack\n version: 82.18.0\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: kube-prometheus-stack\n namespace: flux-system\n values:\n defaultRules:\n create: true\n rules:\n alertmanager: true\n etcd: true\n configReloaders: true\n general: true\n k8sContainerCpuUsageSecondsTotal: true\n k8sContainerMemoryCache: true\n k8sContainerMemoryRss: true\n k8sContainerMemorySwap: true\n k8sContainerResource: true\n k8sContainerMemoryWorkingSetBytes: true\n k8sPodOwner: true\n kubeApiserverAvailability: true\n kubeApiserverBurnrate: true\n kubeApiserverHistogram: true\n kubeApiserverSlos: true\n kubeControllerManager: false\n kubelet: true\n kubeProxy: false\n kubePrometheusGeneral: true\n kubePrometheusNodeRecording: true\n kubernetesApps: true\n kubernetesResources: true\n kubernetesStorage: true\n kubernetesSystem: true\n kubeSchedulerAlerting: false\n kubeSchedulerRecording: false\n kubeStateMetrics: true\n network: true\n node: true\n nodeExporterAlerting: true\n nodeExporterRecording: true\n prometheus: true\n prometheusOperator: true\n windows: false\n prometheus-node-exporter:\n containerSecurityContext:\n readOnlyRootFilesystem: true\n capabilities:\n drop:\n - ALL\n prometheus:\n prometheusSpec:\n scrapeInterval: 60s\n scrapeTimeout: 30s\n retention: 30d\n retentionSize: 10GiB\n storageSpec:\n volumeClaimTemplate:\n spec:\n storageClassName: longhorn\n accessModes:\n - ReadWriteOnce\n resources:\n requests:\n storage: 15Gi\n serviceMonitorNamespaceSelector:\n matchLabels:\n monitoring.coreos.com/serviceMonitor: \"true\"\n route:\n main:\n # -- Enables or disables the route\n enabled: true\n apiVersion: gateway.networking.k8s.io/v1\n kind: HTTPRoute\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Metrics Aggregator.\n gethomepage.dev/group: Monitoring\n gethomepage.dev/icon: prometheus\n gethomepage.dev/name: Prometheus\n hostnames:\n - prometheus.sgenov.dev\n parentRefs:\n - name: internal\n namespace: istio-gateway\n matches:\n - path:\n type: PathPrefix\n value: /\n alertmanager:\n config:\n global:\n resolve_timeout: 5m\n inhibit_rules:\n - source_matchers:\n - severity = critical\n target_matchers:\n - severity =~ warning|info\n equal:\n - namespace\n - alertname\n - source_matchers:\n - severity = warning\n target_matchers:\n - severity = info\n equal:\n - namespace\n - alertname\n - source_matchers:\n - alertname = InfoInhibitor\n target_matchers:\n - severity = info\n equal:\n - namespace\n - target_matchers:\n - alertname = InfoInhibitor\n route:\n group_by:\n - alertname\n - namespace\n group_wait: 30s\n group_interval: 5m\n repeat_interval: 12h\n receiver: discord\n routes:\n - receiver: \"null\"\n matchers:\n - alertname=\"PrometheusDuplicateTimestamps\"\n continue: false\n - receiver: \"null\"\n matchers:\n - alertname=\"Watchdog\"\n continue: false\n - receiver: \"null\"\n matchers:\n - alertname=\"InfoInhibitor\"\n continue: false\n # Match everything else\n - receiver: discord\n receivers:\n - name: \"null\"\n - name: discord\n discord_configs:\n - webhook_url: ENC[AES256_GCM,data:X3JPxmLya1DAXOcF2Wye04dWuT0d5mnwarj04DL1OE5yZFCojauRzcQIF2JNV5Z4lJBWZD5LQuTQ991OS/RBCKBa3zNjoZAP1xFifGfDxTGUxEfszmNpey6porPa7jK+1bRVS7dZX7ZUIEY4Cyg8wfE9TPFDz1jKCQ==,iv:FUy+psbXPk7/m60Ui4p1ERn/mdadI+kRTatdKLAAHEE=,tag:hkUPZmQyDJ1QuRZOrBeiog==,type:str]\n send_resolved: true\n templates:\n - /etc/alertmanager/config/*.tmpl\n alertmanagerSpec:\n alertmanagerConfigSelector:\n matchLabels:\n # This is so we can create AlertManager configs targeting `default`\n alertmanagerConfig: default\n storage:\n volumeClaimTemplate:\n spec:\n storageClassName: longhorn\n accessModes:\n - ReadWriteOnce\n resources:\n requests:\n storage: 5Gi\n route:\n main:\n # -- Enables or disables the route\n enabled: true\n apiVersion: gateway.networking.k8s.io/v1\n kind: HTTPRoute\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Handles Prometheus Alerts\n gethomepage.dev/group: Monitoring\n gethomepage.dev/icon: alertmanager\n gethomepage.dev/name: Alertmanager\n hostnames:\n - alertmanager.sgenov.dev\n parentRefs:\n - name: internal\n namespace: istio-gateway\n matches:\n - path:\n type: PathPrefix\n value: /\n grafana:\n adminUser: admin\n adminPassword: ENC[AES256_GCM,data:W9cc+RM2pJtf/ce61cziwq0pNM4Aro8O240P11xu4MRXNwcAyywK9n0EyBtQGHauZM+t7g==,iv:xZEhDmF+9p5ILOgCUH9yA7uVxFucsjbAnJajTBdlxE8=,tag:dDAMCmNwX2oSzHAVliHjnA==,type:str]\n persistence:\n enabled: true\n type: sts\n storageClassName: longhorn\n accessModes:\n - ReadWriteOnce\n size: 2Gi\n finalizers:\n - kubernetes.io/pvc-protection\n route:\n main:\n # -- Enables or disables the route\n enabled: true\n apiVersion: gateway.networking.k8s.io/v1\n kind: HTTPRoute\n annotations: null\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Nice observeability graphs.\n gethomepage.dev/group: Monitoring\n gethomepage.dev/icon: grafana\n gethomepage.dev/name: Grafana\n gethomepage.dev/widget.type: grafana\n gethomepage.dev/widget.url: https://grafana.sgenov.dev\n gethomepage.dev/widget.version: \"2\"\n gethomepage.dev/widget.alerts: alertmanager\n gethomepage.dev/widget.username: admin\n gethomepage.dev/widget.password: ENC[AES256_GCM,data:/h9MONsjnnynnvz6uTHbgS2s20R09kfhbTUj6CZsCz/Daq00ZnLTRb5ZmDfqFe4Yu+xsXQ==,iv:EkzGmmbeIP9SuB+RbBsypNPEg0xQb3kSpNvdXXdavBo=,tag:tPN9Rahh1fOQiG26YOUuuw==,type:str]\n hostnames:\n - grafana.sgenov.dev\n parentRefs:\n - name: internal\n namespace: istio-gateway\n matches:\n - path:\n type: PathPrefix\n value: /\n crds:\n enabled: true\n ## The CRD upgrade job mitigates the limitation of helm not being able to upgrade CRDs.\n ## The job will apply the CRDs to the cluster before the operator is deployed, using helm hooks.\n ## It deploy a corresponding clusterrole, clusterrolebinding and serviceaccount to apply the CRDs.\n ## This feature is in preview, off by default and may change in the future.\n upgradeJob:\n enabled: true\n forceConflicts: true\n image:\n busybox:\n registry: docker.io\n repository: busybox\n tag: \"1.37\"\n sha: \"\"\n pullPolicy: IfNotPresent\n kubectl:\n registry: registry.k8s.io\n repository: kubectl\n # defaults to the Kubernetes version\n tag: \"\"\n sha: \"\"\n pullPolicy: IfNotPresent\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvd2dkWC9RbjRTTzVCcjR5\n R3h0S3kvSHA1K3VjaDhjY3BoSzlnV2Y5RTFvCkJER095MVB6VEhDMVBoNUM1TkZN\n SEFhN3k1WkRsTFUwVmhrTEhGc0g1ZlkKLS0tIEp4MFNZbkxaZGZDNTlWL0ZYMjVP\n MnZTaUoxakkzSS9yd2hxL1NrSXVoZjQKq8DBQpSfBIe+49H9T4eFXYdUi7ZRtjMd\n 1St9o6vw0RmzNqGTtczmKZs42K2Cf3gE09b40TnFWzh/1AkhtkQuNQ==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2026-01-14T23:32:11Z\"\n mac: ENC[AES256_GCM,data:RSneOamRAdxSkyLVxpZPzfmKJAQwXoFtq4ka2X1hi6TUW5CwieVxzrWScYRbYQxoySD5RoJlnsugmMHSI96TXFDtqHZAA6DYek20ettwO2vuFq8Yp9QvwGJ0ht+f042yJOWilBAdK6hnCGB07xXuS9b4L5E6UcZKBKze+9XlFZM=,iv:iAFeVBOKojgRiEvX7yh/REIYQs22ixGaMdNdzTfKeKA=,tag:tl6t6t5ijhy0bcoZ8aNYZg==,type:str]\n encrypted_regex: (?i)password|webhook_url|token|key\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/observeability/kubernetes-server-metrics.yaml", "content": "apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: kubernetes-server-metrics\n namespace: observeability\n labels:\n grafana_dashboard: \"1\"\ndata:\n new-dashboard.json: |\n {\n \"annotations\": {\n \"list\": [\n {\n \"$$hashKey\": \"object:1058\",\n \"builtIn\": 1,\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"enable\": true,\n \"hide\": false,\n \"iconColor\": \"rgba(0, 211, 255, 1)\",\n \"limit\": 100,\n \"name\": \"Annotations & Alerts\",\n \"showIn\": 0,\n \"type\": \"dashboard\"\n }\n ]\n },\n \"description\": \"If NHD is present in the name of a metric or row that means it is Not Host Dependent\",\n \"editable\": true,\n \"fiscalYearStartMonth\": 0,\n \"graphTooltip\": 1,\n \"id\": 31,\n \"links\": [],\n \"panels\": [\n {\n \"fieldConfig\": {\n \"defaults\": {},\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 6,\n \"w\": 3,\n \"x\": 0,\n \"y\": 0\n },\n \"id\": 381,\n \"options\": {\n \"code\": {\n \"language\": \"plaintext\",\n \"showLineNumbers\": false,\n \"showMiniMap\": false\n },\n \"content\": \"
\\n \\n

$k8s_version

\\n
\",\n \"mode\": \"html\"\n },\n \"pluginVersion\": \"12.1.1\",\n \"title\": \"\",\n \"type\": \"text\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"description\": \"\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [\n {\n \"options\": {\n \"match\": \"null\",\n \"result\": {\n \"text\": \"N/A\"\n }\n },\n \"type\": \"special\"\n }\n ],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 6,\n \"w\": 3,\n \"x\": 3,\n \"y\": 0\n },\n \"id\": 407,\n \"maxDataPoints\": 100,\n \"options\": {\n \"colorMode\": \"none\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"horizontal\",\n \"percentChangeColorMode\": \"standard\",\n \"reduceOptions\": {\n \"calcs\": [\n \"mean\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showPercentChange\": false,\n \"textMode\": \"auto\",\n \"wideLayout\": true\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum(kube_node_info)\",\n \"format\": \"time_series\",\n \"intervalFactor\": 1,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Nodes\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [\n {\n \"options\": {\n \"match\": \"null\",\n \"result\": {\n \"color\": \"#299c46\",\n \"text\": \"0\"\n }\n },\n \"type\": \"special\"\n }\n ],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"#299c46\",\n \"value\": 0\n },\n {\n \"color\": \"rgba(237, 129, 40, 0.89)\",\n \"value\": 1\n },\n {\n \"color\": \"#d44a3a\"\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 3,\n \"w\": 4,\n \"x\": 6,\n \"y\": 0\n },\n \"id\": 409,\n \"maxDataPoints\": 100,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"horizontal\",\n \"percentChangeColorMode\": \"standard\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showPercentChange\": false,\n \"textMode\": \"auto\",\n \"wideLayout\": true\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum(kube_node_status_condition{condition=\\\"DiskPressure\\\", node=~\\\"$Node\\\", status!=\\\"false\\\"})\",\n \"format\": \"time_series\",\n \"intervalFactor\": 1,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Disk Pressure\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [\n {\n \"options\": {\n \"match\": \"null\",\n \"result\": {\n \"color\": \"#299c46\",\n \"text\": \"0\"\n }\n },\n \"type\": \"special\"\n }\n ],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"#299c46\",\n \"value\": 0\n },\n {\n \"color\": \"rgba(237, 129, 40, 0.89)\",\n \"value\": 1\n },\n {\n \"color\": \"#d44a3a\"\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 3,\n \"w\": 4,\n \"x\": 10,\n \"y\": 0\n },\n \"id\": 413,\n \"maxDataPoints\": 100,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"horizontal\",\n \"percentChangeColorMode\": \"standard\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showPercentChange\": false,\n \"textMode\": \"auto\",\n \"wideLayout\": true\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum(kube_node_status_condition{condition=\\\"PIDPressure\\\", node=~\\\"$Node\\\", status!=\\\"false\\\"})\",\n \"format\": \"time_series\",\n \"intervalFactor\": 1,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"PID Pressure\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [\n {\n \"options\": {\n \"match\": \"null\",\n \"result\": {\n \"color\": \"#299c46\",\n \"text\": \"0\"\n }\n },\n \"type\": \"special\"\n }\n ],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"#299c46\",\n \"value\": 0\n },\n {\n \"color\": \"rgba(237, 129, 40, 0.89)\",\n \"value\": 1\n },\n {\n \"color\": \"#d44a3a\"\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 3,\n \"w\": 4,\n \"x\": 14,\n \"y\": 0\n },\n \"id\": 411,\n \"maxDataPoints\": 100,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"horizontal\",\n \"percentChangeColorMode\": \"standard\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showPercentChange\": false,\n \"textMode\": \"auto\",\n \"wideLayout\": true\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum(kube_node_status_condition{condition=\\\"MemoryPressure\\\", node=~\\\"$Node\\\", status!=\\\"false\\\"})\",\n \"format\": \"time_series\",\n \"intervalFactor\": 1,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Memory Pressure\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {},\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"continuous-GrYlRd\"\n },\n \"mappings\": [],\n \"max\": 1,\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"percentunit\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 3,\n \"w\": 6,\n \"x\": 18,\n \"y\": 0\n },\n \"id\": 419,\n \"options\": {\n \"displayMode\": \"lcd\",\n \"legend\": {\n \"calcs\": [],\n \"displayMode\": \"list\",\n \"placement\": \"bottom\",\n \"showLegend\": false\n },\n \"maxVizHeight\": 300,\n \"minVizHeight\": 10,\n \"minVizWidth\": 0,\n \"namePlacement\": \"auto\",\n \"orientation\": \"horizontal\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showUnfilled\": true,\n \"sizing\": \"auto\",\n \"valueMode\": \"color\"\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": true,\n \"expr\": \"avg(1-rate(node_cpu_seconds_total{mode=\\\"idle\\\"}[5m]))\",\n \"interval\": \"\",\n \"legendFormat\": \"Real\",\n \"range\": true,\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum(kube_pod_container_resource_requests{unit=\\\"core\\\"}) / sum(machine_cpu_cores)\",\n \"hide\": false,\n \"legendFormat\": \"Requests\",\n \"range\": true,\n \"refId\": \"B\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum(kube_pod_container_resource_limits{unit=\\\"core\\\"}) / sum(machine_cpu_cores)\",\n \"hide\": false,\n \"legendFormat\": \"Limits\",\n \"range\": true,\n \"refId\": \"C\"\n }\n ],\n \"title\": \"Global CPU Usage\",\n \"type\": \"bargauge\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"#299c46\",\n \"value\": 0\n },\n {\n \"color\": \"rgba(237, 129, 40, 0.89)\",\n \"value\": 1\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 3,\n \"w\": 4,\n \"x\": 6,\n \"y\": 3\n },\n \"id\": 417,\n \"maxDataPoints\": 100,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"horizontal\",\n \"percentChangeColorMode\": \"standard\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showPercentChange\": false,\n \"textMode\": \"auto\",\n \"wideLayout\": true\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum(kube_node_status_condition{condition=\\\"OutOfDisk\\\", node=~\\\"$Node\\\", status=\\\"true\\\"})\",\n \"format\": \"time_series\",\n \"intervalFactor\": 1,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Out of Disk\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [\n {\n \"options\": {\n \"match\": \"null\",\n \"result\": {\n \"color\": \"#299c46\",\n \"text\": \"0\"\n }\n },\n \"type\": \"special\"\n }\n ],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"#299c46\",\n \"value\": 0\n },\n {\n \"color\": \"rgba(237, 129, 40, 0.89)\",\n \"value\": 1\n },\n {\n \"color\": \"#d44a3a\"\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 3,\n \"w\": 4,\n \"x\": 10,\n \"y\": 3\n },\n \"id\": 415,\n \"maxDataPoints\": 100,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"area\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"horizontal\",\n \"percentChangeColorMode\": \"standard\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showPercentChange\": false,\n \"textMode\": \"auto\",\n \"wideLayout\": true\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum(kube_node_status_condition{condition=\\\"NetworkUnavailable\\\", node=~\\\"$Node\\\", status!=\\\"false\\\"})\",\n \"format\": \"time_series\",\n \"intervalFactor\": 1,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Network Unavailable\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [\n {\n \"options\": {\n \"match\": \"null\",\n \"result\": {\n \"text\": \"N/A\"\n }\n },\n \"type\": \"special\"\n }\n ],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"#299c46\",\n \"value\": 0\n },\n {\n \"color\": \"dark-red\",\n \"value\": 1\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 3,\n \"w\": 4,\n \"x\": 14,\n \"y\": 3\n },\n \"id\": 405,\n \"maxDataPoints\": 100,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"area\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"horizontal\",\n \"percentChangeColorMode\": \"standard\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showPercentChange\": false,\n \"textMode\": \"auto\",\n \"wideLayout\": true\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum(kube_node_spec_unschedulable)\",\n \"format\": \"time_series\",\n \"intervalFactor\": 1,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Nodes Unschedulable\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {},\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"continuous-GrYlRd\"\n },\n \"mappings\": [],\n \"max\": 1,\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"percentage\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"percentunit\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 3,\n \"w\": 6,\n \"x\": 18,\n \"y\": 3\n },\n \"id\": 421,\n \"options\": {\n \"displayMode\": \"lcd\",\n \"legend\": {\n \"calcs\": [],\n \"displayMode\": \"list\",\n \"placement\": \"bottom\",\n \"showLegend\": false\n },\n \"maxVizHeight\": 300,\n \"minVizHeight\": 10,\n \"minVizWidth\": 0,\n \"namePlacement\": \"auto\",\n \"orientation\": \"horizontal\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showUnfilled\": true,\n \"sizing\": \"auto\",\n \"text\": {},\n \"valueMode\": \"color\"\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": true,\n \"expr\": \"sum(node_memory_MemTotal_bytes - node_memory_MemAvailable_bytes) / sum(node_memory_MemTotal_bytes)\",\n \"interval\": \"\",\n \"legendFormat\": \"Real\",\n \"range\": true,\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum(kube_pod_container_resource_requests{unit=\\\"byte\\\"}) / sum(machine_memory_bytes)\",\n \"hide\": false,\n \"legendFormat\": \"Requests\",\n \"range\": true,\n \"refId\": \"B\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum(kube_pod_container_resource_limits{unit=\\\"byte\\\"}) / sum(machine_memory_bytes)\",\n \"hide\": false,\n \"legendFormat\": \"Limits\",\n \"range\": true,\n \"refId\": \"C\"\n }\n ],\n \"title\": \"Global RAM Usage\",\n \"type\": \"bargauge\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"percentage\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"#EAB839\",\n \"value\": 75\n },\n {\n \"color\": \"red\",\n \"value\": 90\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 3,\n \"x\": 0,\n \"y\": 6\n },\n \"id\": 423,\n \"options\": {\n \"minVizHeight\": 75,\n \"minVizWidth\": 75,\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"/^requested$/\",\n \"values\": false\n },\n \"showThresholdLabels\": true,\n \"showThresholdMarkers\": true,\n \"sizing\": \"auto\",\n \"text\": {}\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum(kube_node_status_allocatable{resource=\\\"pods\\\"})\",\n \"format\": \"time_series\",\n \"intervalFactor\": 1,\n \"legendFormat\": \"allocatable\",\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum(kube_pod_info)\",\n \"format\": \"time_series\",\n \"intervalFactor\": 1,\n \"legendFormat\": \"requested\",\n \"refId\": \"C\"\n }\n ],\n \"title\": \"Cluster Pod Capacity\",\n \"type\": \"gauge\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"blue\",\n \"value\": 0\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 3,\n \"x\": 3,\n \"y\": 6\n },\n \"id\": 439,\n \"options\": {\n \"colorMode\": \"value\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"percentChangeColorMode\": \"standard\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showPercentChange\": false,\n \"textMode\": \"auto\",\n \"wideLayout\": true\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum(kube_node_status_allocatable{resource=\\\"pods\\\"})\",\n \"legendFormat\": \"__auto\",\n \"range\": true,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Max Containers\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"percentage\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"#EAB839\",\n \"value\": 80\n },\n {\n \"color\": \"red\",\n \"value\": 90\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 3,\n \"x\": 6,\n \"y\": 6\n },\n \"id\": 425,\n \"options\": {\n \"minVizHeight\": 75,\n \"minVizWidth\": 75,\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"/^requested$/\",\n \"values\": false\n },\n \"showThresholdLabels\": true,\n \"showThresholdMarkers\": true,\n \"sizing\": \"auto\"\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum(kube_node_status_capacity{resource=\\\"cpu\\\",unit=\\\"core\\\"})\",\n \"format\": \"time_series\",\n \"hide\": false,\n \"intervalFactor\": 1,\n \"legendFormat\": \"allocatable\",\n \"range\": true,\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum(kube_pod_container_resource_requests{resource=\\\"cpu\\\",unit=\\\"core\\\"})\",\n \"format\": \"time_series\",\n \"intervalFactor\": 1,\n \"legendFormat\": \"requested\",\n \"refId\": \"C\"\n }\n ],\n \"title\": \"Cluster CPU Capacity\",\n \"type\": \"gauge\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"blue\",\n \"value\": 0\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 3,\n \"x\": 9,\n \"y\": 6\n },\n \"id\": 437,\n \"options\": {\n \"colorMode\": \"value\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"percentChangeColorMode\": \"standard\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showPercentChange\": false,\n \"textMode\": \"auto\",\n \"wideLayout\": true\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum(kube_node_status_capacity{resource=\\\"cpu\\\",unit=\\\"core\\\"})\",\n \"legendFormat\": \"__auto\",\n \"range\": true,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Total CPUs\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"percentage\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"#EAB839\",\n \"value\": 75\n },\n {\n \"color\": \"semi-dark-red\",\n \"value\": 90\n }\n ]\n },\n \"unit\": \"decbytes\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"allocatable\"\n },\n \"properties\": [\n {\n \"id\": \"unit\",\n \"value\": \"bytes\"\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 3,\n \"x\": 12,\n \"y\": 6\n },\n \"id\": 427,\n \"options\": {\n \"minVizHeight\": 75,\n \"minVizWidth\": 75,\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"/^requested$/\",\n \"values\": false\n },\n \"showThresholdLabels\": true,\n \"showThresholdMarkers\": true,\n \"sizing\": \"auto\"\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(kube_node_status_allocatable{unit=\\\"byte\\\",resource=\\\"memory\\\"})\",\n \"format\": \"time_series\",\n \"instant\": false,\n \"interval\": \"\",\n \"intervalFactor\": 1,\n \"legendFormat\": \"allocatable\",\n \"range\": true,\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum(kube_pod_container_resource_requests{unit=\\\"byte\\\",resource=\\\"memory\\\"})\",\n \"format\": \"time_series\",\n \"intervalFactor\": 1,\n \"legendFormat\": \"requested\",\n \"refId\": \"C\"\n }\n ],\n \"title\": \"Cluster Mem Capacity\",\n \"type\": \"gauge\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"blue\",\n \"value\": 0\n }\n ]\n },\n \"unit\": \"bytes\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 3,\n \"x\": 15,\n \"y\": 6\n },\n \"id\": 435,\n \"options\": {\n \"colorMode\": \"value\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"percentChangeColorMode\": \"standard\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showPercentChange\": false,\n \"textMode\": \"auto\",\n \"wideLayout\": true\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum(kube_node_status_allocatable{unit=\\\"byte\\\",resource=\\\"memory\\\"})\",\n \"legendFormat\": \"__auto\",\n \"range\": true,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Total memory\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"line+area\"\n }\n },\n \"mappings\": [],\n \"max\": 100,\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"#EAB839\",\n \"value\": 50\n },\n {\n \"color\": \"orange\",\n \"value\": 75\n },\n {\n \"color\": \"red\",\n \"value\": 90\n }\n ]\n },\n \"unit\": \"percent\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 6,\n \"x\": 18,\n \"y\": 6\n },\n \"id\": 367,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"hideZeros\": false,\n \"mode\": \"multi\",\n \"sort\": \"desc\"\n }\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"exemplar\": true,\n \"expr\": \"100 - ((node_filesystem_avail_bytes{job=\\\"$job\\\",mountpoint=\\\"/\\\",fstype!=\\\"rootfs\\\"} * 100) / node_filesystem_size_bytes{job=\\\"$job\\\",mountpoint=\\\"/\\\",fstype!=\\\"rootfs\\\"})\",\n \"interval\": \"\",\n \"legendFormat\": \"{{instance}}\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Disk Capacity\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"Percentage\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 10,\n \"gradientMode\": \"opacity\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"smooth\",\n \"lineStyle\": {\n \"fill\": \"solid\"\n },\n \"lineWidth\": 1,\n \"pointSize\": 6,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"always\",\n \"spanNulls\": true,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"line+area\"\n }\n },\n \"mappings\": [],\n \"max\": 100,\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"transparent\",\n \"value\": 0\n },\n {\n \"color\": \"orange\",\n \"value\": 75\n },\n {\n \"color\": \"red\",\n \"value\": 90\n }\n ]\n },\n \"unit\": \"percent\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 9,\n \"w\": 12,\n \"x\": 0,\n \"y\": 13\n },\n \"id\": 363,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"hideZeros\": false,\n \"mode\": \"multi\",\n \"sort\": \"desc\"\n }\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"exemplar\": true,\n \"expr\": \"sum(irate(node_cpu_seconds_total{mode!='idle'}[5m])) by (instance) / sum(irate(node_cpu_seconds_total[5m])) by (instance) * 100\",\n \"format\": \"time_series\",\n \"interval\": \"\",\n \"legendFormat\": \"{{instance}}\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"CPU Busy ( 5m )\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"Percentage\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 10,\n \"gradientMode\": \"opacity\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"stepAfter\",\n \"lineWidth\": 1,\n \"pointSize\": 6,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"always\",\n \"spanNulls\": true,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"line+area\"\n }\n },\n \"mappings\": [],\n \"max\": 100,\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"transparent\",\n \"value\": 0\n },\n {\n \"color\": \"orange\",\n \"value\": 75\n },\n {\n \"color\": \"red\",\n \"value\": 90\n }\n ]\n },\n \"unit\": \"percent\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 9,\n \"w\": 12,\n \"x\": 12,\n \"y\": 13\n },\n \"id\": 365,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"hideZeros\": false,\n \"mode\": \"multi\",\n \"sort\": \"desc\"\n }\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"exemplar\": true,\n \"expr\": \"100 - ((node_memory_MemAvailable_bytes{job=\\\"$job\\\"} * 100) / node_memory_MemTotal_bytes{job=\\\"$job\\\"})\",\n \"interval\": \"\",\n \"legendFormat\": \"{{instance}}\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Ram used % \",\n \"type\": \"timeseries\"\n },\n {\n \"collapsed\": true,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 22\n },\n \"id\": 375,\n \"panels\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 1,\n \"pointSize\": 3,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": true,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"percentunit\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 8,\n \"x\": 0,\n \"y\": 30\n },\n \"id\": 373,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true,\n \"sortBy\": \"Mean\",\n \"sortDesc\": true\n },\n \"tooltip\": {\n \"hideZeros\": false,\n \"mode\": \"multi\",\n \"sort\": \"desc\"\n }\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"exemplar\": true,\n \"expr\": \"sum (rate (container_cpu_usage_seconds_total{namespace!=\\\"\\\",node=~\\\"^$Node$\\\",namespace=~\\\"$Namespace\\\"}[5m])) by (namespace)\",\n \"format\": \"time_series\",\n \"interval\": \"10s\",\n \"intervalFactor\": 4,\n \"legendFormat\": \"{{ namespace}}\",\n \"metric\": \"network\",\n \"refId\": \"A\",\n \"step\": 10\n }\n ],\n \"title\": \"CPU usage by namespace\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 30,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 1,\n \"pointSize\": 3,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": true,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"Bps\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 8,\n \"x\": 8,\n \"y\": 30\n },\n \"id\": 377,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\"\n ],\n \"displayMode\": \"list\",\n \"placement\": \"bottom\",\n \"showLegend\": false\n },\n \"tooltip\": {\n \"hideZeros\": false,\n \"mode\": \"multi\",\n \"sort\": \"desc\"\n }\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"sum (rate (container_network_receive_bytes_total{node=~\\\"^$Node$\\\"}[5m]))\",\n \"format\": \"time_series\",\n \"interval\": \"10s\",\n \"intervalFactor\": 4,\n \"legendFormat\": \"Received\",\n \"metric\": \"network\",\n \"refId\": \"A\",\n \"step\": 10\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"- sum (rate (container_network_transmit_bytes_total{node=~\\\"^$Node$\\\"}[5m]))\",\n \"format\": \"time_series\",\n \"interval\": \"10s\",\n \"intervalFactor\": 4,\n \"legendFormat\": \"Sent\",\n \"metric\": \"network\",\n \"refId\": \"B\",\n \"step\": 10\n }\n ],\n \"title\": \"Network I/O pressure\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 1,\n \"pointSize\": 3,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": true,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"decbytes\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 8,\n \"x\": 16,\n \"y\": 30\n },\n \"id\": 379,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true,\n \"sortBy\": \"Mean\",\n \"sortDesc\": true\n },\n \"tooltip\": {\n \"hideZeros\": false,\n \"mode\": \"multi\",\n \"sort\": \"desc\"\n }\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"exemplar\": true,\n \"expr\": \"sum (container_memory_working_set_bytes{namespace!=\\\"\\\",node=~\\\"^$Node$\\\",namespace=~\\\"$Namespace\\\"}) by (namespace)\",\n \"format\": \"time_series\",\n \"interval\": \"10s\",\n \"intervalFactor\": 4,\n \"legendFormat\": \"{{ namespace}}\",\n \"metric\": \"network\",\n \"refId\": \"A\",\n \"step\": 10\n }\n ],\n \"title\": \"Memory use by namespace\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"never\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"max\": 100,\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"percent\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 9,\n \"w\": 24,\n \"x\": 0,\n \"y\": 89\n },\n \"id\": 371,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true,\n \"sortBy\": \"Last *\",\n \"sortDesc\": true\n },\n \"tooltip\": {\n \"hideZeros\": false,\n \"mode\": \"multi\",\n \"sort\": \"desc\"\n }\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"expr\": \"100 * (kubelet_volume_stats_used_bytes{kubernetes_io_hostname=~\\\"^$Node$\\\"} / kubelet_volume_stats_capacity_bytes{kubernetes_io_hostname=~\\\"^$Node$\\\"})\",\n \"format\": \"time_series\",\n \"intervalFactor\": 2,\n \"legendFormat\": \"{{ persistentvolumeclaim }} | {{ kubernetes_io_hostname }}\",\n \"refId\": \"A\",\n \"step\": 120\n }\n ],\n \"title\": \"Disk Usage\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"cores\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 1,\n \"pointSize\": 3,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": true,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"decimals\": 3,\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"percentunit\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 24,\n \"x\": 0,\n \"y\": 98\n },\n \"id\": 395,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true,\n \"sortBy\": \"Mean\",\n \"sortDesc\": true\n },\n \"tooltip\": {\n \"hideZeros\": false,\n \"mode\": \"multi\",\n \"sort\": \"desc\"\n }\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"exemplar\": true,\n \"expr\": \"sum (rate (container_cpu_usage_seconds_total{pod!=\\\"\\\",node=~\\\"^$Node$\\\",namespace=~\\\"$Namespace\\\"}[5m])) by (pod)\",\n \"format\": \"time_series\",\n \"interval\": \"10s\",\n \"intervalFactor\": 5,\n \"legendFormat\": \"{{ pod }}\",\n \"metric\": \"container_cpu\",\n \"refId\": \"A\",\n \"step\": 10\n }\n ],\n \"title\": \"Pods CPU usage (5m avg)\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisBorderShow\": false,\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"barWidthFactor\": 0.6,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 10,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"insertNulls\": false,\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 1,\n \"pointSize\": 3,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": true,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": 0\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"bytes\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 7,\n \"w\": 24,\n \"x\": 0,\n \"y\": 105\n },\n \"id\": 401,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true,\n \"sortBy\": \"Mean\",\n \"sortDesc\": true\n },\n \"tooltip\": {\n \"hideZeros\": false,\n \"mode\": \"multi\",\n \"sort\": \"desc\"\n }\n },\n \"pluginVersion\": \"12.1.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"exemplar\": true,\n \"expr\": \"sum (container_memory_working_set_bytes{pod!=\\\"\\\",node=~\\\"^$Node$\\\",namespace=~\\\"$Namespace\\\"}) by (pod)\",\n \"format\": \"time_series\",\n \"interval\": \"10s\",\n \"intervalFactor\": 5,\n \"legendFormat\": \"{{ pod }}\",\n \"metric\": \"container_memory_usage:sort_desc\",\n \"refId\": \"A\",\n \"step\": 10\n }\n ],\n \"title\": \"Pods memory usage\",\n \"type\": \"timeseries\"\n }\n ],\n \"title\": \"Usage\",\n \"type\": \"row\"\n }\n ],\n \"preload\": false,\n \"refresh\": \"30s\",\n \"schemaVersion\": 41,\n \"tags\": [\n \"linux\",\n \"node-exporter\"\n ],\n \"templating\": {\n \"list\": [\n {\n \"current\": {\n \"text\": \"kubernetes-pods\",\n \"value\": \"kubernetes-pods\"\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"definition\": \"label_values(node_uname_info, job)\",\n \"includeAll\": false,\n \"label\": \"Job\",\n \"name\": \"job\",\n \"options\": [],\n \"query\": {\n \"query\": \"label_values(node_uname_info, job)\",\n \"refId\": \"StandardVariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"type\": \"query\"\n },\n {\n \"allValue\": \".*\",\n \"current\": {\n \"text\": \"All\",\n \"value\": \"$__all\"\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"definition\": \"label_values(kubernetes_io_hostname)\",\n \"includeAll\": true,\n \"label\": \"Node\",\n \"name\": \"Node\",\n \"options\": [],\n \"query\": {\n \"query\": \"label_values(kubernetes_io_hostname)\",\n \"refId\": \"StandardVariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"sort\": 1,\n \"type\": \"query\"\n },\n {\n \"allValue\": \".*\",\n \"current\": {\n \"text\": \"All\",\n \"value\": [\n \"$__all\"\n ]\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"definition\": \"label_values(namespace)\",\n \"description\": \"\",\n \"includeAll\": true,\n \"multi\": true,\n \"name\": \"Namespace\",\n \"options\": [],\n \"query\": {\n \"query\": \"label_values(namespace)\",\n \"refId\": \"StandardVariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"type\": \"query\"\n },\n {\n \"current\": {\n \"text\": \"v1.33.2+k3s1\",\n \"value\": \"v1.33.2+k3s1\"\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"definition\": \"label_values(kubernetes_build_info, git_version)\",\n \"hide\": 2,\n \"includeAll\": false,\n \"name\": \"k8s_version\",\n \"options\": [],\n \"query\": {\n \"query\": \"label_values(kubernetes_build_info, git_version)\",\n \"refId\": \"StandardVariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"type\": \"query\"\n },\n {\n \"allValue\": \".*\",\n \"current\": {\n \"text\": \"All\",\n \"value\": \"$__all\"\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"definition\": \"label_values(nginx_ingress_controller_config_hash{namespace=~\\\"$namespace\\\"}, controller_class)\",\n \"hide\": 2,\n \"includeAll\": true,\n \"label\": \"Controller Class\",\n \"name\": \"controller_class\",\n \"options\": [],\n \"query\": {\n \"query\": \"label_values(nginx_ingress_controller_config_hash{namespace=~\\\"$namespace\\\"}, controller_class)\",\n \"refId\": \"StandardVariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"type\": \"query\"\n },\n {\n \"allValue\": \".*\",\n \"current\": {\n \"text\": \"All\",\n \"value\": \"$__all\"\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"definition\": \"label_values(nginx_ingress_controller_config_hash{namespace=~\\\"$namespace\\\",controller_class=~\\\"$controller_class\\\"}, controller_pod) \",\n \"hide\": 2,\n \"includeAll\": true,\n \"label\": \"Controller\",\n \"name\": \"controller\",\n \"options\": [],\n \"query\": {\n \"query\": \"label_values(nginx_ingress_controller_config_hash{namespace=~\\\"$namespace\\\",controller_class=~\\\"$controller_class\\\"}, controller_pod) \",\n \"refId\": \"StandardVariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"type\": \"query\"\n },\n {\n \"allValue\": \".*\",\n \"current\": {\n \"text\": \"All\",\n \"value\": \"$__all\"\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"definition\": \"label_values(nginx_ingress_controller_requests{namespace=~\\\"$namespace\\\",controller_class=~\\\"$controller_class\\\",controller=~\\\"$controller\\\"}, ingress) \",\n \"includeAll\": true,\n \"label\": \"Ingress\",\n \"name\": \"ingress\",\n \"options\": [],\n \"query\": {\n \"query\": \"label_values(nginx_ingress_controller_requests{namespace=~\\\"$namespace\\\",controller_class=~\\\"$controller_class\\\",controller=~\\\"$controller\\\"}, ingress) \",\n \"refId\": \"StandardVariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"type\": \"query\"\n },\n {\n \"allValue\": \".*\",\n \"current\": {\n \"text\": \"All\",\n \"value\": \"$__all\"\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"definition\": \"label_values(nginx_ingress_controller_config_hash, controller_namespace)\",\n \"includeAll\": true,\n \"label\": \"namespace\",\n \"name\": \"namespace\",\n \"options\": [],\n \"query\": {\n \"query\": \"label_values(nginx_ingress_controller_config_hash, controller_namespace)\",\n \"refId\": \"StandardVariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"type\": \"query\"\n },\n {\n \"current\": {\n \"text\": \"speedtest.monitoring:9798\",\n \"value\": \"speedtest.monitoring:9798\"\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"definition\": \"label_values(speedtest_up, instance)\",\n \"hide\": 2,\n \"includeAll\": false,\n \"label\": \"speedtestinstance\",\n \"name\": \"speedtestinstance\",\n \"options\": [],\n \"query\": {\n \"query\": \"label_values(speedtest_up, instance)\",\n \"refId\": \"StandardVariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"type\": \"query\"\n },\n {\n \"current\": {\n \"text\": \"speedtest-exporter\",\n \"value\": \"speedtest-exporter\"\n },\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"definition\": \"label_values(speedtest_up, job)\",\n \"hide\": 2,\n \"includeAll\": false,\n \"label\": \"speedtestjob\",\n \"name\": \"speedtestjob\",\n \"options\": [],\n \"query\": {\n \"query\": \"label_values(speedtest_up, job)\",\n \"refId\": \"StandardVariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"type\": \"query\"\n }\n ]\n },\n \"time\": {\n \"from\": \"now-24h\",\n \"to\": \"now-0m\"\n },\n \"timepicker\": {\n \"nowDelay\": \"0m\"\n },\n \"timezone\": \"browser\",\n \"title\": \"Kubernetes Server Metrics\",\n \"uid\": \"35xtB4Anz\",\n \"version\": 1\n }\n" }, { "path": "cluster/homelab/apps/observeability/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.sensitive.sops.yaml\n - loki-helm-release.yaml\n - namespace.yaml\n # Dashboards\n - kubernetes-server-metrics.yaml\n - trivy.yaml\n" }, { "path": "cluster/homelab/apps/observeability/loki-helm-release.yaml", "content": "apiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: observeability-loki\n namespace: observeability\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: loki-stack\n version: 2.10.3\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: grafana\n namespace: flux-system\n values:\n test_pod:\n enabled: false\n\n loki:\n enabled: true\n isDefault: false\n image:\n tag: \"2.9.3\"\n containerSecurityContext:\n readOnlyRootFilesystem: true\n capabilities:\n drop:\n - ALL\n\n promtail:\n enabled: true\n" }, { "path": "cluster/homelab/apps/observeability/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: observeability\n labels:\n monitoring.coreos.com/serviceMonitor: \"true\"\n" }, { "path": "cluster/homelab/apps/observeability/trivy.yaml", "content": "apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: trivy-dashboard\n namespace: observeability\n labels:\n grafana_dashboard: \"1\"\ndata:\n trivy.json: |\n {\n \"__inputs\": [\n {\n \"name\": \"DS_PROMETHEUS\",\n \"label\": \"Prometheus\",\n \"description\": \"\",\n \"type\": \"datasource\",\n \"pluginId\": \"prometheus\",\n \"pluginName\": \"Prometheus\"\n }\n ],\n \"__elements\": {},\n \"__requires\": [\n {\n \"type\": \"grafana\",\n \"id\": \"grafana\",\n \"name\": \"Grafana\",\n \"version\": \"9.3.1\"\n },\n {\n \"type\": \"datasource\",\n \"id\": \"prometheus\",\n \"name\": \"Prometheus\",\n \"version\": \"1.0.0\"\n },\n {\n \"type\": \"panel\",\n \"id\": \"stat\",\n \"name\": \"Stat\",\n \"version\": \"\"\n },\n {\n \"type\": \"panel\",\n \"id\": \"table\",\n \"name\": \"Table\",\n \"version\": \"\"\n },\n {\n \"type\": \"panel\",\n \"id\": \"timeseries\",\n \"name\": \"Time series\",\n \"version\": \"\"\n }\n ],\n \"annotations\": {\n \"list\": [\n {\n \"builtIn\": 1,\n \"datasource\": {\n \"type\": \"grafana\",\n \"uid\": \"-- Grafana --\"\n },\n \"enable\": true,\n \"hide\": true,\n \"iconColor\": \"rgba(0, 211, 255, 1)\",\n \"name\": \"Annotations & Alerts\",\n \"target\": {\n \"limit\": 100,\n \"matchAny\": false,\n \"tags\": [],\n \"type\": \"dashboard\"\n },\n \"type\": \"dashboard\"\n }\n ]\n },\n \"description\": \"This Dashboard is used to visualise the metrics from the security reports of the Trivy Operator\",\n \"editable\": true,\n \"fiscalYearStartMonth\": 0,\n \"graphTooltip\": 0,\n \"id\": null,\n \"links\": [],\n \"liveNow\": false,\n \"panels\": [\n {\n \"collapsed\": true,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 0\n },\n \"id\": 12,\n \"panels\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"description\": \"Total number by type of security issues identified in the cluster\",\n \"fieldConfig\": {\n \"defaults\": {\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\"\n },\n {\n \"color\": \"red\",\n \"value\": 1\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Critical\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"red\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"High\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"orange\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Medium\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"dark-yellow\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Low\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"green\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Unknown\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"mode\": \"fixed\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 9,\n \"w\": 24,\n \"x\": 0,\n \"y\": 1\n },\n \"id\": 21,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"center\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"9.3.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_vulnerabilities)\",\n \"instant\": true,\n \"legendFormat\": \"Vulnerabilities\",\n \"range\": false,\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_resource_configaudits)\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"Misconfiguration\",\n \"range\": false,\n \"refId\": \"B\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_exposedsecrets)\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"Exposed Secrets\",\n \"range\": false,\n \"refId\": \"C\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_clusterrole_clusterrbacassessments)\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"RBAC Assessment\",\n \"range\": false,\n \"refId\": \"D\"\n }\n ],\n \"title\": \"Number and Type of Security Issues\",\n \"type\": \"stat\"\n }\n ],\n \"title\": \"Quick Overview\",\n \"type\": \"row\"\n },\n {\n \"collapsed\": true,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 1\n },\n \"id\": 2,\n \"panels\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"description\": \"\",\n \"fieldConfig\": {\n \"defaults\": {\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\"\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Critical\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"red\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"High\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"orange\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Medium\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"dark-yellow\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Low\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"green\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Unknown\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"mode\": \"fixed\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 9,\n \"w\": 24,\n \"x\": 0,\n \"y\": 2\n },\n \"id\": 19,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"center\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"9.3.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_vulnerabilities{severity=\\\"Critical\\\"})\",\n \"instant\": true,\n \"legendFormat\": \"Critical\",\n \"range\": false,\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_vulnerabilities{severity=\\\"High\\\"})\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"High\",\n \"range\": false,\n \"refId\": \"B\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_vulnerabilities{severity=\\\"Medium\\\"})\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"Medium\",\n \"range\": false,\n \"refId\": \"C\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_vulnerabilities{severity=\\\"Low\\\"})\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"Low\",\n \"range\": false,\n \"refId\": \"D\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_vulnerabilities{severity=\\\"Unknown\\\"})\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"Unknown\",\n \"range\": false,\n \"refId\": \"E\"\n }\n ],\n \"title\": \"Severity Breakdown of all Vulnerabilities\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"description\": \"\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 3,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\"\n },\n {\n \"color\": \"red\",\n \"value\": 1\n }\n ]\n }\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 11\n },\n \"id\": 27,\n \"options\": {\n \"legend\": {\n \"calcs\": [],\n \"displayMode\": \"list\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"single\",\n \"sort\": \"none\"\n }\n },\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum(trivy_image_vulnerabilities) by (namespace)\",\n \"legendFormat\": \"__auto\",\n \"range\": true,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Number of Vulnerabilities by namespace\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"custom\": {\n \"align\": \"left\",\n \"displayMode\": \"color-text\",\n \"filterable\": true,\n \"inspect\": false\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\"\n },\n {\n \"color\": \"super-light-yellow\",\n \"value\": 1\n },\n {\n \"color\": \"orange\",\n \"value\": 100\n },\n {\n \"color\": \"red\",\n \"value\": 500\n }\n ]\n }\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Image\"\n },\n \"properties\": [\n {\n \"id\": \"custom.displayMode\",\n \"value\": \"json-view\"\n },\n {\n \"id\": \"custom.width\",\n \"value\": 350\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"image_tag\"\n },\n \"properties\": [\n {\n \"id\": \"custom.displayMode\",\n \"value\": \"json-view\"\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 14,\n \"w\": 24,\n \"x\": 0,\n \"y\": 19\n },\n \"id\": 23,\n \"options\": {\n \"footer\": {\n \"enablePagination\": true,\n \"fields\": \"\",\n \"reducer\": [\n \"sum\"\n ],\n \"show\": false\n },\n \"frameIndex\": 1,\n \"showHeader\": true,\n \"sortBy\": []\n },\n \"pluginVersion\": \"9.3.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_vulnerabilities{severity=\\\"Critical\\\"}) by (image_repository,image_tag)\",\n \"format\": \"table\",\n \"instant\": true,\n \"range\": false,\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_vulnerabilities{severity=\\\"High\\\"}) by (image_repository,image_tag)\",\n \"format\": \"table\",\n \"hide\": false,\n \"instant\": true,\n \"range\": false,\n \"refId\": \"B\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_vulnerabilities{severity=\\\"Medium\\\"}) by (image_repository,image_tag)\",\n \"format\": \"table\",\n \"hide\": false,\n \"instant\": true,\n \"range\": false,\n \"refId\": \"C\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_vulnerabilities{severity=\\\"Low\\\"}) by (image_repository,image_tag)\",\n \"format\": \"table\",\n \"hide\": false,\n \"instant\": true,\n \"range\": false,\n \"refId\": \"D\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_image_vulnerabilities{severity=\\\"Unknown\\\"}) by (image_repository,image_tag)\",\n \"format\": \"table\",\n \"hide\": false,\n \"instant\": true,\n \"range\": false,\n \"refId\": \"E\"\n }\n ],\n \"title\": \"Vulnerability by Image\",\n \"transformations\": [\n {\n \"id\": \"filterFieldsByName\",\n \"options\": {\n \"include\": {\n \"names\": [\n \"image_repository\",\n \"image_tag\",\n \"Value #A\",\n \"Value #B\",\n \"Value #C\",\n \"Value #D\",\n \"Value #E\"\n ]\n }\n }\n },\n {\n \"id\": \"seriesToColumns\",\n \"options\": {\n \"byField\": \"image_repository\"\n }\n },\n {\n \"id\": \"filterFieldsByName\",\n \"options\": {\n \"include\": {\n \"names\": [\n \"image_repository\",\n \"Value #A\",\n \"Value #B\",\n \"Value #C\",\n \"Value #D\",\n \"Value #E\",\n \"image_tag 1\"\n ]\n }\n }\n },\n {\n \"id\": \"organize\",\n \"options\": {\n \"excludeByName\": {\n \"image_tag\": false\n },\n \"indexByName\": {},\n \"renameByName\": {\n \"Value #A\": \"Critical\",\n \"Value #B\": \"High\",\n \"Value #C\": \"Medium\",\n \"Value #D\": \"Low\",\n \"Value #E\": \"Unknown\",\n \"image_repository\": \"Image\",\n \"image_tag\": \"Tag\"\n }\n }\n }\n ],\n \"type\": \"table\"\n }\n ],\n \"title\": \"Vulnerabilities\",\n \"type\": \"row\"\n },\n {\n \"collapsed\": true,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 2\n },\n \"id\": 4,\n \"panels\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"description\": \"\",\n \"fieldConfig\": {\n \"defaults\": {\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\"\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Critical\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"red\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"High\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"orange\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Medium\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"dark-yellow\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Low\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"green\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Unknown\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"mode\": \"fixed\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 9,\n \"w\": 24,\n \"x\": 0,\n \"y\": 3\n },\n \"id\": 28,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"center\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"9.3.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_resource_configaudits{severity=\\\"Critical\\\"})\",\n \"instant\": true,\n \"legendFormat\": \"Critical\",\n \"range\": false,\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_resource_configaudits{severity=\\\"High\\\"})\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"High\",\n \"range\": false,\n \"refId\": \"B\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_resource_configaudits{severity=\\\"Medium\\\"})\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"Medium\",\n \"range\": false,\n \"refId\": \"C\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_resource_configaudits{severity=\\\"Low\\\"})\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"Low\",\n \"range\": false,\n \"refId\": \"D\"\n }\n ],\n \"title\": \"Severity Breakdown of all Misconfiguration\",\n \"type\": \"stat\"\n }\n ],\n \"title\": \"Misconfiguration\",\n \"type\": \"row\"\n },\n {\n \"collapsed\": true,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 3\n },\n \"id\": 8,\n \"panels\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"description\": \"\",\n \"fieldConfig\": {\n \"defaults\": {\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\"\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Critical\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"red\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"High\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"orange\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Medium\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"dark-yellow\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Low\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"green\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Unknown\"\n },\n \"properties\": [\n {\n \"id\": \"color\",\n \"value\": {\n \"mode\": \"fixed\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 9,\n \"w\": 24,\n \"x\": 0,\n \"y\": 4\n },\n \"id\": 29,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"center\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"9.3.1\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_role_rbacassessments{severity=\\\"Critical\\\"})\",\n \"instant\": true,\n \"legendFormat\": \"Critical\",\n \"range\": false,\n \"refId\": \"A\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_role_rbacassessments{severity=\\\"High\\\"})\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"High\",\n \"range\": false,\n \"refId\": \"B\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_role_rbacassessments{severity=\\\"Medium\\\"})\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"Medium\",\n \"range\": false,\n \"refId\": \"C\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_role_rbacassessments{severity=\\\"Low\\\"})\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"Low\",\n \"range\": false,\n \"refId\": \"D\"\n },\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"exemplar\": false,\n \"expr\": \"sum(trivy_role_rbacassessments{severity=\\\"UNKNOWN\\\"})\",\n \"hide\": false,\n \"instant\": true,\n \"legendFormat\": \"Unknown\",\n \"range\": false,\n \"refId\": \"E\"\n }\n ],\n \"title\": \"Severity Breakdown of RBAC Security Issues\",\n \"type\": \"stat\"\n }\n ],\n \"title\": \"RBAC Assessment\",\n \"type\": \"row\"\n },\n {\n \"collapsed\": true,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 4\n },\n \"id\": 6,\n \"panels\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"description\": \"\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 0,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n },\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 3,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\"\n },\n {\n \"color\": \"red\",\n \"value\": 1\n }\n ]\n }\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 5\n },\n \"id\": 30,\n \"options\": {\n \"legend\": {\n \"calcs\": [],\n \"displayMode\": \"list\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"single\",\n \"sort\": \"none\"\n }\n },\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"prometheus\",\n \"uid\": \"prometheus\"\n },\n \"editorMode\": \"code\",\n \"expr\": \"sum(trivy_image_exposedsecrets) by (namespace)\",\n \"legendFormat\": \"__auto\",\n \"range\": true,\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Exposed Secrets per namespace\",\n \"type\": \"timeseries\"\n }\n ],\n \"title\": \"Exposed Secrets\",\n \"type\": \"row\"\n }\n ],\n \"refresh\": false,\n \"schemaVersion\": 37,\n \"style\": \"dark\",\n \"tags\": [\n \"trivy\",\n \"trivy operator\",\n \"security\",\n \"security scanning\",\n \"vulnerabilities\",\n \"exposed secrets\",\n \"misconfiguration\"\n ],\n \"templating\": {\n \"list\": [\n {\n \"current\": {\n \"selected\": true,\n \"text\": \"Prometheus\",\n \"value\": \"Prometheus\"\n },\n \"hide\": 0,\n \"includeAll\": false,\n \"label\": \"datasource\",\n \"multi\": false,\n \"name\": \"DS_PROMETHEUS\",\n \"options\": [],\n \"query\": \"prometheus\",\n \"queryValue\": \"\",\n \"refresh\": 1,\n \"regex\": \"\",\n \"skipUrlSync\": false,\n \"type\": \"datasource\"\n }\n ]\n },\n \"time\": {\n \"from\": \"now-2d\",\n \"to\": \"now\"\n },\n \"timepicker\": {},\n \"timezone\": \"\",\n \"title\": \"Trivy Operator Dashboard\",\n \"uid\": \"ycwPj724k\",\n \"version\": 12,\n \"weekStart\": \"\",\n \"gnetId\": 17813\n }\n" }, { "path": "cluster/homelab/apps/openbooks/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: openbooks\n namespace: openbooks\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/openbooks\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/openbooks/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/apps/openbooks/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: openbooks\n" }, { "path": "cluster/homelab/apps/paperless-ngx/gateway-api.sensitive.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: paperless-ngx-external\n namespace: paperless-ngx\nspec:\n parentRefs:\n - name: external\n namespace: istio-gateway\n hostnames:\n - paperless.sgenov.dev\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: paperless-ngx\n port: 80\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArQ1QzVGpzYzVaWnU5bHQ2\n K25JZG9JNjRnZE1ERkZINTY0U0pidGdNN0NBCnJ4eEVya29tTEdoQllaSW1Ja3V3\n YWxqWjZxODdMNUVEUlhzUnZXeW1OckEKLS0tIC9sYkRRNDh4eWNJaWlaamJqVmtM\n MmdKRmVRQzVWNzVrZHp2U2dmZllnK00KzJ8nbGiRMtzzxRwBY3ixXOiZ3DIl+Idh\n OEMEBvdYpjVkxL6pXnFmcw1qzvq5ddeGe8m6uuy8u5NO9yxShqrKBA==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-11-16T14:23:48Z\"\n mac: ENC[AES256_GCM,data:XNuJvx7uQPkB+kJCDopO36GZ44to6sEMU0FpF8nJw+CFqdGdoFzqwDq7ThNXDPGM8rSKU+i8quXl1WVO/WvVcvUf/3+5Qp5s4D0QJBNT2csEbqTI0x0sLSADzyuqs38zFR50OBr23J1feHHiE2jMi4kUniMCmv/NoRrHIeVsihA=,iv:tabpzBbjgqhm9WS0Vv9CDTLzgeKUFUn0MzSJsLbQX9M=,tag:eU3ta9koDdIKLPy9zockZA==,type:str]\n encrypted_regex: (?i)password|webhook_url|token|key\n version: 3.11.0\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: paperless-ngx-internal\n namespace: paperless-ngx\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Document Management System\n gethomepage.dev/group: Knowledge\n gethomepage.dev/icon: paperless-ngx\n gethomepage.dev/name: Paperless-NGX\n gethomepage.dev/widget.type: paperlessngx\n gethomepage.dev/widget.url: https://paperless.sgenov.dev\n gethomepage.dev/widget.key: ENC[AES256_GCM,data:Rnzez6tBbfRuqOsJ9hDf9hq1x+bg3uGfokqt1vRhVwP1btqFpOqk472WgPp5njB+vIRq6JwntwFarp93ZaLTdejla7Tn1pzLlvqgnmZms/g/6V4R7hGejklHpF4FBP7l8hTVPKqqYFGrJ4h2dlLORnpmaFRGB+pkQy6hP4XFkszgfOkeehflpoQSNMcLIew3tMRDGGR2sKJ23WN5F9mOSwn0mw==,iv:jwRN7MVVzwvJ1A1WAYlNnzBbLEW6fwiGPf4bSlEDKMo=,tag:2B/jfk+a7V9FTSqmtMdyBw==,type:str]\nspec:\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - paperless.sgenov.dev\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: paperless-ngx\n port: 80\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArQ1QzVGpzYzVaWnU5bHQ2\n K25JZG9JNjRnZE1ERkZINTY0U0pidGdNN0NBCnJ4eEVya29tTEdoQllaSW1Ja3V3\n YWxqWjZxODdMNUVEUlhzUnZXeW1OckEKLS0tIC9sYkRRNDh4eWNJaWlaamJqVmtM\n MmdKRmVRQzVWNzVrZHp2U2dmZllnK00KzJ8nbGiRMtzzxRwBY3ixXOiZ3DIl+Idh\n OEMEBvdYpjVkxL6pXnFmcw1qzvq5ddeGe8m6uuy8u5NO9yxShqrKBA==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-11-16T14:23:48Z\"\n mac: ENC[AES256_GCM,data:XNuJvx7uQPkB+kJCDopO36GZ44to6sEMU0FpF8nJw+CFqdGdoFzqwDq7ThNXDPGM8rSKU+i8quXl1WVO/WvVcvUf/3+5Qp5s4D0QJBNT2csEbqTI0x0sLSADzyuqs38zFR50OBr23J1feHHiE2jMi4kUniMCmv/NoRrHIeVsihA=,iv:tabpzBbjgqhm9WS0Vv9CDTLzgeKUFUn0MzSJsLbQX9M=,tag:eU3ta9koDdIKLPy9zockZA==,type:str]\n encrypted_regex: (?i)password|webhook_url|token|key\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/paperless-ngx/helm-release.yaml", "content": "apiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: paperless-ngx\n namespace: paperless-ngx\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: paperless-ngx\n version: 0.24.1\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: gabe565\n namespace: flux-system\n values:\n env:\n PAPERLESS_OCR_LANGUAGES: eng bul\n PAPERLESS_TIKA_ENABLED: \"true\"\n PAPERLESS_TIKA_ENDPOINT: http://tika.tika:9998\n PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg.gotenberg:80\n PAPERLESS_URL: https://paperless.sgenov.dev\n podAnnotations:\n backup.velero.io/backup-volumes: data,media,export,consume\n redis:\n image:\n tag: latest\n service:\n main:\n ports:\n http:\n port: 80\n image:\n # -- Image repository\n repository: ghcr.io/paperless-ngx/paperless-ngx\n # -- Image pull policy\n pullPolicy: IfNotPresent\n # -- Image tag\n tag: 2.20.15\n persistence:\n data:\n enabled: true\n storageClass: longhorn\n accessMode: ReadWriteOnce\n size: 10Gi\n media:\n enabled: true\n storageClass: longhorn\n accessMode: ReadWriteOnce\n size: 100Gi\n export:\n enabled: true\n storageClass: longhorn\n accessMode: ReadWriteOnce\n size: 1Gi\n consume:\n enabled: true\n storageClass: longhorn\n accessMode: ReadWriteOnce\n size: 4Gi\n" }, { "path": "cluster/homelab/apps/paperless-ngx/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - gateway-api.sensitive.yaml\n" }, { "path": "cluster/homelab/apps/reactiveresume/cnpg.yaml", "content": "apiVersion: postgresql.cnpg.io/v1\nkind: Cluster\nmetadata:\n name: cluster-postgres\n annotations:\n backup.velero.io/backup-volumes: pgdata\nspec:\n instances: 1\n\n imageName: ghcr.io/cloudnative-pg/postgresql:18.1\n\n storage:\n size: 10Gi\n\n podSecurityContext:\n runAsNonRoot: true\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n add:\n - NET_BIND_SERVICE\n - CHOWN\n - FOWNER\n privileged: false\n readOnlyRootFilesystem: true\n runAsNonRoot: true\n" }, { "path": "cluster/homelab/apps/reactiveresume/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: reactiveresume\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/reactiveresume\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/reactiveresume/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: reactiveresume\nresources:\n - namespace.yaml\n - secret.sops.yaml\n - helm-release.yaml\n - cnpg.yaml\n\n" }, { "path": "cluster/homelab/apps/reactiveresume/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: reactiveresume\n" }, { "path": "cluster/homelab/apps/reactiveresume/secret.sops.yaml", "content": "apiVersion: v1\nkind: Secret\nmetadata:\n name: app\ntype: Opaque\ndata:\n JWT_EXPIRY_TIME: ENC[AES256_GCM,data:P9MdruOYpu8=,iv:33A+J63wTvd4BWKWTtf+DfPMcFaAAhklBA6xUotbBsc=,tag:piTHrEpXxv7f37+u9ie4BA==,type:str]\n JWT_SECRET: ENC[AES256_GCM,data:KFp2KPjG+E1+mG8sAXUyhP6xVfM=,iv:/7hEcfytngg+vCbjk3YV0LGeDYXvKYUHVCqH16AbXiQ=,tag:qeaOthDLZRIWsHnz1RzZLA==,type:str]\n PUBLIC_SERVER_URL: ENC[AES256_GCM,data:OkH4qasBiIhuplM6RQl7SLHZ1Qr3SjMWWKcM/1g5aa0fN6oJbbz2Mg==,iv:MAeGwn0Y4daJ4DywSWrC29F+SnV1qBpww2zVwO6uZtg=,tag:CGsvdEEJQpd1sWEi3lrE+g==,type:str]\n PUBLIC_URL: ENC[AES256_GCM,data:gqkph/fPsb+4soHrtzko4AdY2sTHoce4WYk9LQ+2Ixl9LGZq,iv:1oQaQV9Vnf7goq6+A8rGmy4glpi7maBFB2xG3LB9TM0=,tag:nWqzOgo8fCBRtuLknbXWdg==,type:str]\n SECRET_KEY: ENC[AES256_GCM,data:/zhSKEVPyMQSkKGX6jrhR1Gqnic=,iv:BHiVg4PXboyHhhrnCn6xKWvDT1PCmkyNFVS3GSWGqHM=,tag:VLFuW7thQK7TvWsgGT3LBw==,type:str]\n STORAGE_S3_ENABLED: ENC[AES256_GCM,data:WHJ568szLpQ=,iv:CtRhSbcb51Ofw7KhEBeGmaB6Wm6C4Zub26C3C1ez/oI=,tag:OM/MmjEzjCGsu+C8xsLcYg==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRDV3cXpjaGF5N0J6WURE\n a2duMXA5b3BPQVpLbnZMUVkrRUtjV1pzbjI4CnZzRUtJL213S1JZRC9WVm9MV0Zy\n T2UwK1NaZjlGcGJQemdpWEsrczlTNVUKLS0tIFdlYkErRjhoMW5IZVJpUG5BUnFq\n K1pIRTh5YWdneGFkNVBOaFZyYk1yTzQK0bp8VvFMi86o3wqzvfa00AhEBn8l9+rv\n Zju2NZNZFYtoY59zqA45f4BxbGW2dZTFiJC3u6JY84qZmzLCJBC+OQ==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2026-01-18T20:05:40Z\"\n mac: ENC[AES256_GCM,data:/+SeOCEhLh4xFeZZnW13dRkf3EVKabhgPpvHH5hNLcGiOZwm3UMs+8spxeU0mAg93lATbexIjANp/RMUPmS/3ANdg4SgxY0ZHNakvhmU/KfOfgD21BLDQocnPMv8TlbcGi3y6Bg2geh4sYCMnfoRUMH9S8X4hQg4B9mQUEtp+jU=,iv:t4R5EbS0pSEk5kh2sDNhzuF3qQy9D6H/zNwSpURoLj0=,tag:ugzOATJ6lvZHJ2FUFjxyMQ==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/replacedby/database.yaml", "content": "apiVersion: k8s.mariadb.com/v1alpha1\nkind: MariaDB\nmetadata:\n name: mariadb\nspec:\n inheritMetadata:\n annotations:\n backup.velero.io/backup-volumes: storage\n storage:\n size: 15Gi\n\n replicas: 3\n\n replication:\n enabled: true\n primary:\n # Whether the operator should automatically perform primary failover.\n autoFailover: true\n # Duration before performing primary failover.\n autoFailoverDelay: 0s\n # Trigger a switchover by declaring the desired primary index.\n # podIndex: 0\n tls:\n enabled: false\n---\napiVersion: k8s.mariadb.com/v1alpha1\nkind: Database\nmetadata:\n name: app\nspec:\n mariaDbRef:\n name: mariadb\n characterSet: utf8\n collate: utf8_general_ci\n cleanupPolicy: Delete\n requeueInterval: 10h\n retryInterval: 30s\n" }, { "path": "cluster/homelab/apps/replacedby/deployment.yaml", "content": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: replacedby\n labels:\n app.kubernetes.io/instance: replacedby\n app.kubernetes.io/name: replacedby\nspec:\n replicas: 3\n strategy:\n rollingUpdate:\n maxUnavailable: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: replacedby\n app.kubernetes.io/name: replacedby\n template:\n metadata:\n labels:\n app.kubernetes.io/instance: replacedby\n app.kubernetes.io/name: replacedby\n spec:\n restartPolicy: Always\n containers:\n - name: replacedby\n image: ghcr.io/michaelpalacce/replacedby:0.1.1769382806\n imagePullPolicy: IfNotPresent\n resources:\n requests:\n cpu: 1\n memory: 1Gi\n limits:\n cpu: 1\n memory: 1Gi\n ports:\n - name: web\n containerPort: 8080\n securityContext:\n capabilities:\n drop:\n - \"ALL\"\n add:\n - CHOWN\n - SETUID\n - SETGID\n env:\n - name: PORT\n value: \":8080\"\n - name: ENV\n value: \"prod\"\n - name: GIN_MODE\n value: \"release\"\n - name: MYSQL_PORT\n value: \"3306\"\n - name: MYSQL_HOSTNAME\n value: \"mariadb-primary\"\n - name: MYSQL_DATABASE\n value: \"app\"\n - name: MYSQL_ROOT_PASSWORD #unused... need to fix in app.. w/e\n valueFrom:\n secretKeyRef:\n name: mariadb-root\n key: password\n - name: MYSQL_PASSWORD\n valueFrom:\n secretKeyRef:\n name: mariadb-root\n key: password\n - name: MYSQL_USER\n value: \"root\"\n\n livenessProbe:\n failureThreshold: 10\n initialDelaySeconds: 30\n tcpSocket:\n port: 8080\n timeoutSeconds: 2\n startupProbe:\n failureThreshold: 20\n timeoutSeconds: 2\n tcpSocket:\n port: 8080\n" }, { "path": "cluster/homelab/apps/replacedby/gateway-api.yaml", "content": "---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: replacedby-external\nspec:\n parentRefs:\n - name: external-replacedby\n namespace: istio-gateway\n hostnames:\n - \"replacedby.net\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: replacedby\n port: 8080\n" }, { "path": "cluster/homelab/apps/replacedby/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: replacedby\nresources:\n - namespace.yaml\n - deployment.yaml\n - service.yaml\n - gateway-api.yaml\n - database.yaml\n" }, { "path": "cluster/homelab/apps/replacedby/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: replacedby\n" }, { "path": "cluster/homelab/apps/replacedby/service.yaml", "content": "apiVersion: v1\nkind: Service\nmetadata:\n name: replacedby\nspec:\n selector:\n app.kubernetes.io/instance: replacedby\n app.kubernetes.io/name: replacedby\n ports:\n - name: web\n protocol: TCP\n port: 8080\n" }, { "path": "cluster/homelab/apps/storage/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: storage\n namespace: storage\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/storage\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/storage/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/apps/storage/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: storage\n" }, { "path": "cluster/homelab/apps/tika/helm-release.yaml", "content": "apiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: tika\n namespace: tika\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: tika\n version: 3.2.2\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: tika\n namespace: flux-system\n values:\n image:\n repository: apache/tika\n tag: 3.3.0.0-full\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n readOnlyRootFilesystem: true\n runAsNonRoot: true\n runAsUser: 35002\n runAsGroup: 35002\n resources:\n limits:\n cpu: \"1\"\n memory: 1000Mi\n requests:\n cpu: 500m\n memory: 500Mi\n config:\n base_url: \"https://tika.sgenov.dev\"\n # ingress:\n # ingressClassName: nginx\n # enabled: true\n # annotations:\n # hosts:\n # - host: tika.sgenov.dev\n # paths:\n # - path: /\n # tls:\n # - secretName: ingress\n # hosts:\n # - '*.sgenov.dev'\n" }, { "path": "cluster/homelab/apps/tika/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - namespace.yaml\n - helm-release.yaml\n" }, { "path": "cluster/homelab/apps/tika/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: tika\n" }, { "path": "cluster/homelab/apps/uptimekuma/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: uptimekuma\n namespace: uptimekuma\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/uptimekuma\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n values:\n uptimekuma:\n replicas: 1\n" }, { "path": "cluster/homelab/apps/uptimekuma/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/apps/uptimekuma/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: uptimekuma\n" }, { "path": "cluster/homelab/apps/vikunja/cnpg.yaml", "content": "apiVersion: postgresql.cnpg.io/v1\nkind: Cluster\nmetadata:\n name: cluster-postgres\n annotations:\n backup.velero.io/backup-volumes: pgdata\nspec:\n instances: 1\n\n imageName: ghcr.io/cloudnative-pg/postgresql:18.1\n\n storage:\n size: 10Gi\n\n podSecurityContext:\n runAsNonRoot: true\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n add:\n - NET_BIND_SERVICE\n - CHOWN\n - FOWNER\n privileged: false\n readOnlyRootFilesystem: true\n runAsNonRoot: true\n" }, { "path": "cluster/homelab/apps/vikunja/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: vikunja\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/vikunja\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/vikunja/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: vikunja\nresources:\n - helm-release.yaml\n - namespace.yaml\n - secret.sops.yaml\n - cnpg.yaml\n" }, { "path": "cluster/homelab/apps/vikunja/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: vikunja\n" }, { "path": "cluster/homelab/apps/vikunja/secret.sops.yaml", "content": "kind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: app\ndata:\n JWT_SECRET: ENC[AES256_GCM,data:HV8lEczdf0r5M86z55Sg1ayJiuZw4QF3zFfBwg==,iv:hQR416W0+cXl0g2AW1xnMdz8RtJKU8SMl2p4dZHTFJM=,tag:mhewMNefOsOknkqTbPy9Lg==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPbDQ1S1gwVXNhZHdWQ2k4\n TllvK3owU0hWbjA1NFd2eW01cG5RdTcwY21ZCjdkWVdPNGt6bmwrWERiQlJ4d1h0\n WUlxUmE2WDlIVTJ6SjNkWE56UlFwQ2sKLS0tIEsyRUNmYldwblBzelBDR0JuQkNT\n cjJiUFNvV1FxUktJNE95NlNUdDNMdDgKmkERB0veEzIccXbBf6iuggkuPI4TnXMj\n XOU0EkCIOIKorc5Ww6mc/nrPJwltL6zCEn4m9oxQ7JhpxWJkAD96lQ==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2026-01-19T20:21:59Z\"\n mac: ENC[AES256_GCM,data:F1PI6Lbkf3QpBpy72aCRAZevbElX2TQzUN+32zidvfXPWYOkSz5Du7YflzscoX9bD0iTV5Z9zJQ0YjXiOtfFEjpT5rUPsJ69kPqpBVoUcoqe9lejX2++noUvHMP+ZrgKP8xDQiAuRoilfSnOERr3UDsQ8WFNkb/o/dP4Ls8QTqM=,iv:R2MAWCXdMIaLwJzZUwGyw1YqRA78fuWlnlxJzRldFS0=,tag:Si07xwoL1gAz38quo7gLIA==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/apps/wallabag/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: wallabag\n namespace: wallabag\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/wallabag\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n values:\n wallabag:\n replicas: 1\n" }, { "path": "cluster/homelab/apps/wallabag/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n - secret.sops.yaml\n" }, { "path": "cluster/homelab/apps/wallabag/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: wallabag\n" }, { "path": "cluster/homelab/apps/wallabag/secret.sops.yaml", "content": "kind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: app\n namespace: wallabag\ndata:\n SYMFONY__ENV__DATABASE_DRIVER: ENC[AES256_GCM,data:cVVf28Vlw0yQE2PE,iv:Won29sNJKeVSLZW49yDGU0pd4w3FSDPl7SjB9KSiyEc=,tag:Lg+EIspPQehp/Aa97bbL+w==,type:str]\n SYMFONY__ENV__DATABASE_PORT: ENC[AES256_GCM,data:qujqBhKN870=,iv:wFoLBtAf/yKpToxGBpZNMMHVrHvKClgnWLwGNsLOZFo=,tag:Rm+KizBSIGyKOAn5UsXMFw==,type:str]\n SYMFONY__ENV__DATABASE_NAME: ENC[AES256_GCM,data:rWlpmX77nYhpCLtr,iv:8vnXRHptGLk5alkd6ZXO/XZjlNGsxjMKVtE8JTguY8U=,tag:k92wlKm8pl/zlmfr/Le3mw==,type:str]\n SYMFONY__ENV__DATABASE_USER: ENC[AES256_GCM,data:28ytQy20OTreqb59,iv:Q8HvVHQTvoNEWagMmUjFa2n5UceHB0GQe2dNmyqQF2Y=,tag:Va3xsMcFEOjOueaapG6kAQ==,type:str]\n SYMFONY__ENV__DATABASE_PASSWORD: ENC[AES256_GCM,data:AV+ELghahKDaN/Wz,iv:d9GssB8dgIIOIGYXz8eNiz/EIOf38HYBLVJgBCKRsLY=,tag:qU0LRMhtgWv4VWI0qJOvdQ==,type:str]\n SYMFONY__ENV__DATABASE_HOST: ENC[AES256_GCM,data:0uRbZTTzUv3JoE8lC7mcQITxLsm5ND1i,iv:wJVcokt0NA8T6t8c87PiDbATFxkQVYp1DsRDcoZR2bY=,tag:d6BZn1baCnD9ZAdIgpjq/w==,type:str]\nsops:\n kms: []\n gcp_kms: []\n azure_kv: []\n hc_vault: []\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRTc1M0ExK2JtK0dBR1Uy\n LzhEbXJDdkxSajVjODNiZHJPQlR4d2gzeW5jCnVQSFgxRUxtbkhtOXoySzl1ZU1v\n L1JnRUk0TlpENG42dTVaSFMwZVFSNEEKLS0tIE1QeHpxNkg2TU8zY0JtWE5tOWlX\n QU1LcU05dE10ZjJ1UWxKUy9YNTVYbFUKFPfOI/37nSoRj0/LOmhzgJ63k69+lHl7\n apC4Ycq3es3ner5NyGLnKeq2lTFpZXlsd8m8UYidGORE2ndpN9mihA==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2024-08-03T18:13:49Z\"\n mac: ENC[AES256_GCM,data:8Izus6Qvc0NBCfNI3cim96Elw8agrf0l3O3DVaYh/ApyAZuf41/PyctTnY64gWMB5Yt/LonyuWRYnYZ5un1bWTMWmjY0H+GJVLUNG+QFW+RssR8L2voZvI8/+1hFC1PjyVrCrvbZem+achri/tuCMBpdjjh4Xlirsy1Gx5kRkMo=,iv:DnyV9ksKEGiZE/zKqkhk1ReHYwNyUmsSqev2e7aCVAQ=,tag:KpTHnsamxyv1JbtpKG+8Qg==,type:str]\n pgp: []\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.8.1\n---\nkind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: db\n namespace: wallabag\ndata:\n POSTGRES_USER: ENC[AES256_GCM,data:cnsgtR213+9PMrZo,iv:rRfDZm+n9hiQb2J3ljwCtM1UmmnYNu/9ETxRQUz2As4=,tag:jJ9tCfhokr55omhpWxPXVg==,type:str]\n POSTGRES_DB: ENC[AES256_GCM,data:0ssrdd8l2Hr6u1mq,iv:mIUmLRfo8A2fIbzKDWk5eQUAfvpLuxuavYFQ1Ch7QQM=,tag:N+s8D1QW7YcFMMKOM+GQBQ==,type:str]\n POSTGRES_PASSWORD: ENC[AES256_GCM,data:SiHbaUDGFYcD8pWL,iv:U8m08t8dzUjBIW7jXfD7P+xDltx+Eiybese3g1n2CsA=,tag:ZIrEFT41w4tHh4AVKRwDQQ==,type:str]\nsops:\n kms: []\n gcp_kms: []\n azure_kv: []\n hc_vault: []\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRTc1M0ExK2JtK0dBR1Uy\n LzhEbXJDdkxSajVjODNiZHJPQlR4d2gzeW5jCnVQSFgxRUxtbkhtOXoySzl1ZU1v\n L1JnRUk0TlpENG42dTVaSFMwZVFSNEEKLS0tIE1QeHpxNkg2TU8zY0JtWE5tOWlX\n QU1LcU05dE10ZjJ1UWxKUy9YNTVYbFUKFPfOI/37nSoRj0/LOmhzgJ63k69+lHl7\n apC4Ycq3es3ner5NyGLnKeq2lTFpZXlsd8m8UYidGORE2ndpN9mihA==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2024-08-03T18:13:49Z\"\n mac: ENC[AES256_GCM,data:8Izus6Qvc0NBCfNI3cim96Elw8agrf0l3O3DVaYh/ApyAZuf41/PyctTnY64gWMB5Yt/LonyuWRYnYZ5un1bWTMWmjY0H+GJVLUNG+QFW+RssR8L2voZvI8/+1hFC1PjyVrCrvbZem+achri/tuCMBpdjjh4Xlirsy1Gx5kRkMo=,iv:DnyV9ksKEGiZE/zKqkhk1ReHYwNyUmsSqev2e7aCVAQ=,tag:KpTHnsamxyv1JbtpKG+8Qg==,type:str]\n pgp: []\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.8.1\n" }, { "path": "cluster/homelab/apps/website/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: website\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/website\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/apps/website/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: website\nresources:\n - helm-release.yaml\n - namespace.yaml\n - secret.sops.yaml\n" }, { "path": "cluster/homelab/apps/website/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: website\n" }, { "path": "cluster/homelab/apps/website/secret.sops.yaml", "content": "kind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: website\ndata:\n REQUEST_TIMEOUT: ENC[AES256_GCM,data:iEBil+HGF8s=,iv:72dkrYUQAD1wnEEKKxgHnM5v1Pw01wJ3ZVWP+LxNvMo=,tag:3OFJBFgVdhj9zGXzs9xUhA==,type:str]\n ENV: ENC[AES256_GCM,data:+WiSwEFzDw5pP5A1hxOKJQ==,iv:QGlRfBVPsV++S21QTYL1HN44AV+i4pCtJwj7PGGSs/E=,tag:ONGlpovBj0Qw3zpFQ87ViQ==,type:str]\n USER: ENC[AES256_GCM,data:DIL062NtREM=,iv:FzgDHteBjfeEhXOcFhXOUVM16p/p5yv82aU6tHOcLBw=,tag:G8hd54vIfkF6OzStcH49cA==,type:str]\n PASS: ENC[AES256_GCM,data:bGjFSvpPxb3TVmT9T344Jzxbh64=,iv:xAoeJCYz9j9ZNi36e0QxxJ7sExmePa2gXL0u3lfYsWc=,tag:hcMXhgEopo8ZruW6hAiXUw==,type:str]\n PM2_PUBLIC_KEY: ENC[AES256_GCM,data:3Z0Lte5GeVP98K+Fov1aplVNzhc=,iv:k9RpIXhIoiQcLzh9w6LAPqius8hByvHNZzpRBPFDFHA=,tag:5o1FjymZJfMzd2D8pO5FaA==,type:str]\n PM2_SECRET_KEY: ENC[AES256_GCM,data:nd4N9dKztdXlCGBkZGywUNgPpdg=,iv:PpUxf9yZ6bHuWKjPiPQeQaPlR+spFvySQ6Y2TqLqovM=,tag:QKRVEPWpCvfCPNm4muhGJw==,type:str]\n DATA_PATH: ENC[AES256_GCM,data:SwwjHMBdICU=,iv:nXsiSlz0jy0qF6WWXYRAeJtbip89OhwDvTs8hHYB7h8=,tag:VbqSBgo9TPLzm30OxonbbQ==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2bmg1VGE1dkdLZTREVndZ\n WkRXN1RLYzJjSS9RZWl1TTZ0WTNsWG4zMDBjCktjelZ3VE9KZ0VEZGExQUZhcXFu\n R1pKanNOUVN2ampGV1JEOTdjV0J0aDgKLS0tIEpRYmxsOGhkbDdRTm8zR3dYZ3NI\n RWg3NU5DZkMvTHRxSzZmVHpXNlpvLzAKv1QZr1vuxP0aNdLM/4d8uYBptxs4KzoP\n Uxxvseg5Eo6OGvMnUHTnK33OHodmmEbL7KLGrBPUpSHo1P6i/Lpnow==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-10-24T18:58:53Z\"\n mac: ENC[AES256_GCM,data:TIUnPV9grmOUV79MZvAx5yTGuxQH8PnZX4Yg3uQ9CPRaQfpq6vCp4riik5ZstVpwqV9NYVIu7XT1hjbfDVGmYIWt0RJGYwyBjywuhZ04beJcWTrI+ms9TKhw9LwQLzsAOQ7FtWzGGGwrb0l886wQdOdjoWKyCh77j/RVsY22jBs=,iv:W+mZanSpI+HmzHT7V7QFMS+eSObisDVyJ3lyNcrSrTI=,tag:nJ5zcDUHWFAkMF5pr4O4ow==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/base/.sops.yaml", "content": "creation_rules:\n # Secrets\n - path_regex: .*/*secret.sops.yaml\n encrypted_regex: ^(data|stringData|annotations|)$\n pgp: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n\n # Config Maps\n - path_regex: .*/*config.sops.yaml\n encrypted_regex: ^(data|stringData|annotations|)$\n pgp: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n\n # Ingress Hosts\n - path_regex: .*/*gateway-api.sops.yaml\n encrypted_regex: ^(rules|annotations|)$\n pgp: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n\n # helm-release\n - path_regex: .*/*helm-release.sops.yaml\n encrypted_regex: ^(values)$\n pgp: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n\n # alertmanager alert\n - path_regex: .*/*alert.sops.yaml\n encrypted_regex: ^(receivers)$\n pgp: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n\n # sensitive... just general stuff I don't want to be seen\n - path_regex: .*/*sensitive.sops.yaml\n encrypted_regex: (?i)password|webhook_url|token|key\n pgp: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n" }, { "path": "cluster/homelab/base/apps.yaml", "content": "---\napiVersion: kustomize.toolkit.fluxcd.io/v1\nkind: Kustomization\nmetadata:\n name: apps\n namespace: flux-system\nspec:\n interval: 10m\n dependsOn:\n - name: core\n path: ./cluster/homelab/apps\n prune: true\n decryption:\n provider: sops\n secretRef:\n name: sops-age\n sourceRef:\n kind: GitRepository\n name: flux-system\n" }, { "path": "cluster/homelab/base/configs.yaml", "content": "---\napiVersion: kustomize.toolkit.fluxcd.io/v1\nkind: Kustomization\nmetadata:\n name: configs\n namespace: flux-system\nspec:\n interval: 10m\n dependsOn:\n - name: core\n path: ./cluster/homelab/configs\n prune: true\n decryption:\n provider: sops\n secretRef:\n name: sops-age\n sourceRef:\n kind: GitRepository\n name: flux-system\n" }, { "path": "cluster/homelab/base/core.yaml", "content": "---\napiVersion: kustomize.toolkit.fluxcd.io/v1\nkind: Kustomization\nmetadata:\n name: core\n namespace: flux-system\nspec:\n interval: 10m\n dependsOn:\n - name: helm\n - name: crds\n path: ./cluster/homelab/core\n prune: true\n decryption:\n provider: sops\n secretRef:\n name: sops-age\n sourceRef:\n kind: GitRepository\n name: flux-system\n" }, { "path": "cluster/homelab/base/crds.yaml", "content": "---\napiVersion: kustomize.toolkit.fluxcd.io/v1\nkind: Kustomization\nmetadata:\n name: crds\n namespace: flux-system\nspec:\n interval: 10m\n path: ./cluster/homelab/crds\n prune: true\n decryption:\n provider: sops\n secretRef:\n name: sops-age\n sourceRef:\n kind: GitRepository\n name: flux-system\n" }, { "path": "cluster/homelab/base/flux-system/gotk-components.yaml", "content": "---\n# This manifest was generated by flux. DO NOT EDIT.\n# Flux Version: v2.7.5\n# Components: source-controller,kustomize-controller,helm-controller,notification-controller\napiVersion: v1\nkind: Namespace\nmetadata:\n labels:\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n pod-security.kubernetes.io/warn: restricted\n pod-security.kubernetes.io/warn-version: latest\n name: flux-system\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n labels:\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: allow-egress\n namespace: flux-system\nspec:\n egress:\n - {}\n ingress:\n - from:\n - podSelector: {}\n podSelector: {}\n policyTypes:\n - Ingress\n - Egress\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n labels:\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: allow-scraping\n namespace: flux-system\nspec:\n ingress:\n - from:\n - namespaceSelector: {}\n ports:\n - port: 8080\n protocol: TCP\n podSelector: {}\n policyTypes:\n - Ingress\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n labels:\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: allow-webhooks\n namespace: flux-system\nspec:\n ingress:\n - from:\n - namespaceSelector: {}\n podSelector:\n matchLabels:\n app: notification-controller\n policyTypes:\n - Ingress\n---\napiVersion: v1\nkind: ResourceQuota\nmetadata:\n labels:\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: critical-pods-flux-system\n namespace: flux-system\nspec:\n hard:\n pods: \"1000\"\n scopeSelector:\n matchExpressions:\n - operator: In\n scopeName: PriorityClass\n values:\n - system-node-critical\n - system-cluster-critical\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n labels:\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: crd-controller-flux-system\nrules:\n- apiGroups:\n - source.toolkit.fluxcd.io\n resources:\n - '*'\n verbs:\n - '*'\n- apiGroups:\n - kustomize.toolkit.fluxcd.io\n resources:\n - '*'\n verbs:\n - '*'\n- apiGroups:\n - helm.toolkit.fluxcd.io\n resources:\n - '*'\n verbs:\n - '*'\n- apiGroups:\n - notification.toolkit.fluxcd.io\n resources:\n - '*'\n verbs:\n - '*'\n- apiGroups:\n - image.toolkit.fluxcd.io\n resources:\n - '*'\n verbs:\n - '*'\n- apiGroups:\n - source.extensions.fluxcd.io\n resources:\n - '*'\n verbs:\n - '*'\n- apiGroups:\n - \"\"\n resources:\n - namespaces\n - secrets\n - configmaps\n - serviceaccounts\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n - events\n verbs:\n - create\n - patch\n- apiGroups:\n - \"\"\n resources:\n - configmaps\n verbs:\n - get\n - list\n - watch\n - create\n - update\n - patch\n - delete\n- apiGroups:\n - \"\"\n resources:\n - configmaps/status\n verbs:\n - get\n - update\n - patch\n- apiGroups:\n - coordination.k8s.io\n resources:\n - leases\n verbs:\n - get\n - list\n - watch\n - create\n - update\n - patch\n - delete\n- apiGroups:\n - \"\"\n resources:\n - serviceaccounts/token\n verbs:\n - create\n- nonResourceURLs:\n - /livez/ping\n verbs:\n - head\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n labels:\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n rbac.authorization.k8s.io/aggregate-to-admin: \"true\"\n rbac.authorization.k8s.io/aggregate-to-edit: \"true\"\n name: flux-edit-flux-system\nrules:\n- apiGroups:\n - notification.toolkit.fluxcd.io\n - source.toolkit.fluxcd.io\n - source.extensions.fluxcd.io\n - helm.toolkit.fluxcd.io\n - image.toolkit.fluxcd.io\n - kustomize.toolkit.fluxcd.io\n resources:\n - '*'\n verbs:\n - create\n - delete\n - deletecollection\n - patch\n - update\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n labels:\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n rbac.authorization.k8s.io/aggregate-to-admin: \"true\"\n rbac.authorization.k8s.io/aggregate-to-edit: \"true\"\n rbac.authorization.k8s.io/aggregate-to-view: \"true\"\n name: flux-view-flux-system\nrules:\n- apiGroups:\n - notification.toolkit.fluxcd.io\n - source.toolkit.fluxcd.io\n - source.extensions.fluxcd.io\n - helm.toolkit.fluxcd.io\n - image.toolkit.fluxcd.io\n - kustomize.toolkit.fluxcd.io\n resources:\n - '*'\n verbs:\n - get\n - list\n - watch\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n labels:\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: cluster-reconciler-flux-system\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cluster-admin\nsubjects:\n- kind: ServiceAccount\n name: kustomize-controller\n namespace: flux-system\n- kind: ServiceAccount\n name: helm-controller\n namespace: flux-system\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n labels:\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: crd-controller-flux-system\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: crd-controller-flux-system\nsubjects:\n- kind: ServiceAccount\n name: kustomize-controller\n namespace: flux-system\n- kind: ServiceAccount\n name: helm-controller\n namespace: flux-system\n- kind: ServiceAccount\n name: source-controller\n namespace: flux-system\n- kind: ServiceAccount\n name: notification-controller\n namespace: flux-system\n- kind: ServiceAccount\n name: image-reflector-controller\n namespace: flux-system\n- kind: ServiceAccount\n name: image-automation-controller\n namespace: flux-system\n- kind: ServiceAccount\n name: source-watcher\n namespace: flux-system\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: v0.19.0\n labels:\n app.kubernetes.io/component: source-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: buckets.source.toolkit.fluxcd.io\nspec:\n group: source.toolkit.fluxcd.io\n names:\n kind: Bucket\n listKind: BucketList\n plural: buckets\n singular: bucket\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .spec.endpoint\n name: Endpoint\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n name: v1\n schema:\n openAPIV3Schema:\n description: Bucket is the Schema for the buckets API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n BucketSpec specifies the required configuration to produce an Artifact for\n an object storage bucket.\n properties:\n bucketName:\n description: BucketName is the name of the object storage bucket.\n type: string\n certSecretRef:\n description: |-\n CertSecretRef can be given the name of a Secret containing\n either or both of\n\n - a PEM-encoded client certificate (`tls.crt`) and private\n key (`tls.key`);\n - a PEM-encoded CA certificate (`ca.crt`)\n\n and whichever are supplied, will be used for connecting to the\n bucket. The client cert and key are useful if you are\n authenticating with a certificate; the CA cert is useful if\n you are using a self-signed server certificate. The Secret must\n be of type `Opaque` or `kubernetes.io/tls`.\n\n This field is only supported for the `generic` provider.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n endpoint:\n description: Endpoint is the object storage address the BucketName\n is located at.\n type: string\n ignore:\n description: |-\n Ignore overrides the set of excluded patterns in the .sourceignore format\n (which is the same as .gitignore). If not provided, a default will be used,\n consult the documentation for your version to find out what those are.\n type: string\n insecure:\n description: Insecure allows connecting to a non-TLS HTTP Endpoint.\n type: boolean\n interval:\n description: |-\n Interval at which the Bucket Endpoint is checked for updates.\n This interval is approximate and may be subject to jitter to ensure\n efficient use of resources.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n prefix:\n description: Prefix to use for server-side filtering of files in the\n Bucket.\n type: string\n provider:\n default: generic\n description: |-\n Provider of the object storage bucket.\n Defaults to 'generic', which expects an S3 (API) compatible object\n storage.\n enum:\n - generic\n - aws\n - gcp\n - azure\n type: string\n proxySecretRef:\n description: |-\n ProxySecretRef specifies the Secret containing the proxy configuration\n to use while communicating with the Bucket server.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n region:\n description: Region of the Endpoint where the BucketName is located\n in.\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Secret containing authentication credentials\n for the Bucket.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n serviceAccountName:\n description: |-\n ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate\n the bucket. This field is only supported for the 'gcp' and 'aws' providers.\n For more information about workload identity:\n https://fluxcd.io/flux/components/source/buckets/#workload-identity\n type: string\n sts:\n description: |-\n STS specifies the required configuration to use a Security Token\n Service for fetching temporary credentials to authenticate in a\n Bucket provider.\n\n This field is only supported for the `aws` and `generic` providers.\n properties:\n certSecretRef:\n description: |-\n CertSecretRef can be given the name of a Secret containing\n either or both of\n\n - a PEM-encoded client certificate (`tls.crt`) and private\n key (`tls.key`);\n - a PEM-encoded CA certificate (`ca.crt`)\n\n and whichever are supplied, will be used for connecting to the\n STS endpoint. The client cert and key are useful if you are\n authenticating with a certificate; the CA cert is useful if\n you are using a self-signed server certificate. The Secret must\n be of type `Opaque` or `kubernetes.io/tls`.\n\n This field is only supported for the `ldap` provider.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n endpoint:\n description: |-\n Endpoint is the HTTP/S endpoint of the Security Token Service from\n where temporary credentials will be fetched.\n pattern: ^(http|https)://.*$\n type: string\n provider:\n description: Provider of the Security Token Service.\n enum:\n - aws\n - ldap\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Secret containing authentication credentials\n for the STS endpoint. This Secret must contain the fields `username`\n and `password` and is supported only for the `ldap` provider.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n required:\n - endpoint\n - provider\n type: object\n suspend:\n description: |-\n Suspend tells the controller to suspend the reconciliation of this\n Bucket.\n type: boolean\n timeout:\n default: 60s\n description: Timeout for fetch operations, defaults to 60s.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m))+$\n type: string\n required:\n - bucketName\n - endpoint\n - interval\n type: object\n x-kubernetes-validations:\n - message: STS configuration is only supported for the 'aws' and 'generic'\n Bucket providers\n rule: self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)\n - message: '''aws'' is the only supported STS provider for the ''aws''\n Bucket provider'\n rule: self.provider != 'aws' || !has(self.sts) || self.sts.provider\n == 'aws'\n - message: '''ldap'' is the only supported STS provider for the ''generic''\n Bucket provider'\n rule: self.provider != 'generic' || !has(self.sts) || self.sts.provider\n == 'ldap'\n - message: spec.sts.secretRef is not required for the 'aws' STS provider\n rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.secretRef)'\n - message: spec.sts.certSecretRef is not required for the 'aws' STS provider\n rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.certSecretRef)'\n - message: ServiceAccountName is not supported for the 'generic' Bucket\n provider\n rule: self.provider != 'generic' || !has(self.serviceAccountName)\n - message: cannot set both .spec.secretRef and .spec.serviceAccountName\n rule: '!has(self.secretRef) || !has(self.serviceAccountName)'\n status:\n default:\n observedGeneration: -1\n description: BucketStatus records the observed state of a Bucket.\n properties:\n artifact:\n description: Artifact represents the last successful Bucket reconciliation.\n properties:\n digest:\n description: Digest is the digest of the file in the form of ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n conditions:\n description: Conditions holds the conditions for the Bucket.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: ObservedGeneration is the last observed generation of\n the Bucket object.\n format: int64\n type: integer\n observedIgnore:\n description: |-\n ObservedIgnore is the observed exclusion patterns used for constructing\n the source artifact.\n type: string\n url:\n description: |-\n URL is the dynamic fetch link for the latest Artifact.\n It is provided on a \"best effort\" basis, and using the precise\n BucketStatus.Artifact data is recommended.\n type: string\n type: object\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .spec.endpoint\n name: Endpoint\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n deprecated: true\n deprecationWarning: v1beta2 Bucket is deprecated, upgrade to v1\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: Bucket is the Schema for the buckets API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n BucketSpec specifies the required configuration to produce an Artifact for\n an object storage bucket.\n properties:\n accessFrom:\n description: |-\n AccessFrom specifies an Access Control List for allowing cross-namespace\n references to this object.\n NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092\n properties:\n namespaceSelectors:\n description: |-\n NamespaceSelectors is the list of namespace selectors to which this ACL applies.\n Items in this list are evaluated using a logical OR operation.\n items:\n description: |-\n NamespaceSelector selects the namespaces to which this ACL applies.\n An empty map of MatchLabels matches all namespaces in a cluster.\n properties:\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n type: object\n type: object\n type: array\n required:\n - namespaceSelectors\n type: object\n bucketName:\n description: BucketName is the name of the object storage bucket.\n type: string\n certSecretRef:\n description: |-\n CertSecretRef can be given the name of a Secret containing\n either or both of\n\n - a PEM-encoded client certificate (`tls.crt`) and private\n key (`tls.key`);\n - a PEM-encoded CA certificate (`ca.crt`)\n\n and whichever are supplied, will be used for connecting to the\n bucket. The client cert and key are useful if you are\n authenticating with a certificate; the CA cert is useful if\n you are using a self-signed server certificate. The Secret must\n be of type `Opaque` or `kubernetes.io/tls`.\n\n This field is only supported for the `generic` provider.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n endpoint:\n description: Endpoint is the object storage address the BucketName\n is located at.\n type: string\n ignore:\n description: |-\n Ignore overrides the set of excluded patterns in the .sourceignore format\n (which is the same as .gitignore). If not provided, a default will be used,\n consult the documentation for your version to find out what those are.\n type: string\n insecure:\n description: Insecure allows connecting to a non-TLS HTTP Endpoint.\n type: boolean\n interval:\n description: |-\n Interval at which the Bucket Endpoint is checked for updates.\n This interval is approximate and may be subject to jitter to ensure\n efficient use of resources.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n prefix:\n description: Prefix to use for server-side filtering of files in the\n Bucket.\n type: string\n provider:\n default: generic\n description: |-\n Provider of the object storage bucket.\n Defaults to 'generic', which expects an S3 (API) compatible object\n storage.\n enum:\n - generic\n - aws\n - gcp\n - azure\n type: string\n proxySecretRef:\n description: |-\n ProxySecretRef specifies the Secret containing the proxy configuration\n to use while communicating with the Bucket server.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n region:\n description: Region of the Endpoint where the BucketName is located\n in.\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Secret containing authentication credentials\n for the Bucket.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n sts:\n description: |-\n STS specifies the required configuration to use a Security Token\n Service for fetching temporary credentials to authenticate in a\n Bucket provider.\n\n This field is only supported for the `aws` and `generic` providers.\n properties:\n certSecretRef:\n description: |-\n CertSecretRef can be given the name of a Secret containing\n either or both of\n\n - a PEM-encoded client certificate (`tls.crt`) and private\n key (`tls.key`);\n - a PEM-encoded CA certificate (`ca.crt`)\n\n and whichever are supplied, will be used for connecting to the\n STS endpoint. The client cert and key are useful if you are\n authenticating with a certificate; the CA cert is useful if\n you are using a self-signed server certificate. The Secret must\n be of type `Opaque` or `kubernetes.io/tls`.\n\n This field is only supported for the `ldap` provider.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n endpoint:\n description: |-\n Endpoint is the HTTP/S endpoint of the Security Token Service from\n where temporary credentials will be fetched.\n pattern: ^(http|https)://.*$\n type: string\n provider:\n description: Provider of the Security Token Service.\n enum:\n - aws\n - ldap\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Secret containing authentication credentials\n for the STS endpoint. This Secret must contain the fields `username`\n and `password` and is supported only for the `ldap` provider.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n required:\n - endpoint\n - provider\n type: object\n suspend:\n description: |-\n Suspend tells the controller to suspend the reconciliation of this\n Bucket.\n type: boolean\n timeout:\n default: 60s\n description: Timeout for fetch operations, defaults to 60s.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m))+$\n type: string\n required:\n - bucketName\n - endpoint\n - interval\n type: object\n x-kubernetes-validations:\n - message: STS configuration is only supported for the 'aws' and 'generic'\n Bucket providers\n rule: self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)\n - message: '''aws'' is the only supported STS provider for the ''aws''\n Bucket provider'\n rule: self.provider != 'aws' || !has(self.sts) || self.sts.provider\n == 'aws'\n - message: '''ldap'' is the only supported STS provider for the ''generic''\n Bucket provider'\n rule: self.provider != 'generic' || !has(self.sts) || self.sts.provider\n == 'ldap'\n - message: spec.sts.secretRef is not required for the 'aws' STS provider\n rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.secretRef)'\n - message: spec.sts.certSecretRef is not required for the 'aws' STS provider\n rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.certSecretRef)'\n status:\n default:\n observedGeneration: -1\n description: BucketStatus records the observed state of a Bucket.\n properties:\n artifact:\n description: Artifact represents the last successful Bucket reconciliation.\n properties:\n digest:\n description: Digest is the digest of the file in the form of ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n conditions:\n description: Conditions holds the conditions for the Bucket.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: ObservedGeneration is the last observed generation of\n the Bucket object.\n format: int64\n type: integer\n observedIgnore:\n description: |-\n ObservedIgnore is the observed exclusion patterns used for constructing\n the source artifact.\n type: string\n url:\n description: |-\n URL is the dynamic fetch link for the latest Artifact.\n It is provided on a \"best effort\" basis, and using the precise\n BucketStatus.Artifact data is recommended.\n type: string\n type: object\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: v0.19.0\n labels:\n app.kubernetes.io/component: source-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: externalartifacts.source.toolkit.fluxcd.io\nspec:\n group: source.toolkit.fluxcd.io\n names:\n kind: ExternalArtifact\n listKind: ExternalArtifactList\n plural: externalartifacts\n singular: externalartifact\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n - jsonPath: .spec.sourceRef.name\n name: Source\n type: string\n name: v1\n schema:\n openAPIV3Schema:\n description: ExternalArtifact is the Schema for the external artifacts API\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: ExternalArtifactSpec defines the desired state of ExternalArtifact\n properties:\n sourceRef:\n description: |-\n SourceRef points to the Kubernetes custom resource for\n which the artifact is generated.\n properties:\n apiVersion:\n description: API version of the referent, if not specified the\n Kubernetes preferred version will be used.\n type: string\n kind:\n description: Kind of the referent.\n type: string\n name:\n description: Name of the referent.\n type: string\n namespace:\n description: Namespace of the referent, when not specified it\n acts as LocalObjectReference.\n type: string\n required:\n - kind\n - name\n type: object\n type: object\n status:\n description: ExternalArtifactStatus defines the observed state of ExternalArtifact\n properties:\n artifact:\n description: Artifact represents the output of an ExternalArtifact\n reconciliation.\n properties:\n digest:\n description: Digest is the digest of the file in the form of ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n conditions:\n description: Conditions holds the conditions for the ExternalArtifact.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n type: object\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: v0.19.0\n labels:\n app.kubernetes.io/component: source-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: gitrepositories.source.toolkit.fluxcd.io\nspec:\n group: source.toolkit.fluxcd.io\n names:\n kind: GitRepository\n listKind: GitRepositoryList\n plural: gitrepositories\n shortNames:\n - gitrepo\n singular: gitrepository\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .spec.url\n name: URL\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n name: v1\n schema:\n openAPIV3Schema:\n description: GitRepository is the Schema for the gitrepositories API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n GitRepositorySpec specifies the required configuration to produce an\n Artifact for a Git repository.\n properties:\n ignore:\n description: |-\n Ignore overrides the set of excluded patterns in the .sourceignore format\n (which is the same as .gitignore). If not provided, a default will be used,\n consult the documentation for your version to find out what those are.\n type: string\n include:\n description: |-\n Include specifies a list of GitRepository resources which Artifacts\n should be included in the Artifact produced for this GitRepository.\n items:\n description: |-\n GitRepositoryInclude specifies a local reference to a GitRepository which\n Artifact (sub-)contents must be included, and where they should be placed.\n properties:\n fromPath:\n description: |-\n FromPath specifies the path to copy contents from, defaults to the root\n of the Artifact.\n type: string\n repository:\n description: |-\n GitRepositoryRef specifies the GitRepository which Artifact contents\n must be included.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n toPath:\n description: |-\n ToPath specifies the path to copy contents to, defaults to the name of\n the GitRepositoryRef.\n type: string\n required:\n - repository\n type: object\n type: array\n interval:\n description: |-\n Interval at which the GitRepository URL is checked for updates.\n This interval is approximate and may be subject to jitter to ensure\n efficient use of resources.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n provider:\n description: |-\n Provider used for authentication, can be 'azure', 'github', 'generic'.\n When not specified, defaults to 'generic'.\n enum:\n - generic\n - azure\n - github\n type: string\n proxySecretRef:\n description: |-\n ProxySecretRef specifies the Secret containing the proxy configuration\n to use while communicating with the Git server.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n recurseSubmodules:\n description: |-\n RecurseSubmodules enables the initialization of all submodules within\n the GitRepository as cloned from the URL, using their default settings.\n type: boolean\n ref:\n description: |-\n Reference specifies the Git reference to resolve and monitor for\n changes, defaults to the 'master' branch.\n properties:\n branch:\n description: Branch to check out, defaults to 'master' if no other\n field is defined.\n type: string\n commit:\n description: |-\n Commit SHA to check out, takes precedence over all reference fields.\n\n This can be combined with Branch to shallow clone the branch, in which\n the commit is expected to exist.\n type: string\n name:\n description: |-\n Name of the reference to check out; takes precedence over Branch, Tag and SemVer.\n\n It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description\n Examples: \"refs/heads/main\", \"refs/tags/v0.1.0\", \"refs/pull/420/head\", \"refs/merge-requests/1/head\"\n type: string\n semver:\n description: SemVer tag expression to check out, takes precedence\n over Tag.\n type: string\n tag:\n description: Tag to check out, takes precedence over Branch.\n type: string\n type: object\n secretRef:\n description: |-\n SecretRef specifies the Secret containing authentication credentials for\n the GitRepository.\n For HTTPS repositories the Secret must contain 'username' and 'password'\n fields for basic auth or 'bearerToken' field for token auth.\n For SSH repositories the Secret must contain 'identity'\n and 'known_hosts' fields.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n serviceAccountName:\n description: |-\n ServiceAccountName is the name of the Kubernetes ServiceAccount used to\n authenticate to the GitRepository. This field is only supported for 'azure' provider.\n type: string\n sparseCheckout:\n description: |-\n SparseCheckout specifies a list of directories to checkout when cloning\n the repository. If specified, only these directories are included in the\n Artifact produced for this GitRepository.\n items:\n type: string\n type: array\n suspend:\n description: |-\n Suspend tells the controller to suspend the reconciliation of this\n GitRepository.\n type: boolean\n timeout:\n default: 60s\n description: Timeout for Git operations like cloning, defaults to\n 60s.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m))+$\n type: string\n url:\n description: URL specifies the Git repository URL, it can be an HTTP/S\n or SSH address.\n pattern: ^(http|https|ssh)://.*$\n type: string\n verify:\n description: |-\n Verification specifies the configuration to verify the Git commit\n signature(s).\n properties:\n mode:\n default: HEAD\n description: |-\n Mode specifies which Git object(s) should be verified.\n\n The variants \"head\" and \"HEAD\" both imply the same thing, i.e. verify\n the commit that the HEAD of the Git repository points to. The variant\n \"head\" solely exists to ensure backwards compatibility.\n enum:\n - head\n - HEAD\n - Tag\n - TagAndHEAD\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Secret containing the public keys of trusted Git\n authors.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n required:\n - secretRef\n type: object\n required:\n - interval\n - url\n type: object\n x-kubernetes-validations:\n - message: serviceAccountName can only be set when provider is 'azure'\n rule: '!has(self.serviceAccountName) || (has(self.provider) && self.provider\n == ''azure'')'\n status:\n default:\n observedGeneration: -1\n description: GitRepositoryStatus records the observed state of a Git repository.\n properties:\n artifact:\n description: Artifact represents the last successful GitRepository\n reconciliation.\n properties:\n digest:\n description: Digest is the digest of the file in the form of ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n conditions:\n description: Conditions holds the conditions for the GitRepository.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n includedArtifacts:\n description: |-\n IncludedArtifacts contains a list of the last successfully included\n Artifacts as instructed by GitRepositorySpec.Include.\n items:\n description: Artifact represents the output of a Source reconciliation.\n properties:\n digest:\n description: Digest is the digest of the file in the form of\n ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI\n annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: |-\n ObservedGeneration is the last observed generation of the GitRepository\n object.\n format: int64\n type: integer\n observedIgnore:\n description: |-\n ObservedIgnore is the observed exclusion patterns used for constructing\n the source artifact.\n type: string\n observedInclude:\n description: |-\n ObservedInclude is the observed list of GitRepository resources used to\n produce the current Artifact.\n items:\n description: |-\n GitRepositoryInclude specifies a local reference to a GitRepository which\n Artifact (sub-)contents must be included, and where they should be placed.\n properties:\n fromPath:\n description: |-\n FromPath specifies the path to copy contents from, defaults to the root\n of the Artifact.\n type: string\n repository:\n description: |-\n GitRepositoryRef specifies the GitRepository which Artifact contents\n must be included.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n toPath:\n description: |-\n ToPath specifies the path to copy contents to, defaults to the name of\n the GitRepositoryRef.\n type: string\n required:\n - repository\n type: object\n type: array\n observedRecurseSubmodules:\n description: |-\n ObservedRecurseSubmodules is the observed resource submodules\n configuration used to produce the current Artifact.\n type: boolean\n observedSparseCheckout:\n description: |-\n ObservedSparseCheckout is the observed list of directories used to\n produce the current Artifact.\n items:\n type: string\n type: array\n sourceVerificationMode:\n description: |-\n SourceVerificationMode is the last used verification mode indicating\n which Git object(s) have been verified.\n type: string\n type: object\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .spec.url\n name: URL\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n deprecated: true\n deprecationWarning: v1beta2 GitRepository is deprecated, upgrade to v1\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: GitRepository is the Schema for the gitrepositories API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n GitRepositorySpec specifies the required configuration to produce an\n Artifact for a Git repository.\n properties:\n accessFrom:\n description: |-\n AccessFrom specifies an Access Control List for allowing cross-namespace\n references to this object.\n NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092\n properties:\n namespaceSelectors:\n description: |-\n NamespaceSelectors is the list of namespace selectors to which this ACL applies.\n Items in this list are evaluated using a logical OR operation.\n items:\n description: |-\n NamespaceSelector selects the namespaces to which this ACL applies.\n An empty map of MatchLabels matches all namespaces in a cluster.\n properties:\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n type: object\n type: object\n type: array\n required:\n - namespaceSelectors\n type: object\n gitImplementation:\n default: go-git\n description: |-\n GitImplementation specifies which Git client library implementation to\n use. Defaults to 'go-git', valid values are ('go-git', 'libgit2').\n Deprecated: gitImplementation is deprecated now that 'go-git' is the\n only supported implementation.\n enum:\n - go-git\n - libgit2\n type: string\n ignore:\n description: |-\n Ignore overrides the set of excluded patterns in the .sourceignore format\n (which is the same as .gitignore). If not provided, a default will be used,\n consult the documentation for your version to find out what those are.\n type: string\n include:\n description: |-\n Include specifies a list of GitRepository resources which Artifacts\n should be included in the Artifact produced for this GitRepository.\n items:\n description: |-\n GitRepositoryInclude specifies a local reference to a GitRepository which\n Artifact (sub-)contents must be included, and where they should be placed.\n properties:\n fromPath:\n description: |-\n FromPath specifies the path to copy contents from, defaults to the root\n of the Artifact.\n type: string\n repository:\n description: |-\n GitRepositoryRef specifies the GitRepository which Artifact contents\n must be included.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n toPath:\n description: |-\n ToPath specifies the path to copy contents to, defaults to the name of\n the GitRepositoryRef.\n type: string\n required:\n - repository\n type: object\n type: array\n interval:\n description: Interval at which to check the GitRepository for updates.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n recurseSubmodules:\n description: |-\n RecurseSubmodules enables the initialization of all submodules within\n the GitRepository as cloned from the URL, using their default settings.\n type: boolean\n ref:\n description: |-\n Reference specifies the Git reference to resolve and monitor for\n changes, defaults to the 'master' branch.\n properties:\n branch:\n description: Branch to check out, defaults to 'master' if no other\n field is defined.\n type: string\n commit:\n description: |-\n Commit SHA to check out, takes precedence over all reference fields.\n\n This can be combined with Branch to shallow clone the branch, in which\n the commit is expected to exist.\n type: string\n name:\n description: |-\n Name of the reference to check out; takes precedence over Branch, Tag and SemVer.\n\n It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description\n Examples: \"refs/heads/main\", \"refs/tags/v0.1.0\", \"refs/pull/420/head\", \"refs/merge-requests/1/head\"\n type: string\n semver:\n description: SemVer tag expression to check out, takes precedence\n over Tag.\n type: string\n tag:\n description: Tag to check out, takes precedence over Branch.\n type: string\n type: object\n secretRef:\n description: |-\n SecretRef specifies the Secret containing authentication credentials for\n the GitRepository.\n For HTTPS repositories the Secret must contain 'username' and 'password'\n fields for basic auth or 'bearerToken' field for token auth.\n For SSH repositories the Secret must contain 'identity'\n and 'known_hosts' fields.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n suspend:\n description: |-\n Suspend tells the controller to suspend the reconciliation of this\n GitRepository.\n type: boolean\n timeout:\n default: 60s\n description: Timeout for Git operations like cloning, defaults to\n 60s.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m))+$\n type: string\n url:\n description: URL specifies the Git repository URL, it can be an HTTP/S\n or SSH address.\n pattern: ^(http|https|ssh)://.*$\n type: string\n verify:\n description: |-\n Verification specifies the configuration to verify the Git commit\n signature(s).\n properties:\n mode:\n description: Mode specifies what Git object should be verified,\n currently ('head').\n enum:\n - head\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Secret containing the public keys of trusted Git\n authors.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n required:\n - mode\n - secretRef\n type: object\n required:\n - interval\n - url\n type: object\n status:\n default:\n observedGeneration: -1\n description: GitRepositoryStatus records the observed state of a Git repository.\n properties:\n artifact:\n description: Artifact represents the last successful GitRepository\n reconciliation.\n properties:\n digest:\n description: Digest is the digest of the file in the form of ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n conditions:\n description: Conditions holds the conditions for the GitRepository.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n contentConfigChecksum:\n description: |-\n ContentConfigChecksum is a checksum of all the configurations related to\n the content of the source artifact:\n - .spec.ignore\n - .spec.recurseSubmodules\n - .spec.included and the checksum of the included artifacts\n observed in .status.observedGeneration version of the object. This can\n be used to determine if the content of the included repository has\n changed.\n It has the format of `:`, for example: `sha256:`.\n\n Deprecated: Replaced with explicit fields for observed artifact content\n config in the status.\n type: string\n includedArtifacts:\n description: |-\n IncludedArtifacts contains a list of the last successfully included\n Artifacts as instructed by GitRepositorySpec.Include.\n items:\n description: Artifact represents the output of a Source reconciliation.\n properties:\n digest:\n description: Digest is the digest of the file in the form of\n ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI\n annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: |-\n ObservedGeneration is the last observed generation of the GitRepository\n object.\n format: int64\n type: integer\n observedIgnore:\n description: |-\n ObservedIgnore is the observed exclusion patterns used for constructing\n the source artifact.\n type: string\n observedInclude:\n description: |-\n ObservedInclude is the observed list of GitRepository resources used to\n to produce the current Artifact.\n items:\n description: |-\n GitRepositoryInclude specifies a local reference to a GitRepository which\n Artifact (sub-)contents must be included, and where they should be placed.\n properties:\n fromPath:\n description: |-\n FromPath specifies the path to copy contents from, defaults to the root\n of the Artifact.\n type: string\n repository:\n description: |-\n GitRepositoryRef specifies the GitRepository which Artifact contents\n must be included.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n toPath:\n description: |-\n ToPath specifies the path to copy contents to, defaults to the name of\n the GitRepositoryRef.\n type: string\n required:\n - repository\n type: object\n type: array\n observedRecurseSubmodules:\n description: |-\n ObservedRecurseSubmodules is the observed resource submodules\n configuration used to produce the current Artifact.\n type: boolean\n url:\n description: |-\n URL is the dynamic fetch link for the latest Artifact.\n It is provided on a \"best effort\" basis, and using the precise\n GitRepositoryStatus.Artifact data is recommended.\n type: string\n type: object\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: v0.19.0\n labels:\n app.kubernetes.io/component: source-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: helmcharts.source.toolkit.fluxcd.io\nspec:\n group: source.toolkit.fluxcd.io\n names:\n kind: HelmChart\n listKind: HelmChartList\n plural: helmcharts\n shortNames:\n - hc\n singular: helmchart\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .spec.chart\n name: Chart\n type: string\n - jsonPath: .spec.version\n name: Version\n type: string\n - jsonPath: .spec.sourceRef.kind\n name: Source Kind\n type: string\n - jsonPath: .spec.sourceRef.name\n name: Source Name\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n name: v1\n schema:\n openAPIV3Schema:\n description: HelmChart is the Schema for the helmcharts API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: HelmChartSpec specifies the desired state of a Helm chart.\n properties:\n chart:\n description: |-\n Chart is the name or path the Helm chart is available at in the\n SourceRef.\n type: string\n ignoreMissingValuesFiles:\n description: |-\n IgnoreMissingValuesFiles controls whether to silently ignore missing values\n files rather than failing.\n type: boolean\n interval:\n description: |-\n Interval at which the HelmChart SourceRef is checked for updates.\n This interval is approximate and may be subject to jitter to ensure\n efficient use of resources.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n reconcileStrategy:\n default: ChartVersion\n description: |-\n ReconcileStrategy determines what enables the creation of a new artifact.\n Valid values are ('ChartVersion', 'Revision').\n See the documentation of the values for an explanation on their behavior.\n Defaults to ChartVersion when omitted.\n enum:\n - ChartVersion\n - Revision\n type: string\n sourceRef:\n description: SourceRef is the reference to the Source the chart is\n available at.\n properties:\n apiVersion:\n description: APIVersion of the referent.\n type: string\n kind:\n description: |-\n Kind of the referent, valid values are ('HelmRepository', 'GitRepository',\n 'Bucket').\n enum:\n - HelmRepository\n - GitRepository\n - Bucket\n type: string\n name:\n description: Name of the referent.\n type: string\n required:\n - kind\n - name\n type: object\n suspend:\n description: |-\n Suspend tells the controller to suspend the reconciliation of this\n source.\n type: boolean\n valuesFiles:\n description: |-\n ValuesFiles is an alternative list of values files to use as the chart\n values (values.yaml is not included by default), expected to be a\n relative path in the SourceRef.\n Values files are merged in the order of this list with the last file\n overriding the first. Ignored when omitted.\n items:\n type: string\n type: array\n verify:\n description: |-\n Verify contains the secret name containing the trusted public keys\n used to verify the signature and specifies which provider to use to check\n whether OCI image is authentic.\n This field is only supported when using HelmRepository source with spec.type 'oci'.\n Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.\n properties:\n matchOIDCIdentity:\n description: |-\n MatchOIDCIdentity specifies the identity matching criteria to use\n while verifying an OCI artifact which was signed using Cosign keyless\n signing. The artifact's identity is deemed to be verified if any of the\n specified matchers match against the identity.\n items:\n description: |-\n OIDCIdentityMatch specifies options for verifying the certificate identity,\n i.e. the issuer and the subject of the certificate.\n properties:\n issuer:\n description: |-\n Issuer specifies the regex pattern to match against to verify\n the OIDC issuer in the Fulcio certificate. The pattern must be a\n valid Go regular expression.\n type: string\n subject:\n description: |-\n Subject specifies the regex pattern to match against to verify\n the identity subject in the Fulcio certificate. The pattern must\n be a valid Go regular expression.\n type: string\n required:\n - issuer\n - subject\n type: object\n type: array\n provider:\n default: cosign\n description: Provider specifies the technology used to sign the\n OCI Artifact.\n enum:\n - cosign\n - notation\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Kubernetes Secret containing the\n trusted public keys.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n required:\n - provider\n type: object\n version:\n default: '*'\n description: |-\n Version is the chart version semver expression, ignored for charts from\n GitRepository and Bucket sources. Defaults to latest when omitted.\n type: string\n required:\n - chart\n - interval\n - sourceRef\n type: object\n status:\n default:\n observedGeneration: -1\n description: HelmChartStatus records the observed state of the HelmChart.\n properties:\n artifact:\n description: Artifact represents the output of the last successful\n reconciliation.\n properties:\n digest:\n description: Digest is the digest of the file in the form of ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n conditions:\n description: Conditions holds the conditions for the HelmChart.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedChartName:\n description: |-\n ObservedChartName is the last observed chart name as specified by the\n resolved chart reference.\n type: string\n observedGeneration:\n description: |-\n ObservedGeneration is the last observed generation of the HelmChart\n object.\n format: int64\n type: integer\n observedSourceArtifactRevision:\n description: |-\n ObservedSourceArtifactRevision is the last observed Artifact.Revision\n of the HelmChartSpec.SourceRef.\n type: string\n observedValuesFiles:\n description: |-\n ObservedValuesFiles are the observed value files of the last successful\n reconciliation.\n It matches the chart in the last successfully reconciled artifact.\n items:\n type: string\n type: array\n url:\n description: |-\n URL is the dynamic fetch link for the latest Artifact.\n It is provided on a \"best effort\" basis, and using the precise\n BucketStatus.Artifact data is recommended.\n type: string\n type: object\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .spec.chart\n name: Chart\n type: string\n - jsonPath: .spec.version\n name: Version\n type: string\n - jsonPath: .spec.sourceRef.kind\n name: Source Kind\n type: string\n - jsonPath: .spec.sourceRef.name\n name: Source Name\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n deprecated: true\n deprecationWarning: v1beta2 HelmChart is deprecated, upgrade to v1\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: HelmChart is the Schema for the helmcharts API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: HelmChartSpec specifies the desired state of a Helm chart.\n properties:\n accessFrom:\n description: |-\n AccessFrom specifies an Access Control List for allowing cross-namespace\n references to this object.\n NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092\n properties:\n namespaceSelectors:\n description: |-\n NamespaceSelectors is the list of namespace selectors to which this ACL applies.\n Items in this list are evaluated using a logical OR operation.\n items:\n description: |-\n NamespaceSelector selects the namespaces to which this ACL applies.\n An empty map of MatchLabels matches all namespaces in a cluster.\n properties:\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n type: object\n type: object\n type: array\n required:\n - namespaceSelectors\n type: object\n chart:\n description: |-\n Chart is the name or path the Helm chart is available at in the\n SourceRef.\n type: string\n ignoreMissingValuesFiles:\n description: |-\n IgnoreMissingValuesFiles controls whether to silently ignore missing values\n files rather than failing.\n type: boolean\n interval:\n description: |-\n Interval at which the HelmChart SourceRef is checked for updates.\n This interval is approximate and may be subject to jitter to ensure\n efficient use of resources.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n reconcileStrategy:\n default: ChartVersion\n description: |-\n ReconcileStrategy determines what enables the creation of a new artifact.\n Valid values are ('ChartVersion', 'Revision').\n See the documentation of the values for an explanation on their behavior.\n Defaults to ChartVersion when omitted.\n enum:\n - ChartVersion\n - Revision\n type: string\n sourceRef:\n description: SourceRef is the reference to the Source the chart is\n available at.\n properties:\n apiVersion:\n description: APIVersion of the referent.\n type: string\n kind:\n description: |-\n Kind of the referent, valid values are ('HelmRepository', 'GitRepository',\n 'Bucket').\n enum:\n - HelmRepository\n - GitRepository\n - Bucket\n type: string\n name:\n description: Name of the referent.\n type: string\n required:\n - kind\n - name\n type: object\n suspend:\n description: |-\n Suspend tells the controller to suspend the reconciliation of this\n source.\n type: boolean\n valuesFile:\n description: |-\n ValuesFile is an alternative values file to use as the default chart\n values, expected to be a relative path in the SourceRef. Deprecated in\n favor of ValuesFiles, for backwards compatibility the file specified here\n is merged before the ValuesFiles items. Ignored when omitted.\n type: string\n valuesFiles:\n description: |-\n ValuesFiles is an alternative list of values files to use as the chart\n values (values.yaml is not included by default), expected to be a\n relative path in the SourceRef.\n Values files are merged in the order of this list with the last file\n overriding the first. Ignored when omitted.\n items:\n type: string\n type: array\n verify:\n description: |-\n Verify contains the secret name containing the trusted public keys\n used to verify the signature and specifies which provider to use to check\n whether OCI image is authentic.\n This field is only supported when using HelmRepository source with spec.type 'oci'.\n Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.\n properties:\n matchOIDCIdentity:\n description: |-\n MatchOIDCIdentity specifies the identity matching criteria to use\n while verifying an OCI artifact which was signed using Cosign keyless\n signing. The artifact's identity is deemed to be verified if any of the\n specified matchers match against the identity.\n items:\n description: |-\n OIDCIdentityMatch specifies options for verifying the certificate identity,\n i.e. the issuer and the subject of the certificate.\n properties:\n issuer:\n description: |-\n Issuer specifies the regex pattern to match against to verify\n the OIDC issuer in the Fulcio certificate. The pattern must be a\n valid Go regular expression.\n type: string\n subject:\n description: |-\n Subject specifies the regex pattern to match against to verify\n the identity subject in the Fulcio certificate. The pattern must\n be a valid Go regular expression.\n type: string\n required:\n - issuer\n - subject\n type: object\n type: array\n provider:\n default: cosign\n description: Provider specifies the technology used to sign the\n OCI Artifact.\n enum:\n - cosign\n - notation\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Kubernetes Secret containing the\n trusted public keys.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n required:\n - provider\n type: object\n version:\n default: '*'\n description: |-\n Version is the chart version semver expression, ignored for charts from\n GitRepository and Bucket sources. Defaults to latest when omitted.\n type: string\n required:\n - chart\n - interval\n - sourceRef\n type: object\n status:\n default:\n observedGeneration: -1\n description: HelmChartStatus records the observed state of the HelmChart.\n properties:\n artifact:\n description: Artifact represents the output of the last successful\n reconciliation.\n properties:\n digest:\n description: Digest is the digest of the file in the form of ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n conditions:\n description: Conditions holds the conditions for the HelmChart.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedChartName:\n description: |-\n ObservedChartName is the last observed chart name as specified by the\n resolved chart reference.\n type: string\n observedGeneration:\n description: |-\n ObservedGeneration is the last observed generation of the HelmChart\n object.\n format: int64\n type: integer\n observedSourceArtifactRevision:\n description: |-\n ObservedSourceArtifactRevision is the last observed Artifact.Revision\n of the HelmChartSpec.SourceRef.\n type: string\n observedValuesFiles:\n description: |-\n ObservedValuesFiles are the observed value files of the last successful\n reconciliation.\n It matches the chart in the last successfully reconciled artifact.\n items:\n type: string\n type: array\n url:\n description: |-\n URL is the dynamic fetch link for the latest Artifact.\n It is provided on a \"best effort\" basis, and using the precise\n BucketStatus.Artifact data is recommended.\n type: string\n type: object\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: v0.19.0\n labels:\n app.kubernetes.io/component: source-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: helmrepositories.source.toolkit.fluxcd.io\nspec:\n group: source.toolkit.fluxcd.io\n names:\n kind: HelmRepository\n listKind: HelmRepositoryList\n plural: helmrepositories\n shortNames:\n - helmrepo\n singular: helmrepository\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .spec.url\n name: URL\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n name: v1\n schema:\n openAPIV3Schema:\n description: HelmRepository is the Schema for the helmrepositories API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n HelmRepositorySpec specifies the required configuration to produce an\n Artifact for a Helm repository index YAML.\n properties:\n accessFrom:\n description: |-\n AccessFrom specifies an Access Control List for allowing cross-namespace\n references to this object.\n NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092\n properties:\n namespaceSelectors:\n description: |-\n NamespaceSelectors is the list of namespace selectors to which this ACL applies.\n Items in this list are evaluated using a logical OR operation.\n items:\n description: |-\n NamespaceSelector selects the namespaces to which this ACL applies.\n An empty map of MatchLabels matches all namespaces in a cluster.\n properties:\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n type: object\n type: object\n type: array\n required:\n - namespaceSelectors\n type: object\n certSecretRef:\n description: |-\n CertSecretRef can be given the name of a Secret containing\n either or both of\n\n - a PEM-encoded client certificate (`tls.crt`) and private\n key (`tls.key`);\n - a PEM-encoded CA certificate (`ca.crt`)\n\n and whichever are supplied, will be used for connecting to the\n registry. The client cert and key are useful if you are\n authenticating with a certificate; the CA cert is useful if\n you are using a self-signed server certificate. The Secret must\n be of type `Opaque` or `kubernetes.io/tls`.\n\n It takes precedence over the values specified in the Secret referred\n to by `.spec.secretRef`.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n insecure:\n description: |-\n Insecure allows connecting to a non-TLS HTTP container registry.\n This field is only taken into account if the .spec.type field is set to 'oci'.\n type: boolean\n interval:\n description: |-\n Interval at which the HelmRepository URL is checked for updates.\n This interval is approximate and may be subject to jitter to ensure\n efficient use of resources.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n passCredentials:\n description: |-\n PassCredentials allows the credentials from the SecretRef to be passed\n on to a host that does not match the host as defined in URL.\n This may be required if the host of the advertised chart URLs in the\n index differ from the defined URL.\n Enabling this should be done with caution, as it can potentially result\n in credentials getting stolen in a MITM-attack.\n type: boolean\n provider:\n default: generic\n description: |-\n Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.\n This field is optional, and only taken into account if the .spec.type field is set to 'oci'.\n When not specified, defaults to 'generic'.\n enum:\n - generic\n - aws\n - azure\n - gcp\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Secret containing authentication credentials\n for the HelmRepository.\n For HTTP/S basic auth the secret must contain 'username' and 'password'\n fields.\n Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'\n keys is deprecated. Please use `.spec.certSecretRef` instead.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n suspend:\n description: |-\n Suspend tells the controller to suspend the reconciliation of this\n HelmRepository.\n type: boolean\n timeout:\n description: |-\n Timeout is used for the index fetch operation for an HTTPS helm repository,\n and for remote OCI Repository operations like pulling for an OCI helm\n chart by the associated HelmChart.\n Its default value is 60s.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m))+$\n type: string\n type:\n description: |-\n Type of the HelmRepository.\n When this field is set to \"oci\", the URL field value must be prefixed with \"oci://\".\n enum:\n - default\n - oci\n type: string\n url:\n description: |-\n URL of the Helm repository, a valid URL contains at least a protocol and\n host.\n pattern: ^(http|https|oci)://.*$\n type: string\n required:\n - url\n type: object\n status:\n default:\n observedGeneration: -1\n description: HelmRepositoryStatus records the observed state of the HelmRepository.\n properties:\n artifact:\n description: Artifact represents the last successful HelmRepository\n reconciliation.\n properties:\n digest:\n description: Digest is the digest of the file in the form of ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n conditions:\n description: Conditions holds the conditions for the HelmRepository.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: |-\n ObservedGeneration is the last observed generation of the HelmRepository\n object.\n format: int64\n type: integer\n url:\n description: |-\n URL is the dynamic fetch link for the latest Artifact.\n It is provided on a \"best effort\" basis, and using the precise\n HelmRepositoryStatus.Artifact data is recommended.\n type: string\n type: object\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .spec.url\n name: URL\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n deprecated: true\n deprecationWarning: v1beta2 HelmRepository is deprecated, upgrade to v1\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: HelmRepository is the Schema for the helmrepositories API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n HelmRepositorySpec specifies the required configuration to produce an\n Artifact for a Helm repository index YAML.\n properties:\n accessFrom:\n description: |-\n AccessFrom specifies an Access Control List for allowing cross-namespace\n references to this object.\n NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092\n properties:\n namespaceSelectors:\n description: |-\n NamespaceSelectors is the list of namespace selectors to which this ACL applies.\n Items in this list are evaluated using a logical OR operation.\n items:\n description: |-\n NamespaceSelector selects the namespaces to which this ACL applies.\n An empty map of MatchLabels matches all namespaces in a cluster.\n properties:\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n type: object\n type: object\n type: array\n required:\n - namespaceSelectors\n type: object\n certSecretRef:\n description: |-\n CertSecretRef can be given the name of a Secret containing\n either or both of\n\n - a PEM-encoded client certificate (`tls.crt`) and private\n key (`tls.key`);\n - a PEM-encoded CA certificate (`ca.crt`)\n\n and whichever are supplied, will be used for connecting to the\n registry. The client cert and key are useful if you are\n authenticating with a certificate; the CA cert is useful if\n you are using a self-signed server certificate. The Secret must\n be of type `Opaque` or `kubernetes.io/tls`.\n\n It takes precedence over the values specified in the Secret referred\n to by `.spec.secretRef`.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n insecure:\n description: |-\n Insecure allows connecting to a non-TLS HTTP container registry.\n This field is only taken into account if the .spec.type field is set to 'oci'.\n type: boolean\n interval:\n description: |-\n Interval at which the HelmRepository URL is checked for updates.\n This interval is approximate and may be subject to jitter to ensure\n efficient use of resources.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n passCredentials:\n description: |-\n PassCredentials allows the credentials from the SecretRef to be passed\n on to a host that does not match the host as defined in URL.\n This may be required if the host of the advertised chart URLs in the\n index differ from the defined URL.\n Enabling this should be done with caution, as it can potentially result\n in credentials getting stolen in a MITM-attack.\n type: boolean\n provider:\n default: generic\n description: |-\n Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.\n This field is optional, and only taken into account if the .spec.type field is set to 'oci'.\n When not specified, defaults to 'generic'.\n enum:\n - generic\n - aws\n - azure\n - gcp\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Secret containing authentication credentials\n for the HelmRepository.\n For HTTP/S basic auth the secret must contain 'username' and 'password'\n fields.\n Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'\n keys is deprecated. Please use `.spec.certSecretRef` instead.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n suspend:\n description: |-\n Suspend tells the controller to suspend the reconciliation of this\n HelmRepository.\n type: boolean\n timeout:\n description: |-\n Timeout is used for the index fetch operation for an HTTPS helm repository,\n and for remote OCI Repository operations like pulling for an OCI helm\n chart by the associated HelmChart.\n Its default value is 60s.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m))+$\n type: string\n type:\n description: |-\n Type of the HelmRepository.\n When this field is set to \"oci\", the URL field value must be prefixed with \"oci://\".\n enum:\n - default\n - oci\n type: string\n url:\n description: |-\n URL of the Helm repository, a valid URL contains at least a protocol and\n host.\n pattern: ^(http|https|oci)://.*$\n type: string\n required:\n - url\n type: object\n status:\n default:\n observedGeneration: -1\n description: HelmRepositoryStatus records the observed state of the HelmRepository.\n properties:\n artifact:\n description: Artifact represents the last successful HelmRepository\n reconciliation.\n properties:\n digest:\n description: Digest is the digest of the file in the form of ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n conditions:\n description: Conditions holds the conditions for the HelmRepository.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: |-\n ObservedGeneration is the last observed generation of the HelmRepository\n object.\n format: int64\n type: integer\n url:\n description: |-\n URL is the dynamic fetch link for the latest Artifact.\n It is provided on a \"best effort\" basis, and using the precise\n HelmRepositoryStatus.Artifact data is recommended.\n type: string\n type: object\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: v0.19.0\n labels:\n app.kubernetes.io/component: source-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: ocirepositories.source.toolkit.fluxcd.io\nspec:\n group: source.toolkit.fluxcd.io\n names:\n kind: OCIRepository\n listKind: OCIRepositoryList\n plural: ocirepositories\n shortNames:\n - ocirepo\n singular: ocirepository\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .spec.url\n name: URL\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1\n schema:\n openAPIV3Schema:\n description: OCIRepository is the Schema for the ocirepositories API\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: OCIRepositorySpec defines the desired state of OCIRepository\n properties:\n certSecretRef:\n description: |-\n CertSecretRef can be given the name of a Secret containing\n either or both of\n\n - a PEM-encoded client certificate (`tls.crt`) and private\n key (`tls.key`);\n - a PEM-encoded CA certificate (`ca.crt`)\n\n and whichever are supplied, will be used for connecting to the\n registry. The client cert and key are useful if you are\n authenticating with a certificate; the CA cert is useful if\n you are using a self-signed server certificate. The Secret must\n be of type `Opaque` or `kubernetes.io/tls`.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n ignore:\n description: |-\n Ignore overrides the set of excluded patterns in the .sourceignore format\n (which is the same as .gitignore). If not provided, a default will be used,\n consult the documentation for your version to find out what those are.\n type: string\n insecure:\n description: Insecure allows connecting to a non-TLS HTTP container\n registry.\n type: boolean\n interval:\n description: |-\n Interval at which the OCIRepository URL is checked for updates.\n This interval is approximate and may be subject to jitter to ensure\n efficient use of resources.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n layerSelector:\n description: |-\n LayerSelector specifies which layer should be extracted from the OCI artifact.\n When not specified, the first layer found in the artifact is selected.\n properties:\n mediaType:\n description: |-\n MediaType specifies the OCI media type of the layer\n which should be extracted from the OCI Artifact. The\n first layer matching this type is selected.\n type: string\n operation:\n description: |-\n Operation specifies how the selected layer should be processed.\n By default, the layer compressed content is extracted to storage.\n When the operation is set to 'copy', the layer compressed content\n is persisted to storage as it is.\n enum:\n - extract\n - copy\n type: string\n type: object\n provider:\n default: generic\n description: |-\n The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.\n When not specified, defaults to 'generic'.\n enum:\n - generic\n - aws\n - azure\n - gcp\n type: string\n proxySecretRef:\n description: |-\n ProxySecretRef specifies the Secret containing the proxy configuration\n to use while communicating with the container registry.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n ref:\n description: |-\n The OCI reference to pull and monitor for changes,\n defaults to the latest tag.\n properties:\n digest:\n description: |-\n Digest is the image digest to pull, takes precedence over SemVer.\n The value should be in the format 'sha256:'.\n type: string\n semver:\n description: |-\n SemVer is the range of tags to pull selecting the latest within\n the range, takes precedence over Tag.\n type: string\n semverFilter:\n description: SemverFilter is a regex pattern to filter the tags\n within the SemVer range.\n type: string\n tag:\n description: Tag is the image tag to pull, defaults to latest.\n type: string\n type: object\n secretRef:\n description: |-\n SecretRef contains the secret name containing the registry login\n credentials to resolve image metadata.\n The secret must be of type kubernetes.io/dockerconfigjson.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n serviceAccountName:\n description: |-\n ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate\n the image pull if the service account has attached pull secrets. For more information:\n https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account\n type: string\n suspend:\n description: This flag tells the controller to suspend the reconciliation\n of this source.\n type: boolean\n timeout:\n default: 60s\n description: The timeout for remote OCI Repository operations like\n pulling, defaults to 60s.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m))+$\n type: string\n url:\n description: |-\n URL is a reference to an OCI artifact repository hosted\n on a remote container registry.\n pattern: ^oci://.*$\n type: string\n verify:\n description: |-\n Verify contains the secret name containing the trusted public keys\n used to verify the signature and specifies which provider to use to check\n whether OCI image is authentic.\n properties:\n matchOIDCIdentity:\n description: |-\n MatchOIDCIdentity specifies the identity matching criteria to use\n while verifying an OCI artifact which was signed using Cosign keyless\n signing. The artifact's identity is deemed to be verified if any of the\n specified matchers match against the identity.\n items:\n description: |-\n OIDCIdentityMatch specifies options for verifying the certificate identity,\n i.e. the issuer and the subject of the certificate.\n properties:\n issuer:\n description: |-\n Issuer specifies the regex pattern to match against to verify\n the OIDC issuer in the Fulcio certificate. The pattern must be a\n valid Go regular expression.\n type: string\n subject:\n description: |-\n Subject specifies the regex pattern to match against to verify\n the identity subject in the Fulcio certificate. The pattern must\n be a valid Go regular expression.\n type: string\n required:\n - issuer\n - subject\n type: object\n type: array\n provider:\n default: cosign\n description: Provider specifies the technology used to sign the\n OCI Artifact.\n enum:\n - cosign\n - notation\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Kubernetes Secret containing the\n trusted public keys.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n required:\n - provider\n type: object\n required:\n - interval\n - url\n type: object\n status:\n default:\n observedGeneration: -1\n description: OCIRepositoryStatus defines the observed state of OCIRepository\n properties:\n artifact:\n description: Artifact represents the output of the last successful\n OCI Repository sync.\n properties:\n digest:\n description: Digest is the digest of the file in the form of ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n conditions:\n description: Conditions holds the conditions for the OCIRepository.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: ObservedGeneration is the last observed generation.\n format: int64\n type: integer\n observedIgnore:\n description: |-\n ObservedIgnore is the observed exclusion patterns used for constructing\n the source artifact.\n type: string\n observedLayerSelector:\n description: |-\n ObservedLayerSelector is the observed layer selector used for constructing\n the source artifact.\n properties:\n mediaType:\n description: |-\n MediaType specifies the OCI media type of the layer\n which should be extracted from the OCI Artifact. The\n first layer matching this type is selected.\n type: string\n operation:\n description: |-\n Operation specifies how the selected layer should be processed.\n By default, the layer compressed content is extracted to storage.\n When the operation is set to 'copy', the layer compressed content\n is persisted to storage as it is.\n enum:\n - extract\n - copy\n type: string\n type: object\n url:\n description: URL is the download link for the artifact output of the\n last OCI Repository sync.\n type: string\n type: object\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .spec.url\n name: URL\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n deprecated: true\n deprecationWarning: v1beta2 OCIRepository is deprecated, upgrade to v1\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: OCIRepository is the Schema for the ocirepositories API\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: OCIRepositorySpec defines the desired state of OCIRepository\n properties:\n certSecretRef:\n description: |-\n CertSecretRef can be given the name of a Secret containing\n either or both of\n\n - a PEM-encoded client certificate (`tls.crt`) and private\n key (`tls.key`);\n - a PEM-encoded CA certificate (`ca.crt`)\n\n and whichever are supplied, will be used for connecting to the\n registry. The client cert and key are useful if you are\n authenticating with a certificate; the CA cert is useful if\n you are using a self-signed server certificate. The Secret must\n be of type `Opaque` or `kubernetes.io/tls`.\n\n Note: Support for the `caFile`, `certFile` and `keyFile` keys have\n been deprecated.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n ignore:\n description: |-\n Ignore overrides the set of excluded patterns in the .sourceignore format\n (which is the same as .gitignore). If not provided, a default will be used,\n consult the documentation for your version to find out what those are.\n type: string\n insecure:\n description: Insecure allows connecting to a non-TLS HTTP container\n registry.\n type: boolean\n interval:\n description: |-\n Interval at which the OCIRepository URL is checked for updates.\n This interval is approximate and may be subject to jitter to ensure\n efficient use of resources.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n layerSelector:\n description: |-\n LayerSelector specifies which layer should be extracted from the OCI artifact.\n When not specified, the first layer found in the artifact is selected.\n properties:\n mediaType:\n description: |-\n MediaType specifies the OCI media type of the layer\n which should be extracted from the OCI Artifact. The\n first layer matching this type is selected.\n type: string\n operation:\n description: |-\n Operation specifies how the selected layer should be processed.\n By default, the layer compressed content is extracted to storage.\n When the operation is set to 'copy', the layer compressed content\n is persisted to storage as it is.\n enum:\n - extract\n - copy\n type: string\n type: object\n provider:\n default: generic\n description: |-\n The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.\n When not specified, defaults to 'generic'.\n enum:\n - generic\n - aws\n - azure\n - gcp\n type: string\n proxySecretRef:\n description: |-\n ProxySecretRef specifies the Secret containing the proxy configuration\n to use while communicating with the container registry.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n ref:\n description: |-\n The OCI reference to pull and monitor for changes,\n defaults to the latest tag.\n properties:\n digest:\n description: |-\n Digest is the image digest to pull, takes precedence over SemVer.\n The value should be in the format 'sha256:'.\n type: string\n semver:\n description: |-\n SemVer is the range of tags to pull selecting the latest within\n the range, takes precedence over Tag.\n type: string\n semverFilter:\n description: SemverFilter is a regex pattern to filter the tags\n within the SemVer range.\n type: string\n tag:\n description: Tag is the image tag to pull, defaults to latest.\n type: string\n type: object\n secretRef:\n description: |-\n SecretRef contains the secret name containing the registry login\n credentials to resolve image metadata.\n The secret must be of type kubernetes.io/dockerconfigjson.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n serviceAccountName:\n description: |-\n ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate\n the image pull if the service account has attached pull secrets. For more information:\n https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account\n type: string\n suspend:\n description: This flag tells the controller to suspend the reconciliation\n of this source.\n type: boolean\n timeout:\n default: 60s\n description: The timeout for remote OCI Repository operations like\n pulling, defaults to 60s.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m))+$\n type: string\n url:\n description: |-\n URL is a reference to an OCI artifact repository hosted\n on a remote container registry.\n pattern: ^oci://.*$\n type: string\n verify:\n description: |-\n Verify contains the secret name containing the trusted public keys\n used to verify the signature and specifies which provider to use to check\n whether OCI image is authentic.\n properties:\n matchOIDCIdentity:\n description: |-\n MatchOIDCIdentity specifies the identity matching criteria to use\n while verifying an OCI artifact which was signed using Cosign keyless\n signing. The artifact's identity is deemed to be verified if any of the\n specified matchers match against the identity.\n items:\n description: |-\n OIDCIdentityMatch specifies options for verifying the certificate identity,\n i.e. the issuer and the subject of the certificate.\n properties:\n issuer:\n description: |-\n Issuer specifies the regex pattern to match against to verify\n the OIDC issuer in the Fulcio certificate. The pattern must be a\n valid Go regular expression.\n type: string\n subject:\n description: |-\n Subject specifies the regex pattern to match against to verify\n the identity subject in the Fulcio certificate. The pattern must\n be a valid Go regular expression.\n type: string\n required:\n - issuer\n - subject\n type: object\n type: array\n provider:\n default: cosign\n description: Provider specifies the technology used to sign the\n OCI Artifact.\n enum:\n - cosign\n - notation\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Kubernetes Secret containing the\n trusted public keys.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n required:\n - provider\n type: object\n required:\n - interval\n - url\n type: object\n status:\n default:\n observedGeneration: -1\n description: OCIRepositoryStatus defines the observed state of OCIRepository\n properties:\n artifact:\n description: Artifact represents the output of the last successful\n OCI Repository sync.\n properties:\n digest:\n description: Digest is the digest of the file in the form of ':'.\n pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$\n type: string\n lastUpdateTime:\n description: |-\n LastUpdateTime is the timestamp corresponding to the last update of the\n Artifact.\n format: date-time\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata holds upstream information such as OCI annotations.\n type: object\n path:\n description: |-\n Path is the relative file path of the Artifact. It can be used to locate\n the file in the root of the Artifact storage on the local file system of\n the controller managing the Source.\n type: string\n revision:\n description: |-\n Revision is a human-readable identifier traceable in the origin source\n system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.\n type: string\n size:\n description: Size is the number of bytes in the file.\n format: int64\n type: integer\n url:\n description: |-\n URL is the HTTP address of the Artifact as exposed by the controller\n managing the Source. It can be used to retrieve the Artifact for\n consumption, e.g. by another controller applying the Artifact contents.\n type: string\n required:\n - digest\n - lastUpdateTime\n - path\n - revision\n - url\n type: object\n conditions:\n description: Conditions holds the conditions for the OCIRepository.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n contentConfigChecksum:\n description: |-\n ContentConfigChecksum is a checksum of all the configurations related to\n the content of the source artifact:\n - .spec.ignore\n - .spec.layerSelector\n observed in .status.observedGeneration version of the object. This can\n be used to determine if the content configuration has changed and the\n artifact needs to be rebuilt.\n It has the format of `:`, for example: `sha256:`.\n\n Deprecated: Replaced with explicit fields for observed artifact content\n config in the status.\n type: string\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: ObservedGeneration is the last observed generation.\n format: int64\n type: integer\n observedIgnore:\n description: |-\n ObservedIgnore is the observed exclusion patterns used for constructing\n the source artifact.\n type: string\n observedLayerSelector:\n description: |-\n ObservedLayerSelector is the observed layer selector used for constructing\n the source artifact.\n properties:\n mediaType:\n description: |-\n MediaType specifies the OCI media type of the layer\n which should be extracted from the OCI Artifact. The\n first layer matching this type is selected.\n type: string\n operation:\n description: |-\n Operation specifies how the selected layer should be processed.\n By default, the layer compressed content is extracted to storage.\n When the operation is set to 'copy', the layer compressed content\n is persisted to storage as it is.\n enum:\n - extract\n - copy\n type: string\n type: object\n url:\n description: URL is the download link for the artifact output of the\n last OCI Repository sync.\n type: string\n type: object\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n labels:\n app.kubernetes.io/component: source-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: source-controller\n namespace: flux-system\n---\napiVersion: v1\nkind: Service\nmetadata:\n labels:\n app.kubernetes.io/component: source-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n control-plane: controller\n name: source-controller\n namespace: flux-system\nspec:\n ports:\n - name: http\n port: 80\n protocol: TCP\n targetPort: http\n selector:\n app: source-controller\n type: ClusterIP\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n labels:\n app.kubernetes.io/component: source-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n control-plane: controller\n name: source-controller\n namespace: flux-system\nspec:\n replicas: 1\n selector:\n matchLabels:\n app: source-controller\n strategy:\n type: Recreate\n template:\n metadata:\n annotations:\n prometheus.io/port: \"8080\"\n prometheus.io/scrape: \"true\"\n labels:\n app: source-controller\n app.kubernetes.io/component: source-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n spec:\n containers:\n - args:\n - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./\n - --watch-all-namespaces=true\n - --log-level=info\n - --log-encoding=json\n - --enable-leader-election\n - --storage-path=/data\n - --storage-adv-addr=source-controller.$(RUNTIME_NAMESPACE).svc.cluster.local.\n env:\n - name: RUNTIME_NAMESPACE\n valueFrom:\n fieldRef:\n fieldPath: metadata.namespace\n - name: TUF_ROOT\n value: /tmp/.sigstore\n - name: GOMEMLIMIT\n valueFrom:\n resourceFieldRef:\n containerName: manager\n resource: limits.memory\n image: ghcr.io/fluxcd/source-controller:v1.7.4\n imagePullPolicy: IfNotPresent\n livenessProbe:\n httpGet:\n path: /healthz\n port: healthz\n name: manager\n ports:\n - containerPort: 9090\n name: http\n protocol: TCP\n - containerPort: 8080\n name: http-prom\n protocol: TCP\n - containerPort: 9440\n name: healthz\n protocol: TCP\n readinessProbe:\n httpGet:\n path: /\n port: http\n resources:\n limits:\n cpu: 1000m\n memory: 1Gi\n requests:\n cpu: 50m\n memory: 64Mi\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n readOnlyRootFilesystem: true\n runAsNonRoot: true\n seccompProfile:\n type: RuntimeDefault\n volumeMounts:\n - mountPath: /data\n name: data\n - mountPath: /tmp\n name: tmp\n nodeSelector:\n kubernetes.io/os: linux\n priorityClassName: system-cluster-critical\n securityContext:\n fsGroup: 1337\n serviceAccountName: source-controller\n terminationGracePeriodSeconds: 10\n volumes:\n - emptyDir: {}\n name: data\n - emptyDir: {}\n name: tmp\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: v0.19.0\n labels:\n app.kubernetes.io/component: kustomize-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: kustomizations.kustomize.toolkit.fluxcd.io\nspec:\n group: kustomize.toolkit.fluxcd.io\n names:\n kind: Kustomization\n listKind: KustomizationList\n plural: kustomizations\n shortNames:\n - ks\n singular: kustomization\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n name: v1\n schema:\n openAPIV3Schema:\n description: Kustomization is the Schema for the kustomizations API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n KustomizationSpec defines the configuration to calculate the desired state\n from a Source using Kustomize.\n properties:\n commonMetadata:\n description: |-\n CommonMetadata specifies the common labels and annotations that are\n applied to all resources. Any existing label or annotation will be\n overridden if its key matches a common one.\n properties:\n annotations:\n additionalProperties:\n type: string\n description: Annotations to be added to the object's metadata.\n type: object\n labels:\n additionalProperties:\n type: string\n description: Labels to be added to the object's metadata.\n type: object\n type: object\n components:\n description: Components specifies relative paths to kustomize Components.\n items:\n type: string\n type: array\n decryption:\n description: Decrypt Kubernetes secrets before applying them on the\n cluster.\n properties:\n provider:\n description: Provider is the name of the decryption engine.\n enum:\n - sops\n type: string\n secretRef:\n description: |-\n The secret name containing the private OpenPGP keys used for decryption.\n A static credential for a cloud provider defined inside the Secret\n takes priority to secret-less authentication with the ServiceAccountName\n field.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n serviceAccountName:\n description: |-\n ServiceAccountName is the name of the service account used to\n authenticate with KMS services from cloud providers. If a\n static credential for a given cloud provider is defined\n inside the Secret referenced by SecretRef, that static\n credential takes priority.\n type: string\n required:\n - provider\n type: object\n deletionPolicy:\n description: |-\n DeletionPolicy can be used to control garbage collection when this\n Kustomization is deleted. Valid values are ('MirrorPrune', 'Delete',\n 'WaitForTermination', 'Orphan'). 'MirrorPrune' mirrors the Prune field\n (orphan if false, delete if true). Defaults to 'MirrorPrune'.\n enum:\n - MirrorPrune\n - Delete\n - WaitForTermination\n - Orphan\n type: string\n dependsOn:\n description: |-\n DependsOn may contain a DependencyReference slice\n with references to Kustomization resources that must be ready before this\n Kustomization can be reconciled.\n items:\n description: DependencyReference defines a Kustomization dependency\n on another Kustomization resource.\n properties:\n name:\n description: Name of the referent.\n type: string\n namespace:\n description: |-\n Namespace of the referent, defaults to the namespace of the Kustomization\n resource object that contains the reference.\n type: string\n readyExpr:\n description: |-\n ReadyExpr is a CEL expression that can be used to assess the readiness\n of a dependency. When specified, the built-in readiness check\n is replaced by the logic defined in the CEL expression.\n To make the CEL expression additive to the built-in readiness check,\n the feature gate `AdditiveCELDependencyCheck` must be set to `true`.\n type: string\n required:\n - name\n type: object\n type: array\n force:\n default: false\n description: |-\n Force instructs the controller to recreate resources\n when patching fails due to an immutable field change.\n type: boolean\n healthCheckExprs:\n description: |-\n HealthCheckExprs is a list of healthcheck expressions for evaluating the\n health of custom resources using Common Expression Language (CEL).\n The expressions are evaluated only when Wait or HealthChecks are specified.\n items:\n description: CustomHealthCheck defines the health check for custom\n resources.\n properties:\n apiVersion:\n description: APIVersion of the custom resource under evaluation.\n type: string\n current:\n description: |-\n Current is the CEL expression that determines if the status\n of the custom resource has reached the desired state.\n type: string\n failed:\n description: |-\n Failed is the CEL expression that determines if the status\n of the custom resource has failed to reach the desired state.\n type: string\n inProgress:\n description: |-\n InProgress is the CEL expression that determines if the status\n of the custom resource has not yet reached the desired state.\n type: string\n kind:\n description: Kind of the custom resource under evaluation.\n type: string\n required:\n - apiVersion\n - current\n - kind\n type: object\n type: array\n healthChecks:\n description: A list of resources to be included in the health assessment.\n items:\n description: |-\n NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object\n in any namespace.\n properties:\n apiVersion:\n description: API version of the referent, if not specified the\n Kubernetes preferred version will be used.\n type: string\n kind:\n description: Kind of the referent.\n type: string\n name:\n description: Name of the referent.\n type: string\n namespace:\n description: Namespace of the referent, when not specified it\n acts as LocalObjectReference.\n type: string\n required:\n - kind\n - name\n type: object\n type: array\n ignoreMissingComponents:\n description: |-\n IgnoreMissingComponents instructs the controller to ignore Components paths\n not found in source by removing them from the generated kustomization.yaml\n before running kustomize build.\n type: boolean\n images:\n description: |-\n Images is a list of (image name, new name, new tag or digest)\n for changing image names, tags or digests. This can also be achieved with a\n patch, but this operator is simpler to specify.\n items:\n description: Image contains an image name, a new name, a new tag\n or digest, which will replace the original name and tag.\n properties:\n digest:\n description: |-\n Digest is the value used to replace the original image tag.\n If digest is present NewTag value is ignored.\n type: string\n name:\n description: Name is a tag-less image name.\n type: string\n newName:\n description: NewName is the value used to replace the original\n name.\n type: string\n newTag:\n description: NewTag is the value used to replace the original\n tag.\n type: string\n required:\n - name\n type: object\n type: array\n interval:\n description: |-\n The interval at which to reconcile the Kustomization.\n This interval is approximate and may be subject to jitter to ensure\n efficient use of resources.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n kubeConfig:\n description: |-\n The KubeConfig for reconciling the Kustomization on a remote cluster.\n When used in combination with KustomizationSpec.ServiceAccountName,\n forces the controller to act on behalf of that Service Account at the\n target cluster.\n If the --default-service-account flag is set, its value will be used as\n a controller level fallback for when KustomizationSpec.ServiceAccountName\n is empty.\n properties:\n configMapRef:\n description: |-\n ConfigMapRef holds an optional name of a ConfigMap that contains\n the following keys:\n\n - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or\n `generic`. Required.\n - `cluster`: the fully qualified resource name of the Kubernetes\n cluster in the cloud provider API. Not used by the `generic`\n provider. Required when one of `address` or `ca.crt` is not set.\n - `address`: the address of the Kubernetes API server. Required\n for `generic`. For the other providers, if not specified, the\n first address in the cluster resource will be used, and if\n specified, it must match one of the addresses in the cluster\n resource.\n If audiences is not set, will be used as the audience for the\n `generic` provider.\n - `ca.crt`: the optional PEM-encoded CA certificate for the\n Kubernetes API server. If not set, the controller will use the\n CA certificate from the cluster resource.\n - `audiences`: the optional audiences as a list of\n line-break-separated strings for the Kubernetes ServiceAccount\n token. Defaults to the `address` for the `generic` provider, or\n to specific values for the other providers depending on the\n provider.\n - `serviceAccountName`: the optional name of the Kubernetes\n ServiceAccount in the same namespace that should be used\n for authentication. If not specified, the controller\n ServiceAccount will be used.\n\n Mutually exclusive with SecretRef.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n secretRef:\n description: |-\n SecretRef holds an optional name of a secret that contains a key with\n the kubeconfig file as the value. If no key is set, the key will default\n to 'value'. Mutually exclusive with ConfigMapRef.\n It is recommended that the kubeconfig is self-contained, and the secret\n is regularly updated if credentials such as a cloud-access-token expire.\n Cloud specific `cmd-path` auth helpers will not function without adding\n binaries and credentials to the Pod that is responsible for reconciling\n Kubernetes resources. Supported only for the generic provider.\n properties:\n key:\n description: Key in the Secret, when not specified an implementation-specific\n default key is used.\n type: string\n name:\n description: Name of the Secret.\n type: string\n required:\n - name\n type: object\n type: object\n x-kubernetes-validations:\n - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef\n must be specified\n rule: has(self.configMapRef) || has(self.secretRef)\n - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef\n must be specified\n rule: '!has(self.configMapRef) || !has(self.secretRef)'\n namePrefix:\n description: NamePrefix will prefix the names of all managed resources.\n maxLength: 200\n minLength: 1\n type: string\n nameSuffix:\n description: NameSuffix will suffix the names of all managed resources.\n maxLength: 200\n minLength: 1\n type: string\n patches:\n description: |-\n Strategic merge and JSON patches, defined as inline YAML objects,\n capable of targeting objects based on kind, label and annotation selectors.\n items:\n description: |-\n Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should\n be applied to.\n properties:\n patch:\n description: |-\n Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with\n an array of operation objects.\n type: string\n target:\n description: Target points to the resources that the patch document\n should be applied to.\n properties:\n annotationSelector:\n description: |-\n AnnotationSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource annotations.\n type: string\n group:\n description: |-\n Group is the API group to select resources from.\n Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n kind:\n description: |-\n Kind of the API Group to select resources from.\n Together with Group and Version it is capable of unambiguously\n identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n labelSelector:\n description: |-\n LabelSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource labels.\n type: string\n name:\n description: Name to match resources with.\n type: string\n namespace:\n description: Namespace to select resources from.\n type: string\n version:\n description: |-\n Version of the API Group to select resources from.\n Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n type: object\n required:\n - patch\n type: object\n type: array\n path:\n description: |-\n Path to the directory containing the kustomization.yaml file, or the\n set of plain YAMLs a kustomization.yaml should be generated for.\n Defaults to 'None', which translates to the root path of the SourceRef.\n type: string\n postBuild:\n description: |-\n PostBuild describes which actions to perform on the YAML manifest\n generated by building the kustomize overlay.\n properties:\n substitute:\n additionalProperties:\n type: string\n description: |-\n Substitute holds a map of key/value pairs.\n The variables defined in your YAML manifests that match any of the keys\n defined in the map will be substituted with the set value.\n Includes support for bash string replacement functions\n e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}.\n type: object\n substituteFrom:\n description: |-\n SubstituteFrom holds references to ConfigMaps and Secrets containing\n the variables and their values to be substituted in the YAML manifests.\n The ConfigMap and the Secret data keys represent the var names, and they\n must match the vars declared in the manifests for the substitution to\n happen.\n items:\n description: |-\n SubstituteReference contains a reference to a resource containing\n the variables name and value.\n properties:\n kind:\n description: Kind of the values referent, valid values are\n ('Secret', 'ConfigMap').\n enum:\n - Secret\n - ConfigMap\n type: string\n name:\n description: |-\n Name of the values referent. Should reside in the same namespace as the\n referring resource.\n maxLength: 253\n minLength: 1\n type: string\n optional:\n default: false\n description: |-\n Optional indicates whether the referenced resource must exist, or whether to\n tolerate its absence. If true and the referenced resource is absent, proceed\n as if the resource was present but empty, without any variables defined.\n type: boolean\n required:\n - kind\n - name\n type: object\n type: array\n type: object\n prune:\n description: Prune enables garbage collection.\n type: boolean\n retryInterval:\n description: |-\n The interval at which to retry a previously failed reconciliation.\n When not specified, the controller uses the KustomizationSpec.Interval\n value to retry failures.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n serviceAccountName:\n description: |-\n The name of the Kubernetes service account to impersonate\n when reconciling this Kustomization.\n type: string\n sourceRef:\n description: Reference of the source where the kustomization file\n is.\n properties:\n apiVersion:\n description: API version of the referent.\n type: string\n kind:\n description: Kind of the referent.\n enum:\n - OCIRepository\n - GitRepository\n - Bucket\n - ExternalArtifact\n type: string\n name:\n description: Name of the referent.\n type: string\n namespace:\n description: |-\n Namespace of the referent, defaults to the namespace of the Kubernetes\n resource object that contains the reference.\n type: string\n required:\n - kind\n - name\n type: object\n suspend:\n description: |-\n This flag tells the controller to suspend subsequent kustomize executions,\n it does not apply to already started executions. Defaults to false.\n type: boolean\n targetNamespace:\n description: |-\n TargetNamespace sets or overrides the namespace in the\n kustomization.yaml file.\n maxLength: 63\n minLength: 1\n type: string\n timeout:\n description: |-\n Timeout for validation, apply and health checking operations.\n Defaults to 'Interval' duration.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n wait:\n description: |-\n Wait instructs the controller to check the health of all the reconciled\n resources. When enabled, the HealthChecks are ignored. Defaults to false.\n type: boolean\n required:\n - interval\n - prune\n - sourceRef\n type: object\n status:\n default:\n observedGeneration: -1\n description: KustomizationStatus defines the observed state of a kustomization.\n properties:\n conditions:\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n history:\n description: |-\n History contains a set of snapshots of the last reconciliation attempts\n tracking the revision, the state and the duration of each attempt.\n items:\n description: |-\n Snapshot represents a point-in-time record of a group of resources reconciliation,\n including timing information, status, and a unique digest identifier.\n properties:\n digest:\n description: Digest is the checksum in the format `:`\n of the resources in this snapshot.\n type: string\n firstReconciled:\n description: FirstReconciled is the time when this revision\n was first reconciled to the cluster.\n format: date-time\n type: string\n lastReconciled:\n description: LastReconciled is the time when this revision was\n last reconciled to the cluster.\n format: date-time\n type: string\n lastReconciledDuration:\n description: LastReconciledDuration is time it took to reconcile\n the resources in this revision.\n type: string\n lastReconciledStatus:\n description: LastReconciledStatus is the status of the last\n reconciliation.\n type: string\n metadata:\n additionalProperties:\n type: string\n description: Metadata contains additional information about\n the snapshot.\n type: object\n totalReconciliations:\n description: TotalReconciliations is the total number of reconciliations\n that have occurred for this snapshot.\n format: int64\n type: integer\n required:\n - digest\n - firstReconciled\n - lastReconciled\n - lastReconciledDuration\n - lastReconciledStatus\n - totalReconciliations\n type: object\n type: array\n inventory:\n description: |-\n Inventory contains the list of Kubernetes resource object references that\n have been successfully applied.\n properties:\n entries:\n description: Entries of Kubernetes resource object references.\n items:\n description: ResourceRef contains the information necessary\n to locate a resource within a cluster.\n properties:\n id:\n description: |-\n ID is the string representation of the Kubernetes resource object's metadata,\n in the format '___'.\n type: string\n v:\n description: Version is the API version of the Kubernetes\n resource object's kind.\n type: string\n required:\n - id\n - v\n type: object\n type: array\n required:\n - entries\n type: object\n lastAppliedOriginRevision:\n description: |-\n The last successfully applied origin revision.\n Equals the origin revision of the applied Artifact from the referenced Source.\n Usually present on the Metadata of the applied Artifact and depends on the\n Source type, e.g. for OCI it's the value associated with the key\n \"org.opencontainers.image.revision\".\n type: string\n lastAppliedRevision:\n description: |-\n The last successfully applied revision.\n Equals the Revision of the applied Artifact from the referenced Source.\n type: string\n lastAttemptedRevision:\n description: LastAttemptedRevision is the revision of the last reconciliation\n attempt.\n type: string\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: ObservedGeneration is the last reconciled generation.\n format: int64\n type: integer\n type: object\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n deprecated: true\n deprecationWarning: v1beta2 Kustomization is deprecated, upgrade to v1\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: Kustomization is the Schema for the kustomizations API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: KustomizationSpec defines the configuration to calculate\n the desired state from a Source using Kustomize.\n properties:\n commonMetadata:\n description: |-\n CommonMetadata specifies the common labels and annotations that are applied to all resources.\n Any existing label or annotation will be overridden if its key matches a common one.\n properties:\n annotations:\n additionalProperties:\n type: string\n description: Annotations to be added to the object's metadata.\n type: object\n labels:\n additionalProperties:\n type: string\n description: Labels to be added to the object's metadata.\n type: object\n type: object\n components:\n description: Components specifies relative paths to specifications\n of other Components.\n items:\n type: string\n type: array\n decryption:\n description: Decrypt Kubernetes secrets before applying them on the\n cluster.\n properties:\n provider:\n description: Provider is the name of the decryption engine.\n enum:\n - sops\n type: string\n secretRef:\n description: The secret name containing the private OpenPGP keys\n used for decryption.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n required:\n - provider\n type: object\n dependsOn:\n description: |-\n DependsOn may contain a meta.NamespacedObjectReference slice\n with references to Kustomization resources that must be ready before this\n Kustomization can be reconciled.\n items:\n description: |-\n NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any\n namespace.\n properties:\n name:\n description: Name of the referent.\n type: string\n namespace:\n description: Namespace of the referent, when not specified it\n acts as LocalObjectReference.\n type: string\n required:\n - name\n type: object\n type: array\n force:\n default: false\n description: |-\n Force instructs the controller to recreate resources\n when patching fails due to an immutable field change.\n type: boolean\n healthChecks:\n description: A list of resources to be included in the health assessment.\n items:\n description: |-\n NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object\n in any namespace.\n properties:\n apiVersion:\n description: API version of the referent, if not specified the\n Kubernetes preferred version will be used.\n type: string\n kind:\n description: Kind of the referent.\n type: string\n name:\n description: Name of the referent.\n type: string\n namespace:\n description: Namespace of the referent, when not specified it\n acts as LocalObjectReference.\n type: string\n required:\n - kind\n - name\n type: object\n type: array\n images:\n description: |-\n Images is a list of (image name, new name, new tag or digest)\n for changing image names, tags or digests. This can also be achieved with a\n patch, but this operator is simpler to specify.\n items:\n description: Image contains an image name, a new name, a new tag\n or digest, which will replace the original name and tag.\n properties:\n digest:\n description: |-\n Digest is the value used to replace the original image tag.\n If digest is present NewTag value is ignored.\n type: string\n name:\n description: Name is a tag-less image name.\n type: string\n newName:\n description: NewName is the value used to replace the original\n name.\n type: string\n newTag:\n description: NewTag is the value used to replace the original\n tag.\n type: string\n required:\n - name\n type: object\n type: array\n interval:\n description: The interval at which to reconcile the Kustomization.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n kubeConfig:\n description: |-\n The KubeConfig for reconciling the Kustomization on a remote cluster.\n When used in combination with KustomizationSpec.ServiceAccountName,\n forces the controller to act on behalf of that Service Account at the\n target cluster.\n If the --default-service-account flag is set, its value will be used as\n a controller level fallback for when KustomizationSpec.ServiceAccountName\n is empty.\n properties:\n configMapRef:\n description: |-\n ConfigMapRef holds an optional name of a ConfigMap that contains\n the following keys:\n\n - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or\n `generic`. Required.\n - `cluster`: the fully qualified resource name of the Kubernetes\n cluster in the cloud provider API. Not used by the `generic`\n provider. Required when one of `address` or `ca.crt` is not set.\n - `address`: the address of the Kubernetes API server. Required\n for `generic`. For the other providers, if not specified, the\n first address in the cluster resource will be used, and if\n specified, it must match one of the addresses in the cluster\n resource.\n If audiences is not set, will be used as the audience for the\n `generic` provider.\n - `ca.crt`: the optional PEM-encoded CA certificate for the\n Kubernetes API server. If not set, the controller will use the\n CA certificate from the cluster resource.\n - `audiences`: the optional audiences as a list of\n line-break-separated strings for the Kubernetes ServiceAccount\n token. Defaults to the `address` for the `generic` provider, or\n to specific values for the other providers depending on the\n provider.\n - `serviceAccountName`: the optional name of the Kubernetes\n ServiceAccount in the same namespace that should be used\n for authentication. If not specified, the controller\n ServiceAccount will be used.\n\n Mutually exclusive with SecretRef.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n secretRef:\n description: |-\n SecretRef holds an optional name of a secret that contains a key with\n the kubeconfig file as the value. If no key is set, the key will default\n to 'value'. Mutually exclusive with ConfigMapRef.\n It is recommended that the kubeconfig is self-contained, and the secret\n is regularly updated if credentials such as a cloud-access-token expire.\n Cloud specific `cmd-path` auth helpers will not function without adding\n binaries and credentials to the Pod that is responsible for reconciling\n Kubernetes resources. Supported only for the generic provider.\n properties:\n key:\n description: Key in the Secret, when not specified an implementation-specific\n default key is used.\n type: string\n name:\n description: Name of the Secret.\n type: string\n required:\n - name\n type: object\n type: object\n x-kubernetes-validations:\n - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef\n must be specified\n rule: has(self.configMapRef) || has(self.secretRef)\n - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef\n must be specified\n rule: '!has(self.configMapRef) || !has(self.secretRef)'\n patches:\n description: |-\n Strategic merge and JSON patches, defined as inline YAML objects,\n capable of targeting objects based on kind, label and annotation selectors.\n items:\n description: |-\n Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should\n be applied to.\n properties:\n patch:\n description: |-\n Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with\n an array of operation objects.\n type: string\n target:\n description: Target points to the resources that the patch document\n should be applied to.\n properties:\n annotationSelector:\n description: |-\n AnnotationSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource annotations.\n type: string\n group:\n description: |-\n Group is the API group to select resources from.\n Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n kind:\n description: |-\n Kind of the API Group to select resources from.\n Together with Group and Version it is capable of unambiguously\n identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n labelSelector:\n description: |-\n LabelSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource labels.\n type: string\n name:\n description: Name to match resources with.\n type: string\n namespace:\n description: Namespace to select resources from.\n type: string\n version:\n description: |-\n Version of the API Group to select resources from.\n Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n type: object\n required:\n - patch\n type: object\n type: array\n patchesJson6902:\n description: |-\n JSON 6902 patches, defined as inline YAML objects.\n Deprecated: Use Patches instead.\n items:\n description: JSON6902Patch contains a JSON6902 patch and the target\n the patch should be applied to.\n properties:\n patch:\n description: Patch contains the JSON6902 patch document with\n an array of operation objects.\n items:\n description: |-\n JSON6902 is a JSON6902 operation object.\n https://datatracker.ietf.org/doc/html/rfc6902#section-4\n properties:\n from:\n description: |-\n From contains a JSON-pointer value that references a location within the target document where the operation is\n performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations.\n type: string\n op:\n description: |-\n Op indicates the operation to perform. Its value MUST be one of \"add\", \"remove\", \"replace\", \"move\", \"copy\", or\n \"test\".\n https://datatracker.ietf.org/doc/html/rfc6902#section-4\n enum:\n - test\n - remove\n - add\n - replace\n - move\n - copy\n type: string\n path:\n description: |-\n Path contains the JSON-pointer value that references a location within the target document where the operation\n is performed. The meaning of the value depends on the value of Op.\n type: string\n value:\n description: |-\n Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into\n account by all operations.\n x-kubernetes-preserve-unknown-fields: true\n required:\n - op\n - path\n type: object\n type: array\n target:\n description: Target points to the resources that the patch document\n should be applied to.\n properties:\n annotationSelector:\n description: |-\n AnnotationSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource annotations.\n type: string\n group:\n description: |-\n Group is the API group to select resources from.\n Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n kind:\n description: |-\n Kind of the API Group to select resources from.\n Together with Group and Version it is capable of unambiguously\n identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n labelSelector:\n description: |-\n LabelSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource labels.\n type: string\n name:\n description: Name to match resources with.\n type: string\n namespace:\n description: Namespace to select resources from.\n type: string\n version:\n description: |-\n Version of the API Group to select resources from.\n Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n type: object\n required:\n - patch\n - target\n type: object\n type: array\n patchesStrategicMerge:\n description: |-\n Strategic merge patches, defined as inline YAML objects.\n Deprecated: Use Patches instead.\n items:\n x-kubernetes-preserve-unknown-fields: true\n type: array\n path:\n description: |-\n Path to the directory containing the kustomization.yaml file, or the\n set of plain YAMLs a kustomization.yaml should be generated for.\n Defaults to 'None', which translates to the root path of the SourceRef.\n type: string\n postBuild:\n description: |-\n PostBuild describes which actions to perform on the YAML manifest\n generated by building the kustomize overlay.\n properties:\n substitute:\n additionalProperties:\n type: string\n description: |-\n Substitute holds a map of key/value pairs.\n The variables defined in your YAML manifests\n that match any of the keys defined in the map\n will be substituted with the set value.\n Includes support for bash string replacement functions\n e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}.\n type: object\n substituteFrom:\n description: |-\n SubstituteFrom holds references to ConfigMaps and Secrets containing\n the variables and their values to be substituted in the YAML manifests.\n The ConfigMap and the Secret data keys represent the var names and they\n must match the vars declared in the manifests for the substitution to happen.\n items:\n description: |-\n SubstituteReference contains a reference to a resource containing\n the variables name and value.\n properties:\n kind:\n description: Kind of the values referent, valid values are\n ('Secret', 'ConfigMap').\n enum:\n - Secret\n - ConfigMap\n type: string\n name:\n description: |-\n Name of the values referent. Should reside in the same namespace as the\n referring resource.\n maxLength: 253\n minLength: 1\n type: string\n optional:\n default: false\n description: |-\n Optional indicates whether the referenced resource must exist, or whether to\n tolerate its absence. If true and the referenced resource is absent, proceed\n as if the resource was present but empty, without any variables defined.\n type: boolean\n required:\n - kind\n - name\n type: object\n type: array\n type: object\n prune:\n description: Prune enables garbage collection.\n type: boolean\n retryInterval:\n description: |-\n The interval at which to retry a previously failed reconciliation.\n When not specified, the controller uses the KustomizationSpec.Interval\n value to retry failures.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n serviceAccountName:\n description: |-\n The name of the Kubernetes service account to impersonate\n when reconciling this Kustomization.\n type: string\n sourceRef:\n description: Reference of the source where the kustomization file\n is.\n properties:\n apiVersion:\n description: API version of the referent.\n type: string\n kind:\n description: Kind of the referent.\n enum:\n - OCIRepository\n - GitRepository\n - Bucket\n type: string\n name:\n description: Name of the referent.\n type: string\n namespace:\n description: Namespace of the referent, defaults to the namespace\n of the Kubernetes resource object that contains the reference.\n type: string\n required:\n - kind\n - name\n type: object\n suspend:\n description: |-\n This flag tells the controller to suspend subsequent kustomize executions,\n it does not apply to already started executions. Defaults to false.\n type: boolean\n targetNamespace:\n description: |-\n TargetNamespace sets or overrides the namespace in the\n kustomization.yaml file.\n maxLength: 63\n minLength: 1\n type: string\n timeout:\n description: |-\n Timeout for validation, apply and health checking operations.\n Defaults to 'Interval' duration.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n validation:\n description: 'Deprecated: Not used in v1beta2.'\n enum:\n - none\n - client\n - server\n type: string\n wait:\n description: |-\n Wait instructs the controller to check the health of all the reconciled resources.\n When enabled, the HealthChecks are ignored. Defaults to false.\n type: boolean\n required:\n - interval\n - prune\n - sourceRef\n type: object\n status:\n default:\n observedGeneration: -1\n description: KustomizationStatus defines the observed state of a kustomization.\n properties:\n conditions:\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n inventory:\n description: Inventory contains the list of Kubernetes resource object\n references that have been successfully applied.\n properties:\n entries:\n description: Entries of Kubernetes resource object references.\n items:\n description: ResourceRef contains the information necessary\n to locate a resource within a cluster.\n properties:\n id:\n description: |-\n ID is the string representation of the Kubernetes resource object's metadata,\n in the format '___'.\n type: string\n v:\n description: Version is the API version of the Kubernetes\n resource object's kind.\n type: string\n required:\n - id\n - v\n type: object\n type: array\n required:\n - entries\n type: object\n lastAppliedRevision:\n description: |-\n The last successfully applied revision.\n Equals the Revision of the applied Artifact from the referenced Source.\n type: string\n lastAttemptedRevision:\n description: LastAttemptedRevision is the revision of the last reconciliation\n attempt.\n type: string\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: ObservedGeneration is the last reconciled generation.\n format: int64\n type: integer\n type: object\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n labels:\n app.kubernetes.io/component: kustomize-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: kustomize-controller\n namespace: flux-system\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n labels:\n app.kubernetes.io/component: kustomize-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n control-plane: controller\n name: kustomize-controller\n namespace: flux-system\nspec:\n replicas: 1\n selector:\n matchLabels:\n app: kustomize-controller\n template:\n metadata:\n annotations:\n prometheus.io/port: \"8080\"\n prometheus.io/scrape: \"true\"\n labels:\n app: kustomize-controller\n app.kubernetes.io/component: kustomize-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n spec:\n containers:\n - args:\n - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./\n - --watch-all-namespaces=true\n - --log-level=info\n - --log-encoding=json\n - --enable-leader-election\n env:\n - name: RUNTIME_NAMESPACE\n valueFrom:\n fieldRef:\n fieldPath: metadata.namespace\n - name: GOMEMLIMIT\n valueFrom:\n resourceFieldRef:\n containerName: manager\n resource: limits.memory\n image: ghcr.io/fluxcd/kustomize-controller:v1.7.3\n imagePullPolicy: IfNotPresent\n livenessProbe:\n httpGet:\n path: /healthz\n port: healthz\n name: manager\n ports:\n - containerPort: 8080\n name: http-prom\n protocol: TCP\n - containerPort: 9440\n name: healthz\n protocol: TCP\n readinessProbe:\n httpGet:\n path: /readyz\n port: healthz\n resources:\n limits:\n cpu: 1000m\n memory: 1Gi\n requests:\n cpu: 100m\n memory: 64Mi\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n readOnlyRootFilesystem: true\n runAsNonRoot: true\n seccompProfile:\n type: RuntimeDefault\n volumeMounts:\n - mountPath: /tmp\n name: temp\n nodeSelector:\n kubernetes.io/os: linux\n priorityClassName: system-cluster-critical\n securityContext:\n fsGroup: 1337\n serviceAccountName: kustomize-controller\n terminationGracePeriodSeconds: 60\n volumes:\n - emptyDir: {}\n name: temp\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: v0.19.0\n labels:\n app.kubernetes.io/component: helm-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: helmreleases.helm.toolkit.fluxcd.io\nspec:\n group: helm.toolkit.fluxcd.io\n names:\n kind: HelmRelease\n listKind: HelmReleaseList\n plural: helmreleases\n shortNames:\n - hr\n singular: helmrelease\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n name: v2\n schema:\n openAPIV3Schema:\n description: HelmRelease is the Schema for the helmreleases API\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: HelmReleaseSpec defines the desired state of a Helm release.\n properties:\n chart:\n description: |-\n Chart defines the template of the v1.HelmChart that should be created\n for this HelmRelease.\n properties:\n metadata:\n description: ObjectMeta holds the template for metadata like labels\n and annotations.\n properties:\n annotations:\n additionalProperties:\n type: string\n description: |-\n Annotations is an unstructured key value map stored with a resource that may be\n set by external tools to store and retrieve arbitrary metadata. They are not\n queryable and should be preserved when modifying objects.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/\n type: object\n labels:\n additionalProperties:\n type: string\n description: |-\n Map of string keys and values that can be used to organize and categorize\n (scope and select) objects.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/\n type: object\n type: object\n spec:\n description: Spec holds the template for the v1.HelmChartSpec\n for this HelmRelease.\n properties:\n chart:\n description: The name or path the Helm chart is available\n at in the SourceRef.\n maxLength: 2048\n minLength: 1\n type: string\n ignoreMissingValuesFiles:\n description: IgnoreMissingValuesFiles controls whether to\n silently ignore missing values files rather than failing.\n type: boolean\n interval:\n description: |-\n Interval at which to check the v1.Source for updates. Defaults to\n 'HelmReleaseSpec.Interval'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n reconcileStrategy:\n default: ChartVersion\n description: |-\n Determines what enables the creation of a new artifact. Valid values are\n ('ChartVersion', 'Revision').\n See the documentation of the values for an explanation on their behavior.\n Defaults to ChartVersion when omitted.\n enum:\n - ChartVersion\n - Revision\n type: string\n sourceRef:\n description: The name and namespace of the v1.Source the chart\n is available at.\n properties:\n apiVersion:\n description: APIVersion of the referent.\n type: string\n kind:\n description: Kind of the referent.\n enum:\n - HelmRepository\n - GitRepository\n - Bucket\n type: string\n name:\n description: Name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: Namespace of the referent.\n maxLength: 63\n minLength: 1\n type: string\n required:\n - kind\n - name\n type: object\n valuesFiles:\n description: |-\n Alternative list of values files to use as the chart values (values.yaml\n is not included by default), expected to be a relative path in the SourceRef.\n Values files are merged in the order of this list with the last file overriding\n the first. Ignored when omitted.\n items:\n type: string\n type: array\n verify:\n description: |-\n Verify contains the secret name containing the trusted public keys\n used to verify the signature and specifies which provider to use to check\n whether OCI image is authentic.\n This field is only supported for OCI sources.\n Chart dependencies, which are not bundled in the umbrella chart artifact,\n are not verified.\n properties:\n provider:\n default: cosign\n description: Provider specifies the technology used to\n sign the OCI Helm chart.\n enum:\n - cosign\n - notation\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Kubernetes Secret containing the\n trusted public keys.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n required:\n - provider\n type: object\n version:\n default: '*'\n description: |-\n Version semver expression, ignored for charts from v1.GitRepository and\n v1beta2.Bucket sources. Defaults to latest when omitted.\n type: string\n required:\n - chart\n - sourceRef\n type: object\n required:\n - spec\n type: object\n chartRef:\n description: |-\n ChartRef holds a reference to a source controller resource containing the\n Helm chart artifact.\n properties:\n apiVersion:\n description: APIVersion of the referent.\n type: string\n kind:\n description: Kind of the referent.\n enum:\n - OCIRepository\n - HelmChart\n - ExternalArtifact\n type: string\n name:\n description: Name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace of the referent, defaults to the namespace of the Kubernetes\n resource object that contains the reference.\n maxLength: 63\n minLength: 1\n type: string\n required:\n - kind\n - name\n type: object\n commonMetadata:\n description: |-\n CommonMetadata specifies the common labels and annotations that are\n applied to all resources. Any existing label or annotation will be\n overridden if its key matches a common one.\n properties:\n annotations:\n additionalProperties:\n type: string\n description: Annotations to be added to the object's metadata.\n type: object\n labels:\n additionalProperties:\n type: string\n description: Labels to be added to the object's metadata.\n type: object\n type: object\n dependsOn:\n description: |-\n DependsOn may contain a DependencyReference slice with\n references to HelmRelease resources that must be ready before this HelmRelease\n can be reconciled.\n items:\n description: DependencyReference defines a HelmRelease dependency\n on another HelmRelease resource.\n properties:\n name:\n description: Name of the referent.\n type: string\n namespace:\n description: |-\n Namespace of the referent, defaults to the namespace of the HelmRelease\n resource object that contains the reference.\n type: string\n readyExpr:\n description: |-\n ReadyExpr is a CEL expression that can be used to assess the readiness\n of a dependency. When specified, the built-in readiness check\n is replaced by the logic defined in the CEL expression.\n To make the CEL expression additive to the built-in readiness check,\n the feature gate `AdditiveCELDependencyCheck` must be set to `true`.\n type: string\n required:\n - name\n type: object\n type: array\n driftDetection:\n description: |-\n DriftDetection holds the configuration for detecting and handling\n differences between the manifest in the Helm storage and the resources\n currently existing in the cluster.\n properties:\n ignore:\n description: |-\n Ignore contains a list of rules for specifying which changes to ignore\n during diffing.\n items:\n description: |-\n IgnoreRule defines a rule to selectively disregard specific changes during\n the drift detection process.\n properties:\n paths:\n description: |-\n Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from\n consideration in a Kubernetes object.\n items:\n type: string\n type: array\n target:\n description: |-\n Target is a selector for specifying Kubernetes objects to which this\n rule applies.\n If Target is not set, the Paths will be ignored for all Kubernetes\n objects within the manifest of the Helm release.\n properties:\n annotationSelector:\n description: |-\n AnnotationSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource annotations.\n type: string\n group:\n description: |-\n Group is the API group to select resources from.\n Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n kind:\n description: |-\n Kind of the API Group to select resources from.\n Together with Group and Version it is capable of unambiguously\n identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n labelSelector:\n description: |-\n LabelSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource labels.\n type: string\n name:\n description: Name to match resources with.\n type: string\n namespace:\n description: Namespace to select resources from.\n type: string\n version:\n description: |-\n Version of the API Group to select resources from.\n Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n type: object\n required:\n - paths\n type: object\n type: array\n mode:\n description: |-\n Mode defines how differences should be handled between the Helm manifest\n and the manifest currently applied to the cluster.\n If not explicitly set, it defaults to DiffModeDisabled.\n enum:\n - enabled\n - warn\n - disabled\n type: string\n type: object\n install:\n description: Install holds the configuration for Helm install actions\n for this HelmRelease.\n properties:\n crds:\n description: |-\n CRDs upgrade CRDs from the Helm Chart's crds directory according\n to the CRD upgrade policy provided here. Valid values are `Skip`,\n `Create` or `CreateReplace`. Default is `Create` and if omitted\n CRDs are installed but not updated.\n\n Skip: do neither install nor replace (update) any CRDs.\n\n Create: new CRDs are created, existing CRDs are neither updated nor deleted.\n\n CreateReplace: new CRDs are created, existing CRDs are updated (replaced)\n but not deleted.\n\n By default, CRDs are applied (installed) during Helm install action.\n With this option users can opt in to CRD replace existing CRDs on Helm\n install actions, which is not (yet) natively supported by Helm.\n https://helm.sh/docs/chart_best_practices/custom_resource_definitions.\n enum:\n - Skip\n - Create\n - CreateReplace\n type: string\n createNamespace:\n description: |-\n CreateNamespace tells the Helm install action to create the\n HelmReleaseSpec.TargetNamespace if it does not exist yet.\n On uninstall, the namespace will not be garbage collected.\n type: boolean\n disableHooks:\n description: DisableHooks prevents hooks from running during the\n Helm install action.\n type: boolean\n disableOpenAPIValidation:\n description: |-\n DisableOpenAPIValidation prevents the Helm install action from validating\n rendered templates against the Kubernetes OpenAPI Schema.\n type: boolean\n disableSchemaValidation:\n description: |-\n DisableSchemaValidation prevents the Helm install action from validating\n the values against the JSON Schema.\n type: boolean\n disableTakeOwnership:\n description: |-\n DisableTakeOwnership disables taking ownership of existing resources\n during the Helm install action. Defaults to false.\n type: boolean\n disableWait:\n description: |-\n DisableWait disables the waiting for resources to be ready after a Helm\n install has been performed.\n type: boolean\n disableWaitForJobs:\n description: |-\n DisableWaitForJobs disables waiting for jobs to complete after a Helm\n install has been performed.\n type: boolean\n remediation:\n description: |-\n Remediation holds the remediation configuration for when the Helm install\n action for the HelmRelease fails. The default is to not perform any action.\n properties:\n ignoreTestFailures:\n description: |-\n IgnoreTestFailures tells the controller to skip remediation when the Helm\n tests are run after an install action but fail. Defaults to\n 'Test.IgnoreFailures'.\n type: boolean\n remediateLastFailure:\n description: |-\n RemediateLastFailure tells the controller to remediate the last failure, when\n no retries remain. Defaults to 'false'.\n type: boolean\n retries:\n description: |-\n Retries is the number of retries that should be attempted on failures before\n bailing. Remediation, using an uninstall, is performed between each attempt.\n Defaults to '0', a negative integer equals to unlimited retries.\n type: integer\n type: object\n replace:\n description: |-\n Replace tells the Helm install action to re-use the 'ReleaseName', but only\n if that name is a deleted release which remains in the history.\n type: boolean\n skipCRDs:\n description: |-\n SkipCRDs tells the Helm install action to not install any CRDs. By default,\n CRDs are installed if not already present.\n\n Deprecated use CRD policy (`crds`) attribute with value `Skip` instead.\n type: boolean\n strategy:\n description: |-\n Strategy defines the install strategy to use for this HelmRelease.\n Defaults to 'RemediateOnFailure'.\n properties:\n name:\n description: Name of the install strategy.\n enum:\n - RemediateOnFailure\n - RetryOnFailure\n type: string\n retryInterval:\n description: |-\n RetryInterval is the interval at which to retry a failed install.\n Can be used only when Name is set to RetryOnFailure.\n Defaults to '5m'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n required:\n - name\n type: object\n x-kubernetes-validations:\n - message: .retryInterval cannot be set when .name is 'RemediateOnFailure'\n rule: '!has(self.retryInterval) || self.name != ''RemediateOnFailure'''\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation (like\n Jobs for hooks) during the performance of a Helm install action. Defaults to\n 'HelmReleaseSpec.Timeout'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n type: object\n interval:\n description: Interval at which to reconcile the Helm release.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n kubeConfig:\n description: |-\n KubeConfig for reconciling the HelmRelease on a remote cluster.\n When used in combination with HelmReleaseSpec.ServiceAccountName,\n forces the controller to act on behalf of that Service Account at the\n target cluster.\n If the --default-service-account flag is set, its value will be used as\n a controller level fallback for when HelmReleaseSpec.ServiceAccountName\n is empty.\n properties:\n configMapRef:\n description: |-\n ConfigMapRef holds an optional name of a ConfigMap that contains\n the following keys:\n\n - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or\n `generic`. Required.\n - `cluster`: the fully qualified resource name of the Kubernetes\n cluster in the cloud provider API. Not used by the `generic`\n provider. Required when one of `address` or `ca.crt` is not set.\n - `address`: the address of the Kubernetes API server. Required\n for `generic`. For the other providers, if not specified, the\n first address in the cluster resource will be used, and if\n specified, it must match one of the addresses in the cluster\n resource.\n If audiences is not set, will be used as the audience for the\n `generic` provider.\n - `ca.crt`: the optional PEM-encoded CA certificate for the\n Kubernetes API server. If not set, the controller will use the\n CA certificate from the cluster resource.\n - `audiences`: the optional audiences as a list of\n line-break-separated strings for the Kubernetes ServiceAccount\n token. Defaults to the `address` for the `generic` provider, or\n to specific values for the other providers depending on the\n provider.\n - `serviceAccountName`: the optional name of the Kubernetes\n ServiceAccount in the same namespace that should be used\n for authentication. If not specified, the controller\n ServiceAccount will be used.\n\n Mutually exclusive with SecretRef.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n secretRef:\n description: |-\n SecretRef holds an optional name of a secret that contains a key with\n the kubeconfig file as the value. If no key is set, the key will default\n to 'value'. Mutually exclusive with ConfigMapRef.\n It is recommended that the kubeconfig is self-contained, and the secret\n is regularly updated if credentials such as a cloud-access-token expire.\n Cloud specific `cmd-path` auth helpers will not function without adding\n binaries and credentials to the Pod that is responsible for reconciling\n Kubernetes resources. Supported only for the generic provider.\n properties:\n key:\n description: Key in the Secret, when not specified an implementation-specific\n default key is used.\n type: string\n name:\n description: Name of the Secret.\n type: string\n required:\n - name\n type: object\n type: object\n x-kubernetes-validations:\n - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef\n must be specified\n rule: has(self.configMapRef) || has(self.secretRef)\n - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef\n must be specified\n rule: '!has(self.configMapRef) || !has(self.secretRef)'\n maxHistory:\n description: |-\n MaxHistory is the number of revisions saved by Helm for this HelmRelease.\n Use '0' for an unlimited number of revisions; defaults to '5'.\n type: integer\n persistentClient:\n description: |-\n PersistentClient tells the controller to use a persistent Kubernetes\n client for this release. When enabled, the client will be reused for the\n duration of the reconciliation, instead of being created and destroyed\n for each (step of a) Helm action.\n\n This can improve performance, but may cause issues with some Helm charts\n that for example do create Custom Resource Definitions during installation\n outside Helm's CRD lifecycle hooks, which are then not observed to be\n available by e.g. post-install hooks.\n\n If not set, it defaults to true.\n type: boolean\n postRenderers:\n description: |-\n PostRenderers holds an array of Helm PostRenderers, which will be applied in order\n of their definition.\n items:\n description: PostRenderer contains a Helm PostRenderer specification.\n properties:\n kustomize:\n description: Kustomization to apply as PostRenderer.\n properties:\n images:\n description: |-\n Images is a list of (image name, new name, new tag or digest)\n for changing image names, tags or digests. This can also be achieved with a\n patch, but this operator is simpler to specify.\n items:\n description: Image contains an image name, a new name,\n a new tag or digest, which will replace the original\n name and tag.\n properties:\n digest:\n description: |-\n Digest is the value used to replace the original image tag.\n If digest is present NewTag value is ignored.\n type: string\n name:\n description: Name is a tag-less image name.\n type: string\n newName:\n description: NewName is the value used to replace\n the original name.\n type: string\n newTag:\n description: NewTag is the value used to replace the\n original tag.\n type: string\n required:\n - name\n type: object\n type: array\n patches:\n description: |-\n Strategic merge and JSON patches, defined as inline YAML objects,\n capable of targeting objects based on kind, label and annotation selectors.\n items:\n description: |-\n Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should\n be applied to.\n properties:\n patch:\n description: |-\n Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with\n an array of operation objects.\n type: string\n target:\n description: Target points to the resources that the\n patch document should be applied to.\n properties:\n annotationSelector:\n description: |-\n AnnotationSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource annotations.\n type: string\n group:\n description: |-\n Group is the API group to select resources from.\n Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n kind:\n description: |-\n Kind of the API Group to select resources from.\n Together with Group and Version it is capable of unambiguously\n identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n labelSelector:\n description: |-\n LabelSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource labels.\n type: string\n name:\n description: Name to match resources with.\n type: string\n namespace:\n description: Namespace to select resources from.\n type: string\n version:\n description: |-\n Version of the API Group to select resources from.\n Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n type: object\n required:\n - patch\n type: object\n type: array\n type: object\n type: object\n type: array\n releaseName:\n description: |-\n ReleaseName used for the Helm release. Defaults to a composition of\n '[TargetNamespace-]Name'.\n maxLength: 53\n minLength: 1\n type: string\n rollback:\n description: Rollback holds the configuration for Helm rollback actions\n for this HelmRelease.\n properties:\n cleanupOnFail:\n description: |-\n CleanupOnFail allows deletion of new resources created during the Helm\n rollback action when it fails.\n type: boolean\n disableHooks:\n description: DisableHooks prevents hooks from running during the\n Helm rollback action.\n type: boolean\n disableWait:\n description: |-\n DisableWait disables the waiting for resources to be ready after a Helm\n rollback has been performed.\n type: boolean\n disableWaitForJobs:\n description: |-\n DisableWaitForJobs disables waiting for jobs to complete after a Helm\n rollback has been performed.\n type: boolean\n force:\n description: Force forces resource updates through a replacement\n strategy.\n type: boolean\n recreate:\n description: Recreate performs pod restarts for the resource if\n applicable.\n type: boolean\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation (like\n Jobs for hooks) during the performance of a Helm rollback action. Defaults to\n 'HelmReleaseSpec.Timeout'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n type: object\n serviceAccountName:\n description: |-\n The name of the Kubernetes service account to impersonate\n when reconciling this HelmRelease.\n maxLength: 253\n minLength: 1\n type: string\n storageNamespace:\n description: |-\n StorageNamespace used for the Helm storage.\n Defaults to the namespace of the HelmRelease.\n maxLength: 63\n minLength: 1\n type: string\n suspend:\n description: |-\n Suspend tells the controller to suspend reconciliation for this HelmRelease,\n it does not apply to already started reconciliations. Defaults to false.\n type: boolean\n targetNamespace:\n description: |-\n TargetNamespace to target when performing operations for the HelmRelease.\n Defaults to the namespace of the HelmRelease.\n maxLength: 63\n minLength: 1\n type: string\n test:\n description: Test holds the configuration for Helm test actions for\n this HelmRelease.\n properties:\n enable:\n description: |-\n Enable enables Helm test actions for this HelmRelease after an Helm install\n or upgrade action has been performed.\n type: boolean\n filters:\n description: Filters is a list of tests to run or exclude from\n running.\n items:\n description: Filter holds the configuration for individual Helm\n test filters.\n properties:\n exclude:\n description: Exclude specifies whether the named test should\n be excluded.\n type: boolean\n name:\n description: Name is the name of the test.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - name\n type: object\n type: array\n ignoreFailures:\n description: |-\n IgnoreFailures tells the controller to skip remediation when the Helm tests\n are run but fail. Can be overwritten for tests run after install or upgrade\n actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'.\n type: boolean\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation during\n the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n type: object\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation (like Jobs\n for hooks) during the performance of a Helm action. Defaults to '5m0s'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n uninstall:\n description: Uninstall holds the configuration for Helm uninstall\n actions for this HelmRelease.\n properties:\n deletionPropagation:\n default: background\n description: |-\n DeletionPropagation specifies the deletion propagation policy when\n a Helm uninstall is performed.\n enum:\n - background\n - foreground\n - orphan\n type: string\n disableHooks:\n description: DisableHooks prevents hooks from running during the\n Helm rollback action.\n type: boolean\n disableWait:\n description: |-\n DisableWait disables waiting for all the resources to be deleted after\n a Helm uninstall is performed.\n type: boolean\n keepHistory:\n description: |-\n KeepHistory tells Helm to remove all associated resources and mark the\n release as deleted, but retain the release history.\n type: boolean\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation (like\n Jobs for hooks) during the performance of a Helm uninstall action. Defaults\n to 'HelmReleaseSpec.Timeout'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n type: object\n upgrade:\n description: Upgrade holds the configuration for Helm upgrade actions\n for this HelmRelease.\n properties:\n cleanupOnFail:\n description: |-\n CleanupOnFail allows deletion of new resources created during the Helm\n upgrade action when it fails.\n type: boolean\n crds:\n description: |-\n CRDs upgrade CRDs from the Helm Chart's crds directory according\n to the CRD upgrade policy provided here. Valid values are `Skip`,\n `Create` or `CreateReplace`. Default is `Skip` and if omitted\n CRDs are neither installed nor upgraded.\n\n Skip: do neither install nor replace (update) any CRDs.\n\n Create: new CRDs are created, existing CRDs are neither updated nor deleted.\n\n CreateReplace: new CRDs are created, existing CRDs are updated (replaced)\n but not deleted.\n\n By default, CRDs are not applied during Helm upgrade action. With this\n option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm.\n https://helm.sh/docs/chart_best_practices/custom_resource_definitions.\n enum:\n - Skip\n - Create\n - CreateReplace\n type: string\n disableHooks:\n description: DisableHooks prevents hooks from running during the\n Helm upgrade action.\n type: boolean\n disableOpenAPIValidation:\n description: |-\n DisableOpenAPIValidation prevents the Helm upgrade action from validating\n rendered templates against the Kubernetes OpenAPI Schema.\n type: boolean\n disableSchemaValidation:\n description: |-\n DisableSchemaValidation prevents the Helm upgrade action from validating\n the values against the JSON Schema.\n type: boolean\n disableTakeOwnership:\n description: |-\n DisableTakeOwnership disables taking ownership of existing resources\n during the Helm upgrade action. Defaults to false.\n type: boolean\n disableWait:\n description: |-\n DisableWait disables the waiting for resources to be ready after a Helm\n upgrade has been performed.\n type: boolean\n disableWaitForJobs:\n description: |-\n DisableWaitForJobs disables waiting for jobs to complete after a Helm\n upgrade has been performed.\n type: boolean\n force:\n description: Force forces resource updates through a replacement\n strategy.\n type: boolean\n preserveValues:\n description: |-\n PreserveValues will make Helm reuse the last release's values and merge in\n overrides from 'Values'. Setting this flag makes the HelmRelease\n non-declarative.\n type: boolean\n remediation:\n description: |-\n Remediation holds the remediation configuration for when the Helm upgrade\n action for the HelmRelease fails. The default is to not perform any action.\n properties:\n ignoreTestFailures:\n description: |-\n IgnoreTestFailures tells the controller to skip remediation when the Helm\n tests are run after an upgrade action but fail.\n Defaults to 'Test.IgnoreFailures'.\n type: boolean\n remediateLastFailure:\n description: |-\n RemediateLastFailure tells the controller to remediate the last failure, when\n no retries remain. Defaults to 'false' unless 'Retries' is greater than 0.\n type: boolean\n retries:\n description: |-\n Retries is the number of retries that should be attempted on failures before\n bailing. Remediation, using 'Strategy', is performed between each attempt.\n Defaults to '0', a negative integer equals to unlimited retries.\n type: integer\n strategy:\n description: Strategy to use for failure remediation. Defaults\n to 'rollback'.\n enum:\n - rollback\n - uninstall\n type: string\n type: object\n strategy:\n description: |-\n Strategy defines the upgrade strategy to use for this HelmRelease.\n Defaults to 'RemediateOnFailure'.\n properties:\n name:\n description: Name of the upgrade strategy.\n enum:\n - RemediateOnFailure\n - RetryOnFailure\n type: string\n retryInterval:\n description: |-\n RetryInterval is the interval at which to retry a failed upgrade.\n Can be used only when Name is set to RetryOnFailure.\n Defaults to '5m'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n required:\n - name\n type: object\n x-kubernetes-validations:\n - message: .retryInterval can only be set when .name is 'RetryOnFailure'\n rule: '!has(self.retryInterval) || self.name == ''RetryOnFailure'''\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation (like\n Jobs for hooks) during the performance of a Helm upgrade action. Defaults to\n 'HelmReleaseSpec.Timeout'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n type: object\n values:\n description: Values holds the values for this Helm release.\n x-kubernetes-preserve-unknown-fields: true\n valuesFrom:\n description: |-\n ValuesFrom holds references to resources containing Helm values for this HelmRelease,\n and information about how they should be merged.\n items:\n description: |-\n ValuesReference contains a reference to a resource containing Helm values,\n and optionally the key they can be found at.\n properties:\n kind:\n description: Kind of the values referent, valid values are ('Secret',\n 'ConfigMap').\n enum:\n - Secret\n - ConfigMap\n type: string\n name:\n description: |-\n Name of the values referent. Should reside in the same namespace as the\n referring resource.\n maxLength: 253\n minLength: 1\n type: string\n optional:\n description: |-\n Optional marks this ValuesReference as optional. When set, a not found error\n for the values reference is ignored, but any ValuesKey, TargetPath or\n transient error will still result in a reconciliation failure.\n type: boolean\n targetPath:\n description: |-\n TargetPath is the YAML dot notation path the value should be merged at. When\n set, the ValuesKey is expected to be a single flat value. Defaults to 'None',\n which results in the values getting merged at the root.\n maxLength: 250\n pattern: ^([a-zA-Z0-9_\\-.\\\\\\/]|\\[[0-9]{1,5}\\])+$\n type: string\n valuesKey:\n description: |-\n ValuesKey is the data key where the values.yaml or a specific value can be\n found at. Defaults to 'values.yaml'.\n maxLength: 253\n pattern: ^[\\-._a-zA-Z0-9]+$\n type: string\n required:\n - kind\n - name\n type: object\n type: array\n required:\n - interval\n type: object\n x-kubernetes-validations:\n - message: either chart or chartRef must be set\n rule: (has(self.chart) && !has(self.chartRef)) || (!has(self.chart)\n && has(self.chartRef))\n status:\n default:\n observedGeneration: -1\n description: HelmReleaseStatus defines the observed state of a HelmRelease.\n properties:\n conditions:\n description: Conditions holds the conditions for the HelmRelease.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n failures:\n description: |-\n Failures is the reconciliation failure count against the latest desired\n state. It is reset after a successful reconciliation.\n format: int64\n type: integer\n helmChart:\n description: |-\n HelmChart is the namespaced name of the HelmChart resource created by\n the controller for the HelmRelease.\n type: string\n history:\n description: |-\n History holds the history of Helm releases performed for this HelmRelease\n up to the last successfully completed release.\n items:\n description: |-\n Snapshot captures a point-in-time copy of the status information for a Helm release,\n as managed by the controller.\n properties:\n apiVersion:\n description: |-\n APIVersion is the API version of the Snapshot.\n Provisional: when the calculation method of the Digest field is changed,\n this field will be used to distinguish between the old and new methods.\n type: string\n appVersion:\n description: AppVersion is the chart app version of the release\n object in storage.\n type: string\n chartName:\n description: ChartName is the chart name of the release object\n in storage.\n type: string\n chartVersion:\n description: |-\n ChartVersion is the chart version of the release object in\n storage.\n type: string\n configDigest:\n description: |-\n ConfigDigest is the checksum of the config (better known as\n \"values\") of the release object in storage.\n It has the format of `:`.\n type: string\n deleted:\n description: Deleted is when the release was deleted.\n format: date-time\n type: string\n digest:\n description: |-\n Digest is the checksum of the release object in storage.\n It has the format of `:`.\n type: string\n firstDeployed:\n description: FirstDeployed is when the release was first deployed.\n format: date-time\n type: string\n lastDeployed:\n description: LastDeployed is when the release was last deployed.\n format: date-time\n type: string\n name:\n description: Name is the name of the release.\n type: string\n namespace:\n description: Namespace is the namespace the release is deployed\n to.\n type: string\n ociDigest:\n description: OCIDigest is the digest of the OCI artifact associated\n with the release.\n type: string\n status:\n description: Status is the current state of the release.\n type: string\n testHooks:\n additionalProperties:\n description: |-\n TestHookStatus holds the status information for a test hook as observed\n to be run by the controller.\n properties:\n lastCompleted:\n description: LastCompleted is the time the test hook last\n completed.\n format: date-time\n type: string\n lastStarted:\n description: LastStarted is the time the test hook was\n last started.\n format: date-time\n type: string\n phase:\n description: Phase the test hook was observed to be in.\n type: string\n type: object\n description: |-\n TestHooks is the list of test hooks for the release as observed to be\n run by the controller.\n type: object\n version:\n description: Version is the version of the release object in\n storage.\n type: integer\n required:\n - chartName\n - chartVersion\n - configDigest\n - digest\n - firstDeployed\n - lastDeployed\n - name\n - namespace\n - status\n - version\n type: object\n type: array\n installFailures:\n description: |-\n InstallFailures is the install failure count against the latest desired\n state. It is reset after a successful reconciliation.\n format: int64\n type: integer\n lastAttemptedConfigDigest:\n description: |-\n LastAttemptedConfigDigest is the digest for the config (better known as\n \"values\") of the last reconciliation attempt.\n type: string\n lastAttemptedGeneration:\n description: |-\n LastAttemptedGeneration is the last generation the controller attempted\n to reconcile.\n format: int64\n type: integer\n lastAttemptedReleaseAction:\n description: |-\n LastAttemptedReleaseAction is the last release action performed for this\n HelmRelease. It is used to determine the active retry or remediation\n strategy.\n enum:\n - install\n - upgrade\n type: string\n lastAttemptedReleaseActionDuration:\n description: |-\n LastAttemptedReleaseActionDuration is the duration of the last\n release action performed for this HelmRelease.\n type: string\n lastAttemptedRevision:\n description: |-\n LastAttemptedRevision is the Source revision of the last reconciliation\n attempt. For OCIRepository sources, the 12 first characters of the digest are\n appended to the chart version e.g. \"1.2.3+1234567890ab\".\n type: string\n lastAttemptedRevisionDigest:\n description: |-\n LastAttemptedRevisionDigest is the digest of the last reconciliation attempt.\n This is only set for OCIRepository sources.\n type: string\n lastAttemptedValuesChecksum:\n description: |-\n LastAttemptedValuesChecksum is the SHA1 checksum for the values of the last\n reconciliation attempt.\n\n Deprecated: Use LastAttemptedConfigDigest instead.\n type: string\n lastHandledForceAt:\n description: |-\n LastHandledForceAt holds the value of the most recent\n force request value, so a change of the annotation value\n can be detected.\n type: string\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n lastHandledResetAt:\n description: |-\n LastHandledResetAt holds the value of the most recent reset request\n value, so a change of the annotation value can be detected.\n type: string\n lastReleaseRevision:\n description: |-\n LastReleaseRevision is the revision of the last successful Helm release.\n\n Deprecated: Use History instead.\n type: integer\n observedCommonMetadataDigest:\n description: |-\n ObservedCommonMetadataDigest is the digest for the common metadata of\n the last successful reconciliation attempt.\n type: string\n observedGeneration:\n description: ObservedGeneration is the last observed generation.\n format: int64\n type: integer\n observedPostRenderersDigest:\n description: |-\n ObservedPostRenderersDigest is the digest for the post-renderers of\n the last successful reconciliation attempt.\n type: string\n storageNamespace:\n description: |-\n StorageNamespace is the namespace of the Helm release storage for the\n current release.\n maxLength: 63\n minLength: 1\n type: string\n upgradeFailures:\n description: |-\n UpgradeFailures is the upgrade failure count against the latest desired\n state. It is reset after a successful reconciliation.\n format: int64\n type: integer\n type: object\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n deprecated: true\n deprecationWarning: v2beta2 HelmRelease is deprecated, upgrade to v2\n name: v2beta2\n schema:\n openAPIV3Schema:\n description: HelmRelease is the Schema for the helmreleases API\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: HelmReleaseSpec defines the desired state of a Helm release.\n properties:\n chart:\n description: |-\n Chart defines the template of the v1beta2.HelmChart that should be created\n for this HelmRelease.\n properties:\n metadata:\n description: ObjectMeta holds the template for metadata like labels\n and annotations.\n properties:\n annotations:\n additionalProperties:\n type: string\n description: |-\n Annotations is an unstructured key value map stored with a resource that may be\n set by external tools to store and retrieve arbitrary metadata. They are not\n queryable and should be preserved when modifying objects.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/\n type: object\n labels:\n additionalProperties:\n type: string\n description: |-\n Map of string keys and values that can be used to organize and categorize\n (scope and select) objects.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/\n type: object\n type: object\n spec:\n description: Spec holds the template for the v1beta2.HelmChartSpec\n for this HelmRelease.\n properties:\n chart:\n description: The name or path the Helm chart is available\n at in the SourceRef.\n maxLength: 2048\n minLength: 1\n type: string\n ignoreMissingValuesFiles:\n description: IgnoreMissingValuesFiles controls whether to\n silently ignore missing values files rather than failing.\n type: boolean\n interval:\n description: |-\n Interval at which to check the v1.Source for updates. Defaults to\n 'HelmReleaseSpec.Interval'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n reconcileStrategy:\n default: ChartVersion\n description: |-\n Determines what enables the creation of a new artifact. Valid values are\n ('ChartVersion', 'Revision').\n See the documentation of the values for an explanation on their behavior.\n Defaults to ChartVersion when omitted.\n enum:\n - ChartVersion\n - Revision\n type: string\n sourceRef:\n description: The name and namespace of the v1.Source the chart\n is available at.\n properties:\n apiVersion:\n description: APIVersion of the referent.\n type: string\n kind:\n description: Kind of the referent.\n enum:\n - HelmRepository\n - GitRepository\n - Bucket\n type: string\n name:\n description: Name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: Namespace of the referent.\n maxLength: 63\n minLength: 1\n type: string\n required:\n - kind\n - name\n type: object\n valuesFile:\n description: |-\n Alternative values file to use as the default chart values, expected to\n be a relative path in the SourceRef. Deprecated in favor of ValuesFiles,\n for backwards compatibility the file defined here is merged before the\n ValuesFiles items. Ignored when omitted.\n type: string\n valuesFiles:\n description: |-\n Alternative list of values files to use as the chart values (values.yaml\n is not included by default), expected to be a relative path in the SourceRef.\n Values files are merged in the order of this list with the last file overriding\n the first. Ignored when omitted.\n items:\n type: string\n type: array\n verify:\n description: |-\n Verify contains the secret name containing the trusted public keys\n used to verify the signature and specifies which provider to use to check\n whether OCI image is authentic.\n This field is only supported for OCI sources.\n Chart dependencies, which are not bundled in the umbrella chart artifact,\n are not verified.\n properties:\n provider:\n default: cosign\n description: Provider specifies the technology used to\n sign the OCI Helm chart.\n enum:\n - cosign\n - notation\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Kubernetes Secret containing the\n trusted public keys.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n required:\n - provider\n type: object\n version:\n default: '*'\n description: |-\n Version semver expression, ignored for charts from v1beta2.GitRepository and\n v1beta2.Bucket sources. Defaults to latest when omitted.\n type: string\n required:\n - chart\n - sourceRef\n type: object\n required:\n - spec\n type: object\n chartRef:\n description: |-\n ChartRef holds a reference to a source controller resource containing the\n Helm chart artifact.\n\n Note: this field is provisional to the v2 API, and not actively used\n by v2beta2 HelmReleases.\n properties:\n apiVersion:\n description: APIVersion of the referent.\n type: string\n kind:\n description: Kind of the referent.\n enum:\n - OCIRepository\n - HelmChart\n type: string\n name:\n description: Name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace of the referent, defaults to the namespace of the Kubernetes\n resource object that contains the reference.\n maxLength: 63\n minLength: 1\n type: string\n required:\n - kind\n - name\n type: object\n dependsOn:\n description: |-\n DependsOn may contain a meta.NamespacedObjectReference slice with\n references to HelmRelease resources that must be ready before this HelmRelease\n can be reconciled.\n items:\n description: |-\n NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any\n namespace.\n properties:\n name:\n description: Name of the referent.\n type: string\n namespace:\n description: Namespace of the referent, when not specified it\n acts as LocalObjectReference.\n type: string\n required:\n - name\n type: object\n type: array\n driftDetection:\n description: |-\n DriftDetection holds the configuration for detecting and handling\n differences between the manifest in the Helm storage and the resources\n currently existing in the cluster.\n properties:\n ignore:\n description: |-\n Ignore contains a list of rules for specifying which changes to ignore\n during diffing.\n items:\n description: |-\n IgnoreRule defines a rule to selectively disregard specific changes during\n the drift detection process.\n properties:\n paths:\n description: |-\n Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from\n consideration in a Kubernetes object.\n items:\n type: string\n type: array\n target:\n description: |-\n Target is a selector for specifying Kubernetes objects to which this\n rule applies.\n If Target is not set, the Paths will be ignored for all Kubernetes\n objects within the manifest of the Helm release.\n properties:\n annotationSelector:\n description: |-\n AnnotationSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource annotations.\n type: string\n group:\n description: |-\n Group is the API group to select resources from.\n Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n kind:\n description: |-\n Kind of the API Group to select resources from.\n Together with Group and Version it is capable of unambiguously\n identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n labelSelector:\n description: |-\n LabelSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource labels.\n type: string\n name:\n description: Name to match resources with.\n type: string\n namespace:\n description: Namespace to select resources from.\n type: string\n version:\n description: |-\n Version of the API Group to select resources from.\n Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n type: object\n required:\n - paths\n type: object\n type: array\n mode:\n description: |-\n Mode defines how differences should be handled between the Helm manifest\n and the manifest currently applied to the cluster.\n If not explicitly set, it defaults to DiffModeDisabled.\n enum:\n - enabled\n - warn\n - disabled\n type: string\n type: object\n install:\n description: Install holds the configuration for Helm install actions\n for this HelmRelease.\n properties:\n crds:\n description: |-\n CRDs upgrade CRDs from the Helm Chart's crds directory according\n to the CRD upgrade policy provided here. Valid values are `Skip`,\n `Create` or `CreateReplace`. Default is `Create` and if omitted\n CRDs are installed but not updated.\n\n Skip: do neither install nor replace (update) any CRDs.\n\n Create: new CRDs are created, existing CRDs are neither updated nor deleted.\n\n CreateReplace: new CRDs are created, existing CRDs are updated (replaced)\n but not deleted.\n\n By default, CRDs are applied (installed) during Helm install action.\n With this option users can opt in to CRD replace existing CRDs on Helm\n install actions, which is not (yet) natively supported by Helm.\n https://helm.sh/docs/chart_best_practices/custom_resource_definitions.\n enum:\n - Skip\n - Create\n - CreateReplace\n type: string\n createNamespace:\n description: |-\n CreateNamespace tells the Helm install action to create the\n HelmReleaseSpec.TargetNamespace if it does not exist yet.\n On uninstall, the namespace will not be garbage collected.\n type: boolean\n disableHooks:\n description: DisableHooks prevents hooks from running during the\n Helm install action.\n type: boolean\n disableOpenAPIValidation:\n description: |-\n DisableOpenAPIValidation prevents the Helm install action from validating\n rendered templates against the Kubernetes OpenAPI Schema.\n type: boolean\n disableWait:\n description: |-\n DisableWait disables the waiting for resources to be ready after a Helm\n install has been performed.\n type: boolean\n disableWaitForJobs:\n description: |-\n DisableWaitForJobs disables waiting for jobs to complete after a Helm\n install has been performed.\n type: boolean\n remediation:\n description: |-\n Remediation holds the remediation configuration for when the Helm install\n action for the HelmRelease fails. The default is to not perform any action.\n properties:\n ignoreTestFailures:\n description: |-\n IgnoreTestFailures tells the controller to skip remediation when the Helm\n tests are run after an install action but fail. Defaults to\n 'Test.IgnoreFailures'.\n type: boolean\n remediateLastFailure:\n description: |-\n RemediateLastFailure tells the controller to remediate the last failure, when\n no retries remain. Defaults to 'false'.\n type: boolean\n retries:\n description: |-\n Retries is the number of retries that should be attempted on failures before\n bailing. Remediation, using an uninstall, is performed between each attempt.\n Defaults to '0', a negative integer equals to unlimited retries.\n type: integer\n type: object\n replace:\n description: |-\n Replace tells the Helm install action to re-use the 'ReleaseName', but only\n if that name is a deleted release which remains in the history.\n type: boolean\n skipCRDs:\n description: |-\n SkipCRDs tells the Helm install action to not install any CRDs. By default,\n CRDs are installed if not already present.\n\n Deprecated use CRD policy (`crds`) attribute with value `Skip` instead.\n type: boolean\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation (like\n Jobs for hooks) during the performance of a Helm install action. Defaults to\n 'HelmReleaseSpec.Timeout'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n type: object\n interval:\n description: Interval at which to reconcile the Helm release.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n kubeConfig:\n description: |-\n KubeConfig for reconciling the HelmRelease on a remote cluster.\n When used in combination with HelmReleaseSpec.ServiceAccountName,\n forces the controller to act on behalf of that Service Account at the\n target cluster.\n If the --default-service-account flag is set, its value will be used as\n a controller level fallback for when HelmReleaseSpec.ServiceAccountName\n is empty.\n properties:\n configMapRef:\n description: |-\n ConfigMapRef holds an optional name of a ConfigMap that contains\n the following keys:\n\n - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or\n `generic`. Required.\n - `cluster`: the fully qualified resource name of the Kubernetes\n cluster in the cloud provider API. Not used by the `generic`\n provider. Required when one of `address` or `ca.crt` is not set.\n - `address`: the address of the Kubernetes API server. Required\n for `generic`. For the other providers, if not specified, the\n first address in the cluster resource will be used, and if\n specified, it must match one of the addresses in the cluster\n resource.\n If audiences is not set, will be used as the audience for the\n `generic` provider.\n - `ca.crt`: the optional PEM-encoded CA certificate for the\n Kubernetes API server. If not set, the controller will use the\n CA certificate from the cluster resource.\n - `audiences`: the optional audiences as a list of\n line-break-separated strings for the Kubernetes ServiceAccount\n token. Defaults to the `address` for the `generic` provider, or\n to specific values for the other providers depending on the\n provider.\n - `serviceAccountName`: the optional name of the Kubernetes\n ServiceAccount in the same namespace that should be used\n for authentication. If not specified, the controller\n ServiceAccount will be used.\n\n Mutually exclusive with SecretRef.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n secretRef:\n description: |-\n SecretRef holds an optional name of a secret that contains a key with\n the kubeconfig file as the value. If no key is set, the key will default\n to 'value'. Mutually exclusive with ConfigMapRef.\n It is recommended that the kubeconfig is self-contained, and the secret\n is regularly updated if credentials such as a cloud-access-token expire.\n Cloud specific `cmd-path` auth helpers will not function without adding\n binaries and credentials to the Pod that is responsible for reconciling\n Kubernetes resources. Supported only for the generic provider.\n properties:\n key:\n description: Key in the Secret, when not specified an implementation-specific\n default key is used.\n type: string\n name:\n description: Name of the Secret.\n type: string\n required:\n - name\n type: object\n type: object\n x-kubernetes-validations:\n - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef\n must be specified\n rule: has(self.configMapRef) || has(self.secretRef)\n - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef\n must be specified\n rule: '!has(self.configMapRef) || !has(self.secretRef)'\n maxHistory:\n description: |-\n MaxHistory is the number of revisions saved by Helm for this HelmRelease.\n Use '0' for an unlimited number of revisions; defaults to '5'.\n type: integer\n persistentClient:\n description: |-\n PersistentClient tells the controller to use a persistent Kubernetes\n client for this release. When enabled, the client will be reused for the\n duration of the reconciliation, instead of being created and destroyed\n for each (step of a) Helm action.\n\n This can improve performance, but may cause issues with some Helm charts\n that for example do create Custom Resource Definitions during installation\n outside Helm's CRD lifecycle hooks, which are then not observed to be\n available by e.g. post-install hooks.\n\n If not set, it defaults to true.\n type: boolean\n postRenderers:\n description: |-\n PostRenderers holds an array of Helm PostRenderers, which will be applied in order\n of their definition.\n items:\n description: PostRenderer contains a Helm PostRenderer specification.\n properties:\n kustomize:\n description: Kustomization to apply as PostRenderer.\n properties:\n images:\n description: |-\n Images is a list of (image name, new name, new tag or digest)\n for changing image names, tags or digests. This can also be achieved with a\n patch, but this operator is simpler to specify.\n items:\n description: Image contains an image name, a new name,\n a new tag or digest, which will replace the original\n name and tag.\n properties:\n digest:\n description: |-\n Digest is the value used to replace the original image tag.\n If digest is present NewTag value is ignored.\n type: string\n name:\n description: Name is a tag-less image name.\n type: string\n newName:\n description: NewName is the value used to replace\n the original name.\n type: string\n newTag:\n description: NewTag is the value used to replace the\n original tag.\n type: string\n required:\n - name\n type: object\n type: array\n patches:\n description: |-\n Strategic merge and JSON patches, defined as inline YAML objects,\n capable of targeting objects based on kind, label and annotation selectors.\n items:\n description: |-\n Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should\n be applied to.\n properties:\n patch:\n description: |-\n Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with\n an array of operation objects.\n type: string\n target:\n description: Target points to the resources that the\n patch document should be applied to.\n properties:\n annotationSelector:\n description: |-\n AnnotationSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource annotations.\n type: string\n group:\n description: |-\n Group is the API group to select resources from.\n Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n kind:\n description: |-\n Kind of the API Group to select resources from.\n Together with Group and Version it is capable of unambiguously\n identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n labelSelector:\n description: |-\n LabelSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource labels.\n type: string\n name:\n description: Name to match resources with.\n type: string\n namespace:\n description: Namespace to select resources from.\n type: string\n version:\n description: |-\n Version of the API Group to select resources from.\n Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n type: object\n required:\n - patch\n type: object\n type: array\n patchesJson6902:\n description: |-\n JSON 6902 patches, defined as inline YAML objects.\n\n Deprecated: use Patches instead.\n items:\n description: JSON6902Patch contains a JSON6902 patch and\n the target the patch should be applied to.\n properties:\n patch:\n description: Patch contains the JSON6902 patch document\n with an array of operation objects.\n items:\n description: |-\n JSON6902 is a JSON6902 operation object.\n https://datatracker.ietf.org/doc/html/rfc6902#section-4\n properties:\n from:\n description: |-\n From contains a JSON-pointer value that references a location within the target document where the operation is\n performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations.\n type: string\n op:\n description: |-\n Op indicates the operation to perform. Its value MUST be one of \"add\", \"remove\", \"replace\", \"move\", \"copy\", or\n \"test\".\n https://datatracker.ietf.org/doc/html/rfc6902#section-4\n enum:\n - test\n - remove\n - add\n - replace\n - move\n - copy\n type: string\n path:\n description: |-\n Path contains the JSON-pointer value that references a location within the target document where the operation\n is performed. The meaning of the value depends on the value of Op.\n type: string\n value:\n description: |-\n Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into\n account by all operations.\n x-kubernetes-preserve-unknown-fields: true\n required:\n - op\n - path\n type: object\n type: array\n target:\n description: Target points to the resources that the\n patch document should be applied to.\n properties:\n annotationSelector:\n description: |-\n AnnotationSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource annotations.\n type: string\n group:\n description: |-\n Group is the API group to select resources from.\n Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n kind:\n description: |-\n Kind of the API Group to select resources from.\n Together with Group and Version it is capable of unambiguously\n identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n labelSelector:\n description: |-\n LabelSelector is a string that follows the label selection expression\n https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n It matches with the resource labels.\n type: string\n name:\n description: Name to match resources with.\n type: string\n namespace:\n description: Namespace to select resources from.\n type: string\n version:\n description: |-\n Version of the API Group to select resources from.\n Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.\n https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n type: string\n type: object\n required:\n - patch\n - target\n type: object\n type: array\n patchesStrategicMerge:\n description: |-\n Strategic merge patches, defined as inline YAML objects.\n\n Deprecated: use Patches instead.\n items:\n x-kubernetes-preserve-unknown-fields: true\n type: array\n type: object\n type: object\n type: array\n releaseName:\n description: |-\n ReleaseName used for the Helm release. Defaults to a composition of\n '[TargetNamespace-]Name'.\n maxLength: 53\n minLength: 1\n type: string\n rollback:\n description: Rollback holds the configuration for Helm rollback actions\n for this HelmRelease.\n properties:\n cleanupOnFail:\n description: |-\n CleanupOnFail allows deletion of new resources created during the Helm\n rollback action when it fails.\n type: boolean\n disableHooks:\n description: DisableHooks prevents hooks from running during the\n Helm rollback action.\n type: boolean\n disableWait:\n description: |-\n DisableWait disables the waiting for resources to be ready after a Helm\n rollback has been performed.\n type: boolean\n disableWaitForJobs:\n description: |-\n DisableWaitForJobs disables waiting for jobs to complete after a Helm\n rollback has been performed.\n type: boolean\n force:\n description: Force forces resource updates through a replacement\n strategy.\n type: boolean\n recreate:\n description: Recreate performs pod restarts for the resource if\n applicable.\n type: boolean\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation (like\n Jobs for hooks) during the performance of a Helm rollback action. Defaults to\n 'HelmReleaseSpec.Timeout'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n type: object\n serviceAccountName:\n description: |-\n The name of the Kubernetes service account to impersonate\n when reconciling this HelmRelease.\n maxLength: 253\n minLength: 1\n type: string\n storageNamespace:\n description: |-\n StorageNamespace used for the Helm storage.\n Defaults to the namespace of the HelmRelease.\n maxLength: 63\n minLength: 1\n type: string\n suspend:\n description: |-\n Suspend tells the controller to suspend reconciliation for this HelmRelease,\n it does not apply to already started reconciliations. Defaults to false.\n type: boolean\n targetNamespace:\n description: |-\n TargetNamespace to target when performing operations for the HelmRelease.\n Defaults to the namespace of the HelmRelease.\n maxLength: 63\n minLength: 1\n type: string\n test:\n description: Test holds the configuration for Helm test actions for\n this HelmRelease.\n properties:\n enable:\n description: |-\n Enable enables Helm test actions for this HelmRelease after an Helm install\n or upgrade action has been performed.\n type: boolean\n filters:\n description: Filters is a list of tests to run or exclude from\n running.\n items:\n description: Filter holds the configuration for individual Helm\n test filters.\n properties:\n exclude:\n description: Exclude specifies whether the named test should\n be excluded.\n type: boolean\n name:\n description: Name is the name of the test.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - name\n type: object\n type: array\n ignoreFailures:\n description: |-\n IgnoreFailures tells the controller to skip remediation when the Helm tests\n are run but fail. Can be overwritten for tests run after install or upgrade\n actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'.\n type: boolean\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation during\n the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n type: object\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation (like Jobs\n for hooks) during the performance of a Helm action. Defaults to '5m0s'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n uninstall:\n description: Uninstall holds the configuration for Helm uninstall\n actions for this HelmRelease.\n properties:\n deletionPropagation:\n default: background\n description: |-\n DeletionPropagation specifies the deletion propagation policy when\n a Helm uninstall is performed.\n enum:\n - background\n - foreground\n - orphan\n type: string\n disableHooks:\n description: DisableHooks prevents hooks from running during the\n Helm rollback action.\n type: boolean\n disableWait:\n description: |-\n DisableWait disables waiting for all the resources to be deleted after\n a Helm uninstall is performed.\n type: boolean\n keepHistory:\n description: |-\n KeepHistory tells Helm to remove all associated resources and mark the\n release as deleted, but retain the release history.\n type: boolean\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation (like\n Jobs for hooks) during the performance of a Helm uninstall action. Defaults\n to 'HelmReleaseSpec.Timeout'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n type: object\n upgrade:\n description: Upgrade holds the configuration for Helm upgrade actions\n for this HelmRelease.\n properties:\n cleanupOnFail:\n description: |-\n CleanupOnFail allows deletion of new resources created during the Helm\n upgrade action when it fails.\n type: boolean\n crds:\n description: |-\n CRDs upgrade CRDs from the Helm Chart's crds directory according\n to the CRD upgrade policy provided here. Valid values are `Skip`,\n `Create` or `CreateReplace`. Default is `Skip` and if omitted\n CRDs are neither installed nor upgraded.\n\n Skip: do neither install nor replace (update) any CRDs.\n\n Create: new CRDs are created, existing CRDs are neither updated nor deleted.\n\n CreateReplace: new CRDs are created, existing CRDs are updated (replaced)\n but not deleted.\n\n By default, CRDs are not applied during Helm upgrade action. With this\n option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm.\n https://helm.sh/docs/chart_best_practices/custom_resource_definitions.\n enum:\n - Skip\n - Create\n - CreateReplace\n type: string\n disableHooks:\n description: DisableHooks prevents hooks from running during the\n Helm upgrade action.\n type: boolean\n disableOpenAPIValidation:\n description: |-\n DisableOpenAPIValidation prevents the Helm upgrade action from validating\n rendered templates against the Kubernetes OpenAPI Schema.\n type: boolean\n disableWait:\n description: |-\n DisableWait disables the waiting for resources to be ready after a Helm\n upgrade has been performed.\n type: boolean\n disableWaitForJobs:\n description: |-\n DisableWaitForJobs disables waiting for jobs to complete after a Helm\n upgrade has been performed.\n type: boolean\n force:\n description: Force forces resource updates through a replacement\n strategy.\n type: boolean\n preserveValues:\n description: |-\n PreserveValues will make Helm reuse the last release's values and merge in\n overrides from 'Values'. Setting this flag makes the HelmRelease\n non-declarative.\n type: boolean\n remediation:\n description: |-\n Remediation holds the remediation configuration for when the Helm upgrade\n action for the HelmRelease fails. The default is to not perform any action.\n properties:\n ignoreTestFailures:\n description: |-\n IgnoreTestFailures tells the controller to skip remediation when the Helm\n tests are run after an upgrade action but fail.\n Defaults to 'Test.IgnoreFailures'.\n type: boolean\n remediateLastFailure:\n description: |-\n RemediateLastFailure tells the controller to remediate the last failure, when\n no retries remain. Defaults to 'false' unless 'Retries' is greater than 0.\n type: boolean\n retries:\n description: |-\n Retries is the number of retries that should be attempted on failures before\n bailing. Remediation, using 'Strategy', is performed between each attempt.\n Defaults to '0', a negative integer equals to unlimited retries.\n type: integer\n strategy:\n description: Strategy to use for failure remediation. Defaults\n to 'rollback'.\n enum:\n - rollback\n - uninstall\n type: string\n type: object\n timeout:\n description: |-\n Timeout is the time to wait for any individual Kubernetes operation (like\n Jobs for hooks) during the performance of a Helm upgrade action. Defaults to\n 'HelmReleaseSpec.Timeout'.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n type: object\n values:\n description: Values holds the values for this Helm release.\n x-kubernetes-preserve-unknown-fields: true\n valuesFrom:\n description: |-\n ValuesFrom holds references to resources containing Helm values for this HelmRelease,\n and information about how they should be merged.\n items:\n description: |-\n ValuesReference contains a reference to a resource containing Helm values,\n and optionally the key they can be found at.\n properties:\n kind:\n description: Kind of the values referent, valid values are ('Secret',\n 'ConfigMap').\n enum:\n - Secret\n - ConfigMap\n type: string\n name:\n description: |-\n Name of the values referent. Should reside in the same namespace as the\n referring resource.\n maxLength: 253\n minLength: 1\n type: string\n optional:\n description: |-\n Optional marks this ValuesReference as optional. When set, a not found error\n for the values reference is ignored, but any ValuesKey, TargetPath or\n transient error will still result in a reconciliation failure.\n type: boolean\n targetPath:\n description: |-\n TargetPath is the YAML dot notation path the value should be merged at. When\n set, the ValuesKey is expected to be a single flat value. Defaults to 'None',\n which results in the values getting merged at the root.\n maxLength: 250\n pattern: ^([a-zA-Z0-9_\\-.\\\\\\/]|\\[[0-9]{1,5}\\])+$\n type: string\n valuesKey:\n description: |-\n ValuesKey is the data key where the values.yaml or a specific value can be\n found at. Defaults to 'values.yaml'.\n maxLength: 253\n pattern: ^[\\-._a-zA-Z0-9]+$\n type: string\n required:\n - kind\n - name\n type: object\n type: array\n required:\n - interval\n type: object\n x-kubernetes-validations:\n - message: either chart or chartRef must be set\n rule: (has(self.chart) && !has(self.chartRef)) || (!has(self.chart)\n && has(self.chartRef))\n status:\n default:\n observedGeneration: -1\n description: HelmReleaseStatus defines the observed state of a HelmRelease.\n properties:\n conditions:\n description: Conditions holds the conditions for the HelmRelease.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n failures:\n description: |-\n Failures is the reconciliation failure count against the latest desired\n state. It is reset after a successful reconciliation.\n format: int64\n type: integer\n helmChart:\n description: |-\n HelmChart is the namespaced name of the HelmChart resource created by\n the controller for the HelmRelease.\n type: string\n history:\n description: |-\n History holds the history of Helm releases performed for this HelmRelease\n up to the last successfully completed release.\n items:\n description: |-\n Snapshot captures a point-in-time copy of the status information for a Helm release,\n as managed by the controller.\n properties:\n apiVersion:\n description: |-\n APIVersion is the API version of the Snapshot.\n Provisional: when the calculation method of the Digest field is changed,\n this field will be used to distinguish between the old and new methods.\n type: string\n appVersion:\n description: AppVersion is the chart app version of the release\n object in storage.\n type: string\n chartName:\n description: ChartName is the chart name of the release object\n in storage.\n type: string\n chartVersion:\n description: |-\n ChartVersion is the chart version of the release object in\n storage.\n type: string\n configDigest:\n description: |-\n ConfigDigest is the checksum of the config (better known as\n \"values\") of the release object in storage.\n It has the format of `:`.\n type: string\n deleted:\n description: Deleted is when the release was deleted.\n format: date-time\n type: string\n digest:\n description: |-\n Digest is the checksum of the release object in storage.\n It has the format of `:`.\n type: string\n firstDeployed:\n description: FirstDeployed is when the release was first deployed.\n format: date-time\n type: string\n lastDeployed:\n description: LastDeployed is when the release was last deployed.\n format: date-time\n type: string\n name:\n description: Name is the name of the release.\n type: string\n namespace:\n description: Namespace is the namespace the release is deployed\n to.\n type: string\n ociDigest:\n description: OCIDigest is the digest of the OCI artifact associated\n with the release.\n type: string\n status:\n description: Status is the current state of the release.\n type: string\n testHooks:\n additionalProperties:\n description: |-\n TestHookStatus holds the status information for a test hook as observed\n to be run by the controller.\n properties:\n lastCompleted:\n description: LastCompleted is the time the test hook last\n completed.\n format: date-time\n type: string\n lastStarted:\n description: LastStarted is the time the test hook was\n last started.\n format: date-time\n type: string\n phase:\n description: Phase the test hook was observed to be in.\n type: string\n type: object\n description: |-\n TestHooks is the list of test hooks for the release as observed to be\n run by the controller.\n type: object\n version:\n description: Version is the version of the release object in\n storage.\n type: integer\n required:\n - chartName\n - chartVersion\n - configDigest\n - digest\n - firstDeployed\n - lastDeployed\n - name\n - namespace\n - status\n - version\n type: object\n type: array\n installFailures:\n description: |-\n InstallFailures is the install failure count against the latest desired\n state. It is reset after a successful reconciliation.\n format: int64\n type: integer\n lastAppliedRevision:\n description: |-\n LastAppliedRevision is the revision of the last successfully applied\n source.\n\n Deprecated: the revision can now be found in the History.\n type: string\n lastAttemptedConfigDigest:\n description: |-\n LastAttemptedConfigDigest is the digest for the config (better known as\n \"values\") of the last reconciliation attempt.\n type: string\n lastAttemptedGeneration:\n description: |-\n LastAttemptedGeneration is the last generation the controller attempted\n to reconcile.\n format: int64\n type: integer\n lastAttemptedReleaseAction:\n description: |-\n LastAttemptedReleaseAction is the last release action performed for this\n HelmRelease. It is used to determine the active remediation strategy.\n enum:\n - install\n - upgrade\n type: string\n lastAttemptedRevision:\n description: |-\n LastAttemptedRevision is the Source revision of the last reconciliation\n attempt. For OCIRepository sources, the 12 first characters of the digest are\n appended to the chart version e.g. \"1.2.3+1234567890ab\".\n type: string\n lastAttemptedRevisionDigest:\n description: |-\n LastAttemptedRevisionDigest is the digest of the last reconciliation attempt.\n This is only set for OCIRepository sources.\n type: string\n lastAttemptedValuesChecksum:\n description: |-\n LastAttemptedValuesChecksum is the SHA1 checksum for the values of the last\n reconciliation attempt.\n\n Deprecated: Use LastAttemptedConfigDigest instead.\n type: string\n lastHandledForceAt:\n description: |-\n LastHandledForceAt holds the value of the most recent force request\n value, so a change of the annotation value can be detected.\n type: string\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n lastHandledResetAt:\n description: |-\n LastHandledResetAt holds the value of the most recent reset request\n value, so a change of the annotation value can be detected.\n type: string\n lastReleaseRevision:\n description: |-\n LastReleaseRevision is the revision of the last successful Helm release.\n\n Deprecated: Use History instead.\n type: integer\n observedGeneration:\n description: ObservedGeneration is the last observed generation.\n format: int64\n type: integer\n observedPostRenderersDigest:\n description: |-\n ObservedPostRenderersDigest is the digest for the post-renderers of\n the last successful reconciliation attempt.\n type: string\n storageNamespace:\n description: |-\n StorageNamespace is the namespace of the Helm release storage for the\n current release.\n maxLength: 63\n minLength: 1\n type: string\n upgradeFailures:\n description: |-\n UpgradeFailures is the upgrade failure count against the latest desired\n state. It is reset after a successful reconciliation.\n format: int64\n type: integer\n type: object\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n labels:\n app.kubernetes.io/component: helm-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: helm-controller\n namespace: flux-system\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n labels:\n app.kubernetes.io/component: helm-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n control-plane: controller\n name: helm-controller\n namespace: flux-system\nspec:\n replicas: 1\n selector:\n matchLabels:\n app: helm-controller\n template:\n metadata:\n annotations:\n prometheus.io/port: \"8080\"\n prometheus.io/scrape: \"true\"\n labels:\n app: helm-controller\n app.kubernetes.io/component: helm-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n spec:\n containers:\n - args:\n - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./\n - --watch-all-namespaces=true\n - --log-level=info\n - --log-encoding=json\n - --enable-leader-election\n env:\n - name: RUNTIME_NAMESPACE\n valueFrom:\n fieldRef:\n fieldPath: metadata.namespace\n - name: GOMEMLIMIT\n valueFrom:\n resourceFieldRef:\n containerName: manager\n resource: limits.memory\n image: ghcr.io/fluxcd/helm-controller:v1.4.5\n imagePullPolicy: IfNotPresent\n livenessProbe:\n httpGet:\n path: /healthz\n port: healthz\n name: manager\n ports:\n - containerPort: 8080\n name: http-prom\n protocol: TCP\n - containerPort: 9440\n name: healthz\n protocol: TCP\n readinessProbe:\n httpGet:\n path: /readyz\n port: healthz\n resources:\n limits:\n cpu: 1000m\n memory: 1Gi\n requests:\n cpu: 100m\n memory: 64Mi\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n readOnlyRootFilesystem: true\n runAsNonRoot: true\n seccompProfile:\n type: RuntimeDefault\n volumeMounts:\n - mountPath: /tmp\n name: temp\n nodeSelector:\n kubernetes.io/os: linux\n priorityClassName: system-cluster-critical\n securityContext:\n fsGroup: 1337\n serviceAccountName: helm-controller\n terminationGracePeriodSeconds: 600\n volumes:\n - emptyDir: {}\n name: temp\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: v0.19.0\n labels:\n app.kubernetes.io/component: notification-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: alerts.notification.toolkit.fluxcd.io\nspec:\n group: notification.toolkit.fluxcd.io\n names:\n kind: Alert\n listKind: AlertList\n plural: alerts\n singular: alert\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n deprecated: true\n deprecationWarning: v1beta2 Alert is deprecated, upgrade to v1beta3\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: Alert is the Schema for the alerts API\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: AlertSpec defines an alerting rule for events involving a\n list of objects.\n properties:\n eventMetadata:\n additionalProperties:\n type: string\n description: |-\n EventMetadata is an optional field for adding metadata to events dispatched by the\n controller. This can be used for enhancing the context of the event. If a field\n would override one already present on the original event as generated by the emitter,\n then the override doesn't happen, i.e. the original value is preserved, and an info\n log is printed.\n type: object\n eventSeverity:\n default: info\n description: |-\n EventSeverity specifies how to filter events based on severity.\n If set to 'info' no events will be filtered.\n enum:\n - info\n - error\n type: string\n eventSources:\n description: |-\n EventSources specifies how to filter events based\n on the involved object kind, name and namespace.\n items:\n description: |-\n CrossNamespaceObjectReference contains enough information to let you locate the\n typed referenced object at cluster level\n properties:\n apiVersion:\n description: API version of the referent\n type: string\n kind:\n description: Kind of the referent\n enum:\n - Bucket\n - GitRepository\n - Kustomization\n - HelmRelease\n - HelmChart\n - HelmRepository\n - ImageRepository\n - ImagePolicy\n - ImageUpdateAutomation\n - OCIRepository\n type: string\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n MatchLabels requires the name to be set to `*`.\n type: object\n name:\n description: |-\n Name of the referent\n If multiple resources are targeted `*` may be set.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: Namespace of the referent\n maxLength: 253\n minLength: 1\n type: string\n required:\n - kind\n - name\n type: object\n type: array\n exclusionList:\n description: |-\n ExclusionList specifies a list of Golang regular expressions\n to be used for excluding messages.\n items:\n type: string\n type: array\n inclusionList:\n description: |-\n InclusionList specifies a list of Golang regular expressions\n to be used for including messages.\n items:\n type: string\n type: array\n providerRef:\n description: ProviderRef specifies which Provider this Alert should\n use.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n summary:\n description: Summary holds a short description of the impact and affected\n cluster.\n maxLength: 255\n type: string\n suspend:\n description: |-\n Suspend tells the controller to suspend subsequent\n events handling for this Alert.\n type: boolean\n required:\n - eventSources\n - providerRef\n type: object\n status:\n default:\n observedGeneration: -1\n description: AlertStatus defines the observed state of the Alert.\n properties:\n conditions:\n description: Conditions holds the conditions for the Alert.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: ObservedGeneration is the last observed generation.\n format: int64\n type: integer\n type: object\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1beta3\n schema:\n openAPIV3Schema:\n description: Alert is the Schema for the alerts API\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: AlertSpec defines an alerting rule for events involving a\n list of objects.\n properties:\n eventMetadata:\n additionalProperties:\n type: string\n description: |-\n EventMetadata is an optional field for adding metadata to events dispatched by the\n controller. This can be used for enhancing the context of the event. If a field\n would override one already present on the original event as generated by the emitter,\n then the override doesn't happen, i.e. the original value is preserved, and an info\n log is printed.\n type: object\n eventSeverity:\n default: info\n description: |-\n EventSeverity specifies how to filter events based on severity.\n If set to 'info' no events will be filtered.\n enum:\n - info\n - error\n type: string\n eventSources:\n description: |-\n EventSources specifies how to filter events based\n on the involved object kind, name and namespace.\n items:\n description: |-\n CrossNamespaceObjectReference contains enough information to let you locate the\n typed referenced object at cluster level\n properties:\n apiVersion:\n description: API version of the referent\n type: string\n kind:\n description: Kind of the referent\n enum:\n - Bucket\n - GitRepository\n - Kustomization\n - HelmRelease\n - HelmChart\n - HelmRepository\n - ImageRepository\n - ImagePolicy\n - ImageUpdateAutomation\n - OCIRepository\n type: string\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n MatchLabels requires the name to be set to `*`.\n type: object\n name:\n description: |-\n Name of the referent\n If multiple resources are targeted `*` may be set.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: Namespace of the referent\n maxLength: 253\n minLength: 1\n type: string\n required:\n - kind\n - name\n type: object\n type: array\n exclusionList:\n description: |-\n ExclusionList specifies a list of Golang regular expressions\n to be used for excluding messages.\n items:\n type: string\n type: array\n inclusionList:\n description: |-\n InclusionList specifies a list of Golang regular expressions\n to be used for including messages.\n items:\n type: string\n type: array\n providerRef:\n description: ProviderRef specifies which Provider this Alert should\n use.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n summary:\n description: |-\n Summary holds a short description of the impact and affected cluster.\n Deprecated: Use EventMetadata instead.\n maxLength: 255\n type: string\n suspend:\n description: |-\n Suspend tells the controller to suspend subsequent\n events handling for this Alert.\n type: boolean\n required:\n - eventSources\n - providerRef\n type: object\n type: object\n served: true\n storage: true\n subresources: {}\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: v0.19.0\n labels:\n app.kubernetes.io/component: notification-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: providers.notification.toolkit.fluxcd.io\nspec:\n group: notification.toolkit.fluxcd.io\n names:\n kind: Provider\n listKind: ProviderList\n plural: providers\n singular: provider\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n deprecated: true\n deprecationWarning: v1beta2 Provider is deprecated, upgrade to v1beta3\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: Provider is the Schema for the providers API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: ProviderSpec defines the desired state of the Provider.\n properties:\n address:\n description: |-\n Address specifies the endpoint, in a generic sense, to where alerts are sent.\n What kind of endpoint depends on the specific Provider type being used.\n For the generic Provider, for example, this is an HTTP/S address.\n For other Provider types this could be a project ID or a namespace.\n maxLength: 2048\n type: string\n certSecretRef:\n description: |-\n CertSecretRef specifies the Secret containing\n a PEM-encoded CA certificate (in the `ca.crt` key).\n\n Note: Support for the `caFile` key has\n been deprecated.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n channel:\n description: Channel specifies the destination channel where events\n should be posted.\n maxLength: 2048\n type: string\n interval:\n description: Interval at which to reconcile the Provider with its\n Secret references.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n proxy:\n description: Proxy the HTTP/S address of the proxy server.\n maxLength: 2048\n pattern: ^(http|https)://.*$\n type: string\n secretRef:\n description: |-\n SecretRef specifies the Secret containing the authentication\n credentials for this Provider.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n suspend:\n description: |-\n Suspend tells the controller to suspend subsequent\n events handling for this Provider.\n type: boolean\n timeout:\n description: Timeout for sending alerts to the Provider.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m))+$\n type: string\n type:\n description: Type specifies which Provider implementation to use.\n enum:\n - slack\n - discord\n - msteams\n - rocket\n - generic\n - generic-hmac\n - github\n - gitlab\n - gitea\n - bitbucketserver\n - bitbucket\n - azuredevops\n - googlechat\n - googlepubsub\n - webex\n - sentry\n - azureeventhub\n - telegram\n - lark\n - matrix\n - opsgenie\n - alertmanager\n - grafana\n - githubdispatch\n - pagerduty\n - datadog\n type: string\n username:\n description: Username specifies the name under which events are posted.\n maxLength: 2048\n type: string\n required:\n - type\n type: object\n status:\n default:\n observedGeneration: -1\n description: ProviderStatus defines the observed state of the Provider.\n properties:\n conditions:\n description: Conditions holds the conditions for the Provider.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: ObservedGeneration is the last reconciled generation.\n format: int64\n type: integer\n type: object\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1beta3\n schema:\n openAPIV3Schema:\n description: Provider is the Schema for the providers API\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: ProviderSpec defines the desired state of the Provider.\n properties:\n address:\n description: |-\n Address specifies the endpoint, in a generic sense, to where alerts are sent.\n What kind of endpoint depends on the specific Provider type being used.\n For the generic Provider, for example, this is an HTTP/S address.\n For other Provider types this could be a project ID or a namespace.\n maxLength: 2048\n type: string\n certSecretRef:\n description: |-\n CertSecretRef specifies the Secret containing TLS certificates\n for secure communication.\n\n Supported configurations:\n - CA-only: Server authentication (provide ca.crt only)\n - mTLS: Mutual authentication (provide ca.crt + tls.crt + tls.key)\n - Client-only: Client authentication with system CA (provide tls.crt + tls.key only)\n\n Legacy keys \"caFile\", \"certFile\", \"keyFile\" are supported but deprecated. Use \"ca.crt\", \"tls.crt\", \"tls.key\" instead.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n channel:\n description: Channel specifies the destination channel where events\n should be posted.\n maxLength: 2048\n type: string\n commitStatusExpr:\n description: |-\n CommitStatusExpr is a CEL expression that evaluates to a string value\n that can be used to generate a custom commit status message for use\n with eligible Provider types (github, gitlab, gitea, bitbucketserver,\n bitbucket, azuredevops). Supported variables are: event, provider,\n and alert.\n type: string\n interval:\n description: |-\n Interval at which to reconcile the Provider with its Secret references.\n Deprecated and not used in v1beta3.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n proxy:\n description: |-\n Proxy the HTTP/S address of the proxy server.\n Deprecated: Use ProxySecretRef instead. Will be removed in v1.\n maxLength: 2048\n pattern: ^(http|https)://.*$\n type: string\n proxySecretRef:\n description: |-\n ProxySecretRef specifies the Secret containing the proxy configuration\n for this Provider. The Secret should contain an 'address' key with the\n HTTP/S address of the proxy server. Optional 'username' and 'password'\n keys can be provided for proxy authentication.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n secretRef:\n description: |-\n SecretRef specifies the Secret containing the authentication\n credentials for this Provider.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n serviceAccountName:\n description: |-\n ServiceAccountName is the name of the Kubernetes ServiceAccount used to\n authenticate with cloud provider services through workload identity.\n This enables multi-tenant authentication without storing static credentials.\n\n Supported provider types: azureeventhub, azuredevops, googlepubsub\n\n When specified, the controller will:\n 1. Create an OIDC token for the specified ServiceAccount\n 2. Exchange it for cloud provider credentials via STS\n 3. Use the obtained credentials for API authentication\n\n When unspecified, controller-level authentication is used (single-tenant).\n\n An error is thrown if static credentials are also defined in SecretRef.\n This field requires the ObjectLevelWorkloadIdentity feature gate to be enabled.\n type: string\n suspend:\n description: |-\n Suspend tells the controller to suspend subsequent\n events handling for this Provider.\n type: boolean\n timeout:\n description: Timeout for sending alerts to the Provider.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m))+$\n type: string\n type:\n description: Type specifies which Provider implementation to use.\n enum:\n - slack\n - discord\n - msteams\n - rocket\n - generic\n - generic-hmac\n - github\n - gitlab\n - gitea\n - bitbucketserver\n - bitbucket\n - azuredevops\n - googlechat\n - googlepubsub\n - webex\n - sentry\n - azureeventhub\n - telegram\n - lark\n - matrix\n - opsgenie\n - alertmanager\n - grafana\n - githubdispatch\n - pagerduty\n - datadog\n - nats\n - zulip\n - otel\n type: string\n username:\n description: Username specifies the name under which events are posted.\n maxLength: 2048\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: spec.commitStatusExpr is only supported for the 'github', 'gitlab',\n 'gitea', 'bitbucketserver', 'bitbucket', 'azuredevops' provider types\n rule: self.type == 'github' || self.type == 'gitlab' || self.type ==\n 'gitea' || self.type == 'bitbucketserver' || self.type == 'bitbucket'\n || self.type == 'azuredevops' || !has(self.commitStatusExpr)\n type: object\n served: true\n storage: true\n subresources: {}\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: v0.19.0\n labels:\n app.kubernetes.io/component: notification-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: receivers.notification.toolkit.fluxcd.io\nspec:\n group: notification.toolkit.fluxcd.io\n names:\n kind: Receiver\n listKind: ReceiverList\n plural: receivers\n singular: receiver\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n name: v1\n schema:\n openAPIV3Schema:\n description: Receiver is the Schema for the receivers API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: ReceiverSpec defines the desired state of the Receiver.\n properties:\n events:\n description: |-\n Events specifies the list of event types to handle,\n e.g. 'push' for GitHub or 'Push Hook' for GitLab.\n items:\n type: string\n type: array\n interval:\n default: 10m\n description: Interval at which to reconcile the Receiver with its\n Secret references.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n resourceFilter:\n description: |-\n ResourceFilter is a CEL expression expected to return a boolean that is\n evaluated for each resource referenced in the Resources field when a\n webhook is received. If the expression returns false then the controller\n will not request a reconciliation for the resource.\n When the expression is specified the controller will parse it and mark\n the object as terminally failed if the expression is invalid or does not\n return a boolean.\n type: string\n resources:\n description: A list of resources to be notified about changes.\n items:\n description: |-\n CrossNamespaceObjectReference contains enough information to let you locate the\n typed referenced object at cluster level\n properties:\n apiVersion:\n description: API version of the referent\n type: string\n kind:\n description: Kind of the referent\n enum:\n - Bucket\n - GitRepository\n - Kustomization\n - HelmRelease\n - HelmChart\n - HelmRepository\n - ImageRepository\n - ImagePolicy\n - ImageUpdateAutomation\n - OCIRepository\n type: string\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n MatchLabels requires the name to be set to `*`.\n type: object\n name:\n description: |-\n Name of the referent\n If multiple resources are targeted `*` may be set.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: Namespace of the referent\n maxLength: 253\n minLength: 1\n type: string\n required:\n - kind\n - name\n type: object\n type: array\n secretRef:\n description: |-\n SecretRef specifies the Secret containing the token used\n to validate the payload authenticity.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n suspend:\n description: |-\n Suspend tells the controller to suspend subsequent\n events handling for this receiver.\n type: boolean\n type:\n description: |-\n Type of webhook sender, used to determine\n the validation procedure and payload deserialization.\n enum:\n - generic\n - generic-hmac\n - github\n - gitlab\n - bitbucket\n - harbor\n - dockerhub\n - quay\n - gcr\n - nexus\n - acr\n - cdevents\n type: string\n required:\n - resources\n - secretRef\n - type\n type: object\n status:\n default:\n observedGeneration: -1\n description: ReceiverStatus defines the observed state of the Receiver.\n properties:\n conditions:\n description: Conditions holds the conditions for the Receiver.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: ObservedGeneration is the last observed generation of\n the Receiver object.\n format: int64\n type: integer\n webhookPath:\n description: |-\n WebhookPath is the generated incoming webhook address in the format\n of '/hook/sha256sum(token+name+namespace)'.\n type: string\n type: object\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n name: Ready\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n name: Status\n type: string\n deprecated: true\n deprecationWarning: v1beta2 Receiver is deprecated, upgrade to v1\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: Receiver is the Schema for the receivers API.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: ReceiverSpec defines the desired state of the Receiver.\n properties:\n events:\n description: |-\n Events specifies the list of event types to handle,\n e.g. 'push' for GitHub or 'Push Hook' for GitLab.\n items:\n type: string\n type: array\n interval:\n description: Interval at which to reconcile the Receiver with its\n Secret references.\n pattern: ^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$\n type: string\n resources:\n description: A list of resources to be notified about changes.\n items:\n description: |-\n CrossNamespaceObjectReference contains enough information to let you locate the\n typed referenced object at cluster level\n properties:\n apiVersion:\n description: API version of the referent\n type: string\n kind:\n description: Kind of the referent\n enum:\n - Bucket\n - GitRepository\n - Kustomization\n - HelmRelease\n - HelmChart\n - HelmRepository\n - ImageRepository\n - ImagePolicy\n - ImageUpdateAutomation\n - OCIRepository\n type: string\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n MatchLabels requires the name to be set to `*`.\n type: object\n name:\n description: |-\n Name of the referent\n If multiple resources are targeted `*` may be set.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: Namespace of the referent\n maxLength: 253\n minLength: 1\n type: string\n required:\n - kind\n - name\n type: object\n type: array\n secretRef:\n description: |-\n SecretRef specifies the Secret containing the token used\n to validate the payload authenticity.\n properties:\n name:\n description: Name of the referent.\n type: string\n required:\n - name\n type: object\n suspend:\n description: |-\n Suspend tells the controller to suspend subsequent\n events handling for this receiver.\n type: boolean\n type:\n description: |-\n Type of webhook sender, used to determine\n the validation procedure and payload deserialization.\n enum:\n - generic\n - generic-hmac\n - github\n - gitlab\n - bitbucket\n - harbor\n - dockerhub\n - quay\n - gcr\n - nexus\n - acr\n type: string\n required:\n - resources\n - secretRef\n - type\n type: object\n status:\n default:\n observedGeneration: -1\n description: ReceiverStatus defines the observed state of the Receiver.\n properties:\n conditions:\n description: Conditions holds the conditions for the Receiver.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n type: array\n lastHandledReconcileAt:\n description: |-\n LastHandledReconcileAt holds the value of the most recent\n reconcile request value, so a change of the annotation value\n can be detected.\n type: string\n observedGeneration:\n description: ObservedGeneration is the last observed generation of\n the Receiver object.\n format: int64\n type: integer\n url:\n description: |-\n URL is the generated incoming webhook address in the format\n of '/hook/sha256sum(token+name+namespace)'.\n Deprecated: Replaced by WebhookPath.\n type: string\n webhookPath:\n description: |-\n WebhookPath is the generated incoming webhook address in the format\n of '/hook/sha256sum(token+name+namespace)'.\n type: string\n type: object\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n labels:\n app.kubernetes.io/component: notification-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n name: notification-controller\n namespace: flux-system\n---\napiVersion: v1\nkind: Service\nmetadata:\n labels:\n app.kubernetes.io/component: notification-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n control-plane: controller\n name: notification-controller\n namespace: flux-system\nspec:\n ports:\n - name: http\n port: 80\n protocol: TCP\n targetPort: http\n selector:\n app: notification-controller\n type: ClusterIP\n---\napiVersion: v1\nkind: Service\nmetadata:\n labels:\n app.kubernetes.io/component: notification-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n control-plane: controller\n name: webhook-receiver\n namespace: flux-system\nspec:\n ports:\n - name: http\n port: 80\n protocol: TCP\n targetPort: http-webhook\n selector:\n app: notification-controller\n type: ClusterIP\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n labels:\n app.kubernetes.io/component: notification-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n control-plane: controller\n name: notification-controller\n namespace: flux-system\nspec:\n replicas: 1\n selector:\n matchLabels:\n app: notification-controller\n template:\n metadata:\n annotations:\n prometheus.io/port: \"8080\"\n prometheus.io/scrape: \"true\"\n labels:\n app: notification-controller\n app.kubernetes.io/component: notification-controller\n app.kubernetes.io/instance: flux-system\n app.kubernetes.io/part-of: flux\n app.kubernetes.io/version: v2.7.5\n spec:\n containers:\n - args:\n - --watch-all-namespaces=true\n - --log-level=info\n - --log-encoding=json\n - --enable-leader-election\n env:\n - name: RUNTIME_NAMESPACE\n valueFrom:\n fieldRef:\n fieldPath: metadata.namespace\n - name: GOMEMLIMIT\n valueFrom:\n resourceFieldRef:\n containerName: manager\n resource: limits.memory\n image: ghcr.io/fluxcd/notification-controller:v1.7.5\n imagePullPolicy: IfNotPresent\n livenessProbe:\n httpGet:\n path: /healthz\n port: healthz\n name: manager\n ports:\n - containerPort: 9090\n name: http\n protocol: TCP\n - containerPort: 9292\n name: http-webhook\n protocol: TCP\n - containerPort: 8080\n name: http-prom\n protocol: TCP\n - containerPort: 9440\n name: healthz\n protocol: TCP\n readinessProbe:\n httpGet:\n path: /readyz\n port: healthz\n resources:\n limits:\n cpu: 1000m\n memory: 1Gi\n requests:\n cpu: 100m\n memory: 64Mi\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n readOnlyRootFilesystem: true\n runAsNonRoot: true\n seccompProfile:\n type: RuntimeDefault\n volumeMounts:\n - mountPath: /tmp\n name: temp\n nodeSelector:\n kubernetes.io/os: linux\n securityContext:\n fsGroup: 1337\n serviceAccountName: notification-controller\n terminationGracePeriodSeconds: 10\n volumes:\n - emptyDir: {}\n name: temp\n" }, { "path": "cluster/homelab/base/flux-system/gotk-patch.yaml", "content": "---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: source-controller\n namespace: flux-system\nspec:\n template:\n spec:\n containers:\n - name: manager\n resources:\n limits:\n memory: 2Gi\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: helm-controller\n namespace: flux-system\nspec:\n template:\n spec:\n containers:\n - name: manager\n resources:\n limits:\n memory: 2Gi\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: kustomize-controller\n namespace: flux-system\nspec:\n template:\n spec:\n containers:\n - name: manager\n resources:\n limits:\n memory: 2Gi\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: notification-controller\n namespace: flux-system\nspec:\n template:\n spec:\n containers:\n - name: manager\n resources:\n limits:\n memory: 2Gi\n---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: GitRepository\nmetadata:\n name: flux-system\n namespace: flux-system\nspec:\n interval: 2m0s\n\n" }, { "path": "cluster/homelab/base/flux-system/gotk-sync.yaml", "content": "# This manifest was generated by flux. DO NOT EDIT.\n---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: GitRepository\nmetadata:\n name: flux-system\n namespace: flux-system\nspec:\n interval: 1m0s\n ref:\n branch: master\n secretRef:\n name: flux-system\n url: ssh://git@github.com/Michaelpalacce/HomeLab\n---\napiVersion: kustomize.toolkit.fluxcd.io/v1\nkind: Kustomization\nmetadata:\n name: flux-system\n namespace: flux-system\nspec:\n interval: 10m0s\n path: ./cluster/homelab/base\n prune: true\n sourceRef:\n kind: GitRepository\n name: flux-system\n" }, { "path": "cluster/homelab/base/flux-system/kustomization.yaml", "content": "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - gotk-components.yaml\n - gotk-sync.yaml\npatchesStrategicMerge:\n - gotk-patch.yaml\n#Ref: https://flux-iac.github.io/tofu-controller/use-tf-controller/flux-receiver-and-alert/\npatches:\n - patch: |\n - op: add\n path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/eventSources/items/properties/kind/enum/-\n value: Terraform\n - op: add\n path: /spec/versions/1/schema/openAPIV3Schema/properties/spec/properties/eventSources/items/properties/kind/enum/-\n value: Terraform\n target:\n kind: CustomResourceDefinition\n name: alerts.notification.toolkit.fluxcd.io\n - patch: |\n - op: add\n path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/resources/items/properties/kind/enum/-\n value: Terraform\n - op: add\n path: /spec/versions/1/schema/openAPIV3Schema/properties/spec/properties/resources/items/properties/kind/enum/-\n value: Terraform\n target:\n kind: CustomResourceDefinition\n name: receivers.notification.toolkit.fluxcd.io\n - patch: |\n - op: add\n path: /rules/-\n value:\n apiGroups: [ 'infra.contrib.fluxcd.io' ]\n resources: [ '*' ]\n verbs: [ '*' ]\n target:\n kind: ClusterRole\n name: crd-controller-flux-system\n" }, { "path": "cluster/homelab/base/helm.yaml", "content": "---\napiVersion: kustomize.toolkit.fluxcd.io/v1\nkind: Kustomization\nmetadata:\n name: helm\n namespace: flux-system\nspec:\n interval: 10m\n path: ./cluster/homelab/helm\n prune: true\n decryption:\n provider: sops\n secretRef:\n name: sops-age\n sourceRef:\n kind: GitRepository\n name: flux-system\n" }, { "path": "cluster/homelab/base/terraform.yaml", "content": "---\napiVersion: kustomize.toolkit.fluxcd.io/v1\nkind: Kustomization\nmetadata:\n name: terraform\n namespace: flux-system\nspec:\n interval: 10m\n path: ./cluster/homelab/terraform\n prune: true\n decryption:\n provider: sops\n secretRef:\n name: sops-age\n sourceRef:\n kind: GitRepository\n name: flux-system\n" }, { "path": "cluster/homelab/configs/flux/alert.yaml", "content": "---\napiVersion: notification.toolkit.fluxcd.io/v1beta3\nkind: Alert\nmetadata:\n name: discord-alert\n namespace: flux-system\nspec:\n providerRef:\n name: discord\n eventMetadata:\n summary: Cluster impacted\n env: homelab\n cluster: homelab\n eventSeverity: error\n eventSources:\n - kind: GitRepository\n name: '*'\n - kind: Kustomization\n name: '*'\n - kind: HelmRelease\n name: '*'\n" }, { "path": "cluster/homelab/configs/flux/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - notification.sops.yaml\n - alert.yaml\n" }, { "path": "cluster/homelab/configs/flux/notification.sops.yaml", "content": "apiVersion: notification.toolkit.fluxcd.io/v1beta3\nkind: Provider\nmetadata:\n name: discord\n namespace: flux-system\nspec:\n type: discord\n secretRef:\n name: discord-webhook\nsops:\n kms: []\n gcp_kms: []\n azure_kv: []\n hc_vault: []\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxdG03UXdIWHR2QjJKRGVy\n bldvOEM3bTdsVDdWZlJ3MXNyb3gyd3JWSmwwCkhKTWZUdjZZMWdCaTlJOXdLR2hC\n MkVkQ2IybUlpS3U1bDhhQ0JBT0M2QzgKLS0tIEV1c3dnNzI5QmZ3anE5MDZQbi9q\n WC9CcHYrL3lOVC9KOTNVcE1nK2QyWjAKAK3yc3BRn77Ix/KU8FC36vmGxn6tT3OR\n gJcxaHbHd7XTO8NTkbDyYem1yO84dx9UYpx+s6z8ELcfhXjCOtrFxg==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-04-06T14:43:36Z\"\n mac: ENC[AES256_GCM,data:S0KrIyiVUu4GU9y28In8JZrVTHdY4bK6sH0shBeM1sgOZh/1I7MTkoCS8pU5GM+YnU41WAIlQJCznZeWALrdSI+Q0t5P1+1lh30+XuWF8Nx/DPROFEAU8HRBe5KhHqB8guoxLiHLvGxX0yqp5WnjHZSL8WHkD89HqAblev0RZds=,iv:ANGoj9VH9aZ6n606wwJulMLrWusovRTjMyyDbLH9IQc=,tag:Fuzalw61kkPHNJ6K4TY0iQ==,type:str]\n pgp: []\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.8.1\n---\napiVersion: v1\nkind: Secret\nmetadata:\n name: discord-webhook\n namespace: flux-system\nstringData:\n address: ENC[AES256_GCM,data:/NxCwohlFJPCng1/7bOmd6dKoJP3sjeP/9+Iw4pLl4OaMiS9bZy13RXHcpQ7mzA9RL/5pAGzDaeUfntrAMMZ4/waqYFQm3Ug42lG/JhT+yXpXNki0H0c0++4mjZeQcnxHGHvgsn2BMp/HGS0XRRK/+qP0FRTVda+RA==,iv:o5F7aZZhKACpZ5gvyV3hPDCikf7XbGNG9FEnc9YrYIY=,tag:NA5dJ5P6nBgUBFZP0I5KFQ==,type:str]\nsops:\n kms: []\n gcp_kms: []\n azure_kv: []\n hc_vault: []\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxdG03UXdIWHR2QjJKRGVy\n bldvOEM3bTdsVDdWZlJ3MXNyb3gyd3JWSmwwCkhKTWZUdjZZMWdCaTlJOXdLR2hC\n MkVkQ2IybUlpS3U1bDhhQ0JBT0M2QzgKLS0tIEV1c3dnNzI5QmZ3anE5MDZQbi9q\n WC9CcHYrL3lOVC9KOTNVcE1nK2QyWjAKAK3yc3BRn77Ix/KU8FC36vmGxn6tT3OR\n gJcxaHbHd7XTO8NTkbDyYem1yO84dx9UYpx+s6z8ELcfhXjCOtrFxg==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-04-06T14:43:36Z\"\n mac: ENC[AES256_GCM,data:S0KrIyiVUu4GU9y28In8JZrVTHdY4bK6sH0shBeM1sgOZh/1I7MTkoCS8pU5GM+YnU41WAIlQJCznZeWALrdSI+Q0t5P1+1lh30+XuWF8Nx/DPROFEAU8HRBe5KhHqB8guoxLiHLvGxX0yqp5WnjHZSL8WHkD89HqAblev0RZds=,iv:ANGoj9VH9aZ6n606wwJulMLrWusovRTjMyyDbLH9IQc=,tag:Fuzalw61kkPHNJ6K4TY0iQ==,type:str]\n pgp: []\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.8.1\n" }, { "path": "cluster/homelab/configs/istio/external-gateway-adygenova.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: Gateway\nmetadata:\n name: external-adygenova\n namespace: istio-gateway\nspec:\n addresses:\n - type: IPAddress\n value: 192.168.1.18\n gatewayClassName: istio\n listeners:\n - name: http\n port: 80\n protocol: HTTP\n allowedRoutes:\n namespaces:\n from: All\n - name: https\n hostname: \"adygenova.com\"\n port: 443\n protocol: HTTPS\n tls:\n mode: Terminate\n certificateRefs:\n - name: adygenova-cert\n allowedRoutes:\n namespaces:\n from: All\n" }, { "path": "cluster/homelab/configs/istio/external-gateway-replacedby.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: Gateway\nmetadata:\n name: external-replacedby\n namespace: istio-gateway\nspec:\n addresses:\n - type: IPAddress\n value: 192.168.1.17\n gatewayClassName: istio\n listeners:\n - name: http\n port: 80\n protocol: HTTP\n allowedRoutes:\n namespaces:\n from: All\n - name: https\n hostname: \"replacedby.net\"\n port: 443\n protocol: HTTPS\n tls:\n mode: Terminate\n certificateRefs:\n - name: replacedby-cert\n allowedRoutes:\n namespaces:\n from: All\n" }, { "path": "cluster/homelab/configs/istio/external-gateway.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: Gateway\nmetadata:\n name: external\n namespace: istio-gateway\nspec:\n addresses:\n - type: IPAddress\n value: 192.168.1.16\n gatewayClassName: istio\n listeners:\n - name: http\n port: 80\n protocol: HTTP\n allowedRoutes:\n namespaces:\n from: All\n - name: https\n hostname: \"sgenov.dev\"\n port: 443\n protocol: HTTPS\n tls:\n mode: Terminate\n certificateRefs:\n - name: ingress\n allowedRoutes:\n namespaces:\n from: All\n # allowedRoutes:\n # namespaces:\n # from: Selector\n # selector:\n # matchLabels:\n # kubernetes.io/metadata.name: default\n" }, { "path": "cluster/homelab/configs/istio/internal-gateway.yaml", "content": "apiVersion: gateway.networking.k8s.io/v1\nkind: Gateway\nmetadata:\n name: internal\n namespace: istio-gateway\nspec:\n addresses:\n - type: IPAddress\n value: 192.168.1.15\n gatewayClassName: istio\n listeners:\n - name: http\n port: 80\n protocol: HTTP\n allowedRoutes:\n namespaces:\n from: All\n - name: https\n hostname: \"*.sgenov.dev\"\n port: 443\n protocol: HTTPS\n tls:\n mode: Terminate\n certificateRefs:\n - name: ingress\n allowedRoutes:\n namespaces:\n from: All\n" }, { "path": "cluster/homelab/configs/istio/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - internal-gateway.yaml\n - external-gateway.yaml\n - external-gateway-adygenova.yaml\n - external-gateway-replacedby.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/configs/istio/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: istio-gateway\n" }, { "path": "cluster/homelab/configs/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - flux\n - velero\n - metallb\n - kyverno\n # Commented out to prevent accidental upgrades... turns out automated upgrades are a bad idea due to incompatibilities.One issue I ran into was with longhorn, which was not compatible with the latest version of k3s and resulted in a broken cluster that I had to recreate.\n # - system-upgrade\n - istio\n" }, { "path": "cluster/homelab/configs/kyverno/cleanup-empty-replicasets.yaml", "content": "#The described logic currently deletes the ReplicaSets created 30 seconds ago. You can adjust this timeframe according to your specific requirements.\napiVersion: kyverno.io/v2beta1\nkind: ClusterCleanupPolicy\nmetadata:\n name: cleanup-empty-replicasets\n annotations:\n policies.kyverno.io/title: Cleanup Empty ReplicaSets\n policies.kyverno.io/category: Other\n policies.kyverno.io/severity: medium\n policies.kyverno.io/subject: ReplicaSet\n kyverno.io/kyverno-version: 1.11.1\n policies.kyverno.io/minversion: 1.9.0\n kyverno.io/kubernetes-version: \"1.27\"\n policies.kyverno.io/description: >-\n ReplicaSets serve as an intermediate controller for various Pod controllers like Deployments. When a new version of a Deployment is initiated, it generates a new ReplicaSet with the specified number of replicas and scales down the current one to zero. Consequently, numerous empty ReplicaSets may accumulate in the cluster, leading to clutter and potential false positives in policy reports if enabled. This cleanup policy is designed to remove empty ReplicaSets across the cluster within a specified timeframe, for instance, ReplicaSets created one day ago, ensuring the ability to rollback to previous ReplicaSets in case of deployment issues\nspec:\n match:\n any:\n - resources:\n kinds:\n - ReplicaSet\n exclude:\n any:\n - resources:\n namespaces:\n - kube-system\n conditions:\n all:\n - key: \"{{ target.spec.replicas }}\"\n operator: Equals\n value: 0\n - key: \"{{ time_diff('{{target.metadata.creationTimestamp}}','{{ time_now_utc() }}') }}\"\n operator: GreaterThan\n value: \"0h0m30s\"\n schedule: \"*/1 * * * *\"\n---\napiVersion: kyverno.io/v2\nkind: ClusterCleanupPolicy\nmetadata:\n name: clean-bare-pods\n annotations:\n policies.kyverno.io/title: Cleanup Bare Pods\n policies.kyverno.io/category: Other\n policies.kyverno.io/severity: medium\n policies.kyverno.io/subject: Pod\n kyverno.io/kyverno-version: 1.11.1\n policies.kyverno.io/minversion: 1.10.0\n pod-policies.kyverno.io/autogen-controllers: none\n kyverno.io/kubernetes-version: \"1.27\"\n policies.kyverno.io/description: >-\n A bare Pod is any Pod created directly and not owned by a controller such as a\n Deployment or Job. Bare Pods are often create manually by users in an attempt to troubleshoot\n an issue. If left in the cluster, they create clutter, increase cost, and can be a security\n risk. Bare Pods can be cleaned up periodically through use of a policy. This policy finds\n and removes all bare Pods across the cluster.\nspec:\n match:\n any:\n - resources:\n kinds:\n - Pod\n conditions:\n all:\n - key: \"{{ target.metadata.ownerReferences[] || `[]` }}\"\n operator: Equals\n value: []\n schedule: \"*/1 * * * *\"\n" }, { "path": "cluster/homelab/configs/kyverno/default-network-policy.yaml", "content": "apiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n name: generate-networkpolicy-existing\n annotations:\n policies.kyverno.io/title: Generate NetworkPolicy to Existing Namespaces\n policies.kyverno.io/category: Other\n policies.kyverno.io/severity: medium\n policies.kyverno.io/subject: Namespace, NetworkPolicy\n kyverno.io/kyverno-version: 1.7.0\n policies.kyverno.io/minversion: 1.7.0\n kyverno.io/kubernetes-version: \"1.23\"\n policies.kyverno.io/description: >-\n A NetworkPolicy is often a critical piece when provisioning new Namespaces,\n but there may be existing Namespaces which also need the same resource. Creating\n each one individually or manipulating each Namespace in order to trigger creation\n is additional overhead. This policy creates a new NetworkPolicy for existing\n Namespaces which results in a default deny behavior and labels it with created-by=kyverno.\n This also generates some additional ns specific networkpolicies.\nspec:\n generateExisting: true\n rules:\n - name: generate-paperless-networkpolicy\n match:\n any:\n - resources:\n kinds:\n - Namespace\n names:\n - tika\n - gotenberg\n - paperless-ngx\n generate:\n kind: NetworkPolicy\n apiVersion: networking.k8s.io/v1\n name: \"{{request.object.metadata.name}}-default-deny\"\n namespace: \"{{request.object.metadata.name}}\"\n synchronize: true\n data:\n metadata:\n labels:\n created-by: kyverno\n spec:\n podSelector: {}\n policyTypes:\n - Egress\n egress:\n # It's ok internally to these namespaces\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"tika\"\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"gotenberg\"\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"paperless-ngx\"\n # DNS is allowed (CoreDNS)\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: kube-system\n ports:\n - protocol: UDP\n port: 53\n - protocol: TCP\n port: 53\n # Allow everywhere but not internally, don't want it communicating to local network\n - to:\n - ipBlock:\n cidr: 0.0.0.0/0\n except:\n - 10.0.0.0/8 # RFC 1918 - Class A private\n - 172.16.0.0/12 # RFC 1918 - Class B private\n - 192.168.0.0/16 # RFC 1918 - Class C private\n - name: generate-existing-networkpolicy\n exclude:\n any:\n - resources:\n namespaces:\n - longhorn-system\n - kyverno\n - kube-system\n - flux-system\n - velero # We want to communicate to all namespaces for backup reasons\n - observeability # Has it's own\n - uptimekuma # A little bit down :)\n - homepage # A little bit down :)\n - cnpg-system\n\n # These work together, they have their own policy\n - tika\n - gotenberg\n - paperless-ngx\n\n # Fix this later\n - reflector\n - system-upgrade\n - metallb-system\n - istio-system\n - istio-gateway\n - cert-manager\n match:\n any:\n - resources:\n kinds:\n - Namespace\n generate:\n kind: NetworkPolicy\n apiVersion: networking.k8s.io/v1\n name: \"{{request.object.metadata.name}}-default-deny\"\n namespace: \"{{request.object.metadata.name}}\"\n synchronize: true\n data:\n metadata:\n labels:\n created-by: kyverno\n spec:\n podSelector: {}\n policyTypes:\n - Egress\n egress:\n # Allow everywhere but not internally, don't want it communicating to local network\n - to:\n - ipBlock:\n cidr: 0.0.0.0/0\n except:\n - 10.0.0.0/8 # RFC 1918 - Class A private\n - 172.16.0.0/12 # RFC 1918 - Class B private\n - 192.168.0.0/16 # RFC 1918 - Class C private\n # It's ok internally to the namespace\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"{{request.object.metadata.name}}\"\n # DNS is allowed (CoreDNS)\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: kube-system\n ports:\n - protocol: UDP\n port: 53\n - protocol: TCP\n port: 53\n - name: generate-homepage-networkpolicy\n match:\n any:\n - resources:\n kinds:\n - Namespace\n names:\n - homepage\n generate:\n kind: NetworkPolicy\n apiVersion: networking.k8s.io/v1\n name: \"{{request.object.metadata.name}}-default-deny\"\n namespace: \"{{request.object.metadata.name}}\"\n synchronize: true\n data:\n metadata:\n labels:\n created-by: kyverno\n spec:\n podSelector: {}\n policyTypes:\n - Egress\n egress:\n - to:\n - ipBlock:\n cidr: 10.0.0.0/8\n - ipBlock:\n cidr: 192.168.0.0/16\n # It's ok internally to the namespace\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"{{request.object.metadata.name}}\"\n # DNS is allowed (CoreDNS)\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: kube-system\n ports:\n - protocol: UDP\n port: 53\n - protocol: TCP\n port: 53\n - name: generate-uptimekuma-networkpolicy\n match:\n any:\n - resources:\n kinds:\n - Namespace\n names:\n - uptimekuma\n generate:\n kind: NetworkPolicy\n apiVersion: networking.k8s.io/v1\n name: \"{{request.object.metadata.name}}-default-deny\"\n namespace: \"{{request.object.metadata.name}}\"\n synchronize: true\n data:\n metadata:\n labels:\n created-by: kyverno\n spec:\n podSelector: {}\n policyTypes:\n - Egress\n egress:\n # Allow everywhere but not internal RFC1918 (except 192.168/16)\n - to:\n - ipBlock:\n cidr: 0.0.0.0/0\n ports:\n - protocol: TCP\n port: 53\n - protocol: UDP\n port: 53\n - protocol: TCP\n port: 80\n - protocol: TCP\n port: 443\n - to:\n - ipBlock:\n cidr: 192.168.1.22/32\n # Some cases where we are doing internal TCP checks\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"firefly\"\n ports:\n - protocol: TCP\n port: 5432 # postgres\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"reactiveresume\"\n ports:\n - protocol: TCP\n port: 5432 # postgres\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"wallabag\"\n ports:\n - protocol: TCP\n port: 5432 # postgres\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"observeability\"\n ports:\n - protocol: TCP\n port: 3100 # Loki\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"n8n\"\n ports:\n - protocol: TCP\n port: 5432 # postgres\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"vikunja\"\n ports:\n - protocol: TCP\n port: 5432 # postgres\n\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"velero\"\n ports:\n - protocol: TCP\n port: 8085 # velero port\n # It's ok internally to the namespace\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: \"{{request.object.metadata.name}}\"\n # DNS is allowed (CoreDNS)\n - to:\n - namespaceSelector:\n matchLabels:\n kubernetes.io/metadata.name: kube-system\n ports:\n - protocol: UDP\n port: 53\n - protocol: TCP\n port: 53\n" }, { "path": "cluster/homelab/configs/kyverno/disallow-default.yaml", "content": "apiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n name: disallow-default-namespace\n annotations:\n pod-policies.kyverno.io/autogen-controllers: none\n policies.kyverno.io/title: Disallow Default Namespace\n policies.kyverno.io/minversion: 1.6.0\n policies.kyverno.io/category: Multi-Tenancy\n policies.kyverno.io/severity: medium\n policies.kyverno.io/subject: Pod\n policies.kyverno.io/description: >-\n Kubernetes Namespaces are an optional feature that provide a way to segment and\n isolate cluster resources across multiple applications and users. As a best\n practice, workloads should be isolated with Namespaces. Namespaces should be required\n and the default (empty) Namespace should not be used. This policy validates that Pods\n specify a Namespace name other than `default`. Rule auto-generation is disabled here\n due to Pod controllers need to specify the `namespace` field under the top-level `metadata`\n object and not at the Pod template level.\nspec:\n background: true\n rules:\n - name: validate-namespace\n match:\n any:\n - resources:\n kinds:\n - Pod\n validate:\n failureAction: Enforce\n message: \"Using 'default' namespace is not allowed.\"\n pattern:\n metadata:\n namespace: \"!default\"\n - name: validate-podcontroller-namespace\n match:\n any:\n - resources:\n kinds:\n - DaemonSet\n - Deployment\n - Job\n - StatefulSet\n validate:\n failureAction: Enforce\n message: \"Using 'default' namespace is not allowed for pod controllers.\"\n pattern:\n metadata:\n namespace: \"!default\"\n" }, { "path": "cluster/homelab/configs/kyverno/disallow-helm-tiller.yaml", "content": "apiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n name: disallow-helm-tiller\n annotations:\n policies.kyverno.io/title: Disallow Helm Tiller\n policies.kyverno.io/category: Sample\n policies.kyverno.io/minversion: 1.6.0\n policies.kyverno.io/severity: medium\n policies.kyverno.io/subject: Pod\n policies.kyverno.io/description: >-\n Tiller, found in Helm v2, has known security challenges. It requires administrative privileges and acts as a shared\n resource accessible to any authenticated user. Tiller can lead to privilege escalation as\n restricted users can impact other users. It is recommended to use Helm v3+ which does not contain\n Tiller for these reasons. This policy validates that there is not an image\n containing the name `tiller`.\nspec:\n background: true\n rules:\n - name: validate-helm-tiller\n match:\n any:\n - resources:\n kinds:\n - Pod\n validate:\n failureAction: Enforce\n message: \"Helm Tiller is not allowed\"\n foreach:\n - list: \"request.object.spec.containers\"\n pattern:\n image: \"!*tiller*\"\n - list: \"request.object.spec.initContainers\"\n pattern:\n image: \"!*tiller*\"\n - list: \"request.object.spec.ephemeralContainers\"\n pattern:\n image: \"!*tiller*\"\n" }, { "path": "cluster/homelab/configs/kyverno/disallow-latest-tag.yaml", "content": "apiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n name: disallow-latest-tag\n annotations:\n policies.kyverno.io/title: Disallow Latest Tag\n policies.kyverno.io/category: Best Practices\n policies.kyverno.io/minversion: 1.6.0\n policies.kyverno.io/severity: medium\n policies.kyverno.io/subject: Pod\n policies.kyverno.io/description: >-\n The ':latest' tag is mutable and can lead to unexpected errors if the\n image changes. A best practice is to use an immutable tag that maps to\n a specific version of an application Pod. This policy validates that the image\n specifies a tag and that it is not called `latest`.\nspec:\n background: true\n rules:\n - name: require-image-tag\n match:\n any:\n - resources:\n kinds:\n - Pod\n validate:\n failureAction: Enforce\n message: \"An image tag is required.\"\n foreach:\n - list: \"request.object.spec.containers\"\n pattern:\n image: \"*:*\"\n - list: \"request.object.spec.initContainers\"\n pattern:\n image: \"*:*\"\n - list: \"request.object.spec.ephemeralContainers\"\n pattern:\n image: \"*:*\"\n - name: validate-image-tag\n match:\n any:\n - resources:\n kinds:\n - Pod\n validate:\n failureAction: Enforce\n message: \"Using a mutable image tag e.g. 'latest' is not allowed.\"\n foreach:\n - list: \"request.object.spec.containers\"\n pattern:\n image: \"!*:latest\"\n - list: \"request.object.spec.initContainers\"\n pattern:\n image: \"!*:latest\"\n - list: \"request.object.spec.ephemeralContainers\"\n pattern:\n image: \"!*:latest\"\n" }, { "path": "cluster/homelab/configs/kyverno/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: kyverno-policies\n namespace: kyverno\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: kyverno-policies\n version: 3.8.0\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: kyverno\n namespace: flux-system\n" }, { "path": "cluster/homelab/configs/kyverno/inject-image-pull-secrets.yaml", "content": "apiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n name: inject-default-image-pull-secret\n annotations:\n policies.kyverno.io/title: Inject default image pull secret\n policies.kyverno.io/category: Best Practices\n policies.kyverno.io/subject: ServiceAccount, ImagePullSecrets\n policies.kyverno.io/description: >-\n Adds 'default-image-pull-secret' to the 'imagePullSecrets' list of \n any ServiceAccount created or updated. This ensures that pods using the SA \n can pull images from private registries.\n policies.kyverno.io/severity: low\n kyverno.io/kyverno-version: 1.7.0\n policies.kyverno.io/minversion: 1.7.0\n kyverno.io/kubernetes-version: \"1.23\"\nspec:\n rules:\n - name: inject-image-pull-secret\n match:\n any:\n - resources:\n kinds:\n - ServiceAccount\n mutate:\n mutateExistingOnPolicyUpdate: true\n targets:\n - kind: ServiceAccount\n name: default\n apiVersion: v1\n patchStrategicMerge:\n imagePullSecrets:\n - name: default-image-pull-secret\n" }, { "path": "cluster/homelab/configs/kyverno/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n # - helm-release.yaml\n - no-privileged.yaml\n - cleanup-empty-replicasets.yaml\n - disallow-default.yaml\n - disallow-helm-tiller.yaml\n - require-drop-all.yaml\n - restrict-service-external-ips.yaml\n - restrict-node-port.yaml\n # - default-network-policy.yaml\n - inject-image-pull-secrets.yaml\n" }, { "path": "cluster/homelab/configs/kyverno/no-privileged.yaml", "content": "apiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n name: disallow-privileged-containers\n annotations:\n policies.kyverno.io/title: Disallow Privileged Containers\n policies.kyverno.io/category: Pod Security Standards (Baseline)\n policies.kyverno.io/severity: medium\n policies.kyverno.io/subject: Pod\n kyverno.io/kyverno-version: 1.6.0\n kyverno.io/kubernetes-version: \"1.22-1.23\"\n policies.kyverno.io/description: >-\n Privileged mode disables most security mechanisms and must not be allowed. This policy\n ensures Pods do not call for privileged mode.\nspec:\n background: true\n rules:\n - name: privileged-containers\n match:\n any:\n - resources:\n kinds:\n - Pod\n exclude:\n any:\n - resources:\n namespaces:\n - kured\n - longhorn-system\n - system-upgrade\n validate:\n failureAction: Enforce\n message: >-\n Privileged mode is disallowed. The fields spec.containers[*].securityContext.privileged,\n spec.initContainers[*].securityContext.privileged, and spec.ephemeralContainers[*].securityContext.privileged must be unset or set to `false`.\n pattern:\n spec:\n =(ephemeralContainers):\n - =(securityContext):\n =(privileged): \"false\"\n =(initContainers):\n - =(securityContext):\n =(privileged): \"false\"\n containers:\n - =(securityContext):\n =(privileged): \"false\"\n" }, { "path": "cluster/homelab/configs/kyverno/require-drop-all.yaml", "content": "apiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n name: drop-all-capabilities\n annotations:\n policies.kyverno.io/title: Drop All Capabilities\n policies.kyverno.io/category: Best Practices\n policies.kyverno.io/severity: medium\n policies.kyverno.io/minversion: 1.6.0\n policies.kyverno.io/subject: Pod\n policies.kyverno.io/description: >-\n Capabilities permit privileged actions without giving full root access. All\n capabilities should be dropped from a Pod, with only those required added back.\n This policy ensures that all containers explicitly specify the `drop: [\"ALL\"]`\n ability. Note that this policy also illustrates how to cover drop entries in any\n case although this may not strictly conform to the Pod Security Standards.\nspec:\n background: true\n rules:\n - name: require-drop-all\n exclude:\n any:\n - resources:\n namespaces:\n - longhorn-system\n - kube-system\n - metallb-system # @TODO: This may be fixable...\n - kured\n - velero\n - system-upgrade\n match:\n any:\n - resources:\n kinds:\n - Pod\n preconditions:\n all:\n - key: \"{{ request.operation || 'BACKGROUND' }}\"\n operator: NotEquals\n value: DELETE\n validate:\n failureAction: Audit\n message: >-\n Containers must drop `ALL` capabilities.\n foreach:\n - list: request.object.spec.[ephemeralContainers, initContainers, containers][]\n deny:\n conditions:\n all:\n - key: ALL\n operator: AnyNotIn\n value: \"{{ element.securityContext.capabilities.drop[].to_upper(@) || `[]` }}\"\n" }, { "path": "cluster/homelab/configs/kyverno/restrict-node-port.yaml", "content": "apiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n name: restrict-nodeport\n annotations:\n policies.kyverno.io/title: Disallow NodePort\n policies.kyverno.io/category: Best Practices\n policies.kyverno.io/minversion: 1.6.0\n policies.kyverno.io/severity: medium\n policies.kyverno.io/subject: Service\n policies.kyverno.io/description: >-\n A Kubernetes Service of type NodePort uses a host port to receive traffic from\n any source. A NetworkPolicy cannot be used to control traffic to host ports.\n Although NodePort Services can be useful, their use must be limited to Services\n with additional upstream security checks. This policy validates that any new Services\n do not use the `NodePort` type.\nspec:\n background: true\n rules:\n - name: validate-nodeport\n match:\n any:\n - resources:\n kinds:\n - Service\n validate:\n failureAction: Enforce\n message: \"Services of type NodePort are not allowed.\"\n pattern:\n spec:\n =(type): \"!NodePort\"\n" }, { "path": "cluster/homelab/configs/kyverno/restrict-service-external-ips.yaml", "content": "apiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n name: restrict-external-ips\n annotations:\n policies.kyverno.io/title: Restrict External IPs\n policies.kyverno.io/category: Best Practices\n policies.kyverno.io/minversion: 1.6.0\n policies.kyverno.io/severity: medium\n policies.kyverno.io/subject: Service\n policies.kyverno.io/description: >-\n Service externalIPs can be used for a MITM attack (CVE-2020-8554).\n Restrict externalIPs or limit to a known set of addresses.\n See: https://github.com/kyverno/kyverno/issues/1367. This policy validates\n that the `externalIPs` field is not set on a Service.\nspec:\n background: true\n rules:\n - name: check-ips\n match:\n any:\n - resources:\n kinds:\n - Service\n validate:\n failureAction: Enforce\n message: \"externalIPs are not allowed.\"\n pattern:\n spec:\n # restrict external IP addresses\n # you can alternatively restrict to a known set of addresses using:\n # =(externalIPs): [\"37.10.11.53\", \"153.10.20.1\"]\n X(externalIPs): \"null\"\n" }, { "path": "cluster/homelab/configs/metallb/ip-pool.yaml", "content": "apiVersion: metallb.io/v1beta1\nkind: IPAddressPool\nmetadata:\n name: first-pool\n namespace: metallb-system\nspec:\n addresses:\n - 192.168.1.5-192.168.1.19\n" }, { "path": "cluster/homelab/configs/metallb/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - ip-pool.yaml\n - l2-advertisement.yaml\n" }, { "path": "cluster/homelab/configs/metallb/l2-advertisement.yaml", "content": "apiVersion: metallb.io/v1beta1\nkind: L2Advertisement\nmetadata:\n name: default\n namespace: metallb-system\n" }, { "path": "cluster/homelab/configs/system-upgrade/README.md", "content": "# Warning\n\nThis is disabled since automatic updates may end up breaking something due to deprecations." }, { "path": "cluster/homelab/configs/system-upgrade/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n- plans/stable\n" }, { "path": "cluster/homelab/configs/system-upgrade/plans/latest/agent.yaml", "content": "---\n# Agent plan\napiVersion: upgrade.cattle.io/v1\nkind: Plan\nmetadata:\n name: agent-plan\n namespace: system-upgrade\nspec:\n concurrency: 1\n cordon: true\n nodeSelector:\n matchExpressions:\n - key: node-role.kubernetes.io/master\n operator: DoesNotExist\n prepare:\n args:\n - prepare\n - server-plan\n image: rancher/k3s-upgrade\n serviceAccountName: system-upgrade\n upgrade:\n image: rancher/k3s-upgrade\n channel: https://update.k3s.io/v1-release/channels/latest" }, { "path": "cluster/homelab/configs/system-upgrade/plans/latest/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nspec:\n dependsOn:\n - name: core\n - name: helm\nresources:\n - agent.yaml\n - server.yaml" }, { "path": "cluster/homelab/configs/system-upgrade/plans/latest/server.yaml", "content": "---\n# Server plan\napiVersion: upgrade.cattle.io/v1\nkind: Plan\nmetadata:\n name: server-plan\n namespace: system-upgrade\nspec:\n concurrency: 1\n cordon: true\n nodeSelector:\n matchExpressions:\n - key: node-role.kubernetes.io/master\n operator: In\n values:\n - \"true\"\n serviceAccountName: system-upgrade\n upgrade:\n image: rancher/k3s-upgrade\n channel: https://update.k3s.io/v1-release/channels/latest" }, { "path": "cluster/homelab/configs/system-upgrade/plans/stable/agent.yaml", "content": "---\n# Agent plan\napiVersion: upgrade.cattle.io/v1\nkind: Plan\nmetadata:\n name: agent-plan\n namespace: system-upgrade\nspec:\n concurrency: 1\n cordon: true\n nodeSelector:\n matchExpressions:\n - key: node-role.kubernetes.io/master\n operator: DoesNotExist\n prepare:\n args:\n - prepare\n - server-plan\n image: rancher/k3s-upgrade\n serviceAccountName: system-upgrade\n upgrade:\n image: rancher/k3s-upgrade\n channel: https://update.k3s.io/v1-release/channels/stable" }, { "path": "cluster/homelab/configs/system-upgrade/plans/stable/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - agent.yaml\n - server.yaml" }, { "path": "cluster/homelab/configs/system-upgrade/plans/stable/server.yaml", "content": "---\n# Server plan\napiVersion: upgrade.cattle.io/v1\nkind: Plan\nmetadata:\n name: server-plan\n namespace: system-upgrade\nspec:\n concurrency: 1\n cordon: true\n nodeSelector:\n matchExpressions:\n - key: node-role.kubernetes.io/master\n operator: In\n values:\n - \"true\"\n serviceAccountName: system-upgrade\n upgrade:\n image: rancher/k3s-upgrade\n channel: https://update.k3s.io/v1-release/channels/stable" }, { "path": "cluster/homelab/configs/velero/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - schedule.yaml\n" }, { "path": "cluster/homelab/configs/velero/schedule.yaml", "content": "apiVersion: velero.io/v1\nkind: Schedule\nmetadata:\n name: general\n namespace: velero\nspec:\n schedule: \"00 01 * * 6\"\n template:\n hooks: {}\n includedNamespaces: # Either not important, not containing any information or they are easily recoverable\n - freshrss # RSS are not fatal\n - openbooks\n - cyberchef\n - diagrams\n - storage\n - koffan\n - foldingathome\n snapshotVolumes: true\n ttl: 730h0m0s # 1 Month\n useOwnerReferencesInBackup: false\n---\napiVersion: velero.io/v1\nkind: Schedule\nmetadata:\n name: sensitive\n namespace: velero\nspec:\n schedule: \"00 01 * * 1,5\"\n template:\n hooks: {}\n includedNamespaces: # Related to my homelab or automation\n - media\n - n8n\n - uptimekuma\n - go-ddns-controller-system\n - nodered\n - changedetection\n snapshotVolumes: true\n ttl: 1460h0m0s # 2 Month\n useOwnerReferencesInBackup: false\n---\napiVersion: velero.io/v1\nkind: Schedule\nmetadata:\n name: critical\n namespace: velero\nspec:\n schedule: \"00 01 * * *\"\n template:\n hooks: {}\n includedNamespaces: # Data I don't want to lose\n - replacedby\n - vikunja\n - website\n - reactiveresume\n - homebox\n - paperless-ngx\n - firefly\n - wallabag\n - linkwarden\n - mealie\n snapshotVolumes: true\n ttl: 2190h0m0s\n useOwnerReferencesInBackup: false\n" }, { "path": "cluster/homelab/core/archive/cgroup-gc/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: cgroup-gc\n namespace: cgroup-gc\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: ./Helm/apps/cgroup-gc\n reconcileStrategy: Revision\n sourceRef:\n kind: GitRepository\n name: flux-system\n namespace: flux-system\n" }, { "path": "cluster/homelab/core/archive/cgroup-gc/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/core/archive/cgroup-gc/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: cgroup-gc\n" }, { "path": "cluster/homelab/core/archive/kube-vip/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: kube-vip\n namespace: kube-vip\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: kube-vip\n version: 0.9.8\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: kube-vip\n namespace: flux-system\n values:\n image:\n repository: ghcr.io/kube-vip/kube-vip\n tag: \"v1.1.2\"\n env:\n lb_enable: \"true\"\n lb_port: \"6443\"\n" }, { "path": "cluster/homelab/core/archive/kube-vip/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/core/archive/kube-vip/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: kube-vip\n" }, { "path": "cluster/homelab/core/cert-manager/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: cert-manager\n namespace: cert-manager\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: cert-manager\n version: v1.20.2\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: cert-manager\n namespace: flux-system\n values:\n installCRDs: true\n deploymentAnnotations:\n certmanager.k8s.io/disable-validation: \"true\"\n config:\n enableGatewayAPI: true\n crds:\n enabled: true\n enableCertificateOwnerRef: true # automatically remove secrets if cert is removed\n" }, { "path": "cluster/homelab/core/cert-manager/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n - secret.sops.yaml\n" }, { "path": "cluster/homelab/core/cert-manager/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: cert-manager\n" }, { "path": "cluster/homelab/core/cert-manager/secret.sops.yaml", "content": "apiVersion: v1\nkind: Secret\ntype: Opaque\nmetadata:\n name: cloudflare\n namespace: cert-manager\ndata:\n apikey: ENC[AES256_GCM,data:GEwv4zsXma9KNxjpTHEUPktOWt8iPY3iWn5Qg2IbhwF5LzHHljOj+wtNWPuR6w9AhJHf65DIYMM=,iv:0sIMJyLLSPt7rPMddOdTupr3sxFfLfBsqllGatxJSmQ=,tag:NwTiQuHJD7zxItdNUu+aew==,type:str]\nsops:\n kms: []\n gcp_kms: []\n azure_kv: []\n hc_vault: []\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5YzAwNjR4SlVjanZILzc4\n Y2pyN3Fydkt1dHgyR0RqRkcyZERld0hIcFNJClB6M3RLUEpQZnFhMXBZYW1QcnVp\n c3ZSS2RsblNocSswWGpMRFNQclZzakEKLS0tIDg3WCtNVWF3OE1uU3pJdjdwTCtB\n V2hkT08zTk1yRjQ4ZjFCMHl1cVhZSEUKeqKiXOZ5VnrTZEg0F/v2zTaLY+0mEOcP\n GOGM3OF3KlYDxKL2Yiy7DuhfauDgjKByg+x7z6KWM8MfV1PbT/pNOw==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2024-03-26T13:57:41Z\"\n mac: ENC[AES256_GCM,data:EVFpktWkrG9ZhhFrnOX55Ll1Pft+jlaQXRvf0ut9AJ1ES+rNO68PENM/4w3zLBDv23dEd5uIXeWZlXPsvbJPm8IK5kDC+GXkel3YU46ITLTfNROpYSsm6yh7EWFaMtj0/Eeo2b3lfpCJ0OwghKzhQ/4BbnM6FqkKlTUXj/NKsAc=,iv:cdzzGNnQA/G3MXr4WXr73Wsdqvre6ivagAHPCxS4c5k=,tag:0/nL0HD9sklDP1mRFrdWNQ==,type:str]\n pgp: []\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.8.1\n" }, { "path": "cluster/homelab/core/cluster-critical/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - priority-classes.yaml\n" }, { "path": "cluster/homelab/core/cluster-critical/priority-classes.yaml", "content": "---\napiVersion: scheduling.k8s.io/v1\nkind: PriorityClass\nmetadata:\n name: default-priority\nvalue: 0\nglobalDefault: true\ndescription: \"Default priority of pods. Generally 0 is used without specifying it, but adding it for explicitness.\"\n\n---\napiVersion: scheduling.k8s.io/v1\nkind: PriorityClass\nmetadata:\n name: general-priority\nvalue: 1000\nglobalDefault: false\ndescription: \"For general workload of apps that are not important.\"\n\n---\napiVersion: scheduling.k8s.io/v1\nkind: PriorityClass\nmetadata:\n name: sensitive-priority\nvalue: 2000\nglobalDefault: false\ndescription: \"Related to my homelab or automation.\"\n\n---\napiVersion: scheduling.k8s.io/v1\nkind: PriorityClass\nmetadata:\n name: critical-priority\nvalue: 3000\nglobalDefault: false\ndescription: \"Apps I don't want to go down.\"\n" }, { "path": "cluster/homelab/core/cnpg/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: cnpg\n namespace: cnpg-system\nspec:\n interval: 1h\n install:\n createNamespace: true\n chart:\n spec:\n chart: cloudnative-pg\n version: 0.28.0\n interval: 1h\n sourceRef:\n kind: HelmRepository\n name: cnpg\n namespace: flux-system\n values:\n image:\n repository: ghcr.io/cloudnative-pg/cloudnative-pg\n pullPolicy: IfNotPresent\n tag: \"1.29.0\"\n monitoring:\n podMonitorEnabled: true\n podMonitorAdditionalLabels:\n release: observeability\n grafanaDashboard:\n create: true\n config:\n create: true\n name: cnpg-controller-manager-config\n secret: false\n clusterWide: true\n # -- The content of the configmap/secret, see\n # https://cloudnative-pg.io/documentation/current/operator_conf/#available-options\n # for all the available options.\n data:\n INHERITED_ANNOTATIONS: backup.velero.io/*\n # INHERITED_LABELS: environment, workload, app\n # WATCH_NAMESPACE: namespace-a,namespace-b\n # -- The maximum number of concurrent reconciles. Defaults to 10.\n maxConcurrentReconciles: 10\n" }, { "path": "cluster/homelab/core/cnpg/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/core/cnpg/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: cnpg-system\n labels:\n monitoring.coreos.com/serviceMonitor: \"true\"\n" }, { "path": "cluster/homelab/core/descheduler/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: descheduler\n namespace: kube-system\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: descheduler\n version: 0.35.1\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: descheduler\n namespace: flux-system\n" }, { "path": "cluster/homelab/core/descheduler/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n" }, { "path": "cluster/homelab/core/istio/cni-helm-release.yaml", "content": "apiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: istio-cni\n namespace: istio-system\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: cni\n version: 1.29.2\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: istio\n namespace: flux-system\n values:\n profile: ambient\n global:\n platform: k3s\n" }, { "path": "cluster/homelab/core/istio/control-plane-helm-release.yaml", "content": "apiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: istiod\n namespace: istio-system\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: istiod\n version: 1.29.2\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: istio\n namespace: flux-system\n values:\n profile: ambient\n" }, { "path": "cluster/homelab/core/istio/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - control-plane-helm-release.yaml\n - cni-helm-release.yaml\n - ztunnel-helm-release.yaml\n" }, { "path": "cluster/homelab/core/istio/ztunnel-helm-release.yaml", "content": "apiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: ztunnel\n namespace: istio-system\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: ztunnel\n version: 1.29.2\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: istio\n namespace: flux-system\n" }, { "path": "cluster/homelab/core/kured/helm-release.sops.yaml", "content": "apiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: kured\n namespace: kured\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: kured\n version: 5.11.0\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: kubereboot\n namespace: flux-system\n values:\n configuration:\n drainGracePeriod: ENC[AES256_GCM,data:2Td0Vw==,iv:UJHIic7+cOmT6q8v0Pakfy7FvDNUwvqGX698sFBpipM=,tag:R0HgYh0oLsldq76CgngGwg==,type:int]\n drainTimeout: ENC[AES256_GCM,data:FlOOtjg=,iv:see4FeKoJUsHk7LOu+/ZzY3GR4SBO7egdA1t+XqQMTg=,tag:7tYYPrI48stvMMAU8d9Omw==,type:str]\n forceReboot: ENC[AES256_GCM,data:3OgvH/M=,iv:FBoepgdrSrEe8R7xWk19fxT97LklI9tGCi2Fl90fKkk=,tag:YULlbrO2jg90jingMj9/OQ==,type:bool]\n #ENC[AES256_GCM,data:p58DFDFzk1DNaY2JnEqwy1g=,iv:QMm6RsHnz8a3sjHup17XlLegUWg46ZFGFKOWVAmJ/cI=,tag:Byj6iWeJJMZLA/QRVzrvbA==,type:comment]\n startTime: ENC[AES256_GCM,data:9vJzN2Y=,iv:iZ3SOxdM0IhZ/Pl1flnoozQMnNytu+rpHTALKbXGzDg=,tag:G0S4JBatU4DhFGkPIBiVDw==,type:str]\n #ENC[AES256_GCM,data:PwhGuZQETUNB9G/wWmSwlaI=,iv:Sq7bjgxldqKPSRo7rKbmTHApYQf7RVW9zW08hAfVBhw=,tag:dRLxpUZwYqRQENg4BMaMcQ==,type:comment]\n endTime: ENC[AES256_GCM,data:oRM8M5g=,iv:E24JzYa+Nyul8Blp0VMIG7VApcYhq57T9N07jJw2xK8=,tag:+G5M4Wx3jcIvOdvNBs1Urg==,type:str]\n #ENC[AES256_GCM,data:5fx84FA6Lq86A/iM1UEUM7SulY4eUHqaSk3lziN029TzvYqtsb/RzO3PYLNqTU2qaBwCeRRaowZ+iKe1tHbKdex6nMt+TUz1wlIJA4XS9mI5pq6SUMV7xOjiplh4YsXo,iv:/IQ1Dnd+5ZaSRGXMA5jY4pqth3sb3mRHAaAU9uw3L3k=,tag:TE0CaA+2g0VYi0NH6Yl/Aw==,type:comment]\n #ENC[AES256_GCM,data:bJ7fEcDqcE5EDMQc3/7klXRfRUOGeKvLS5KE5OxYkKd31Q==,iv:nVboVs/+SwFkwkdd9N6anhiwTryg7aAC0fbWCMxR9/8=,tag:yorWOET9WHAXOGl1IP5vtQ==,type:comment]\n notifyUrl: ENC[AES256_GCM,data:jVHLn79qAR9bmCQM455cG7EmTvmkAzzK/r6qNb1WkXfUVkDxF6y0oJjmmpEex/alqRISbocEvVabzJEg1d7m/6FNwz8wRF+4NTDMNGcWiPHbF6OAVMbMma6ts2NwsXVUojE=,iv:4GfvaOMlgZyPz0k4aY8PMBm16blGzYLMzlru6WObwIE=,tag:VRQbXd3FSIef3R8DfG6wsw==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0RWlKYkQ0L1cvd1FzV01j\n TEhXWitrSmVYc0xQNXZKNjRYcFJtcUdpNkRJCkwvdVpucUlZR3RnTXlyVnd1dlRz\n bkVNZWo4MFhCUDZMbk9TQXVJTDhHY28KLS0tIGlEbllMa2FsMHp1RFRBczF0dlND\n cFhiSXpnNW5TK3FUbjNPdGlaaWNWMU0KwCUiirHe9HKRT+8FbjtCt1RKgYRWbY2b\n H8EYEq180QqJn1d2RXlqZh6ughtZYe3C8cHT2riG13vebNj81r9oeA==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-05-16T06:40:14Z\"\n mac: ENC[AES256_GCM,data:QqA98BTEQnfOzlEXXHtLR/OzOlHKiDkZHhlRxb5GnY7bTh1cf9diLbrdnomdl7Aa6tywnE+r8oMz+zWBZyb1egjlbrYq2JG/e161O3jtrBnGJbfIoMncOdSCdhLQJ5OGdddu5o+9ZIoUsVidCCICU8rP+HS2lXm+oEjTExKinrI=,iv:2mnpopavMeYr36ZIIgWJao4hka2hN3Vcqvory5WG0ak=,tag:vAJ6Ym9oO3cqkx8OYhnBMg==,type:str]\n encrypted_regex: ^(values)$\n version: 3.10.2\n" }, { "path": "cluster/homelab/core/kured/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.sops.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/core/kured/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: kured\n" }, { "path": "cluster/homelab/core/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - cluster-critical\n - cnpg\n - reflector\n - system-upgrade\n - longhorn-system\n - velero\n - cert-manager\n - kyverno\n # - kured\n # - trivy\n - descheduler\n - metallb\n - istio\n - mariadb-operator\n - tofu-controller\n" }, { "path": "cluster/homelab/core/kyverno/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: kyverno\n namespace: kyverno\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: kyverno\n version: 3.8.0\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: kyverno\n namespace: flux-system\n values:\n admissionController:\n serviceMonitor:\n additionalLabels:\n release: observeability\n enabled: true\n\n backgroundController:\n serviceMonitor:\n additionalLabels:\n release: observeability\n enabled: true\n rbac:\n clusterRole:\n extraResources:\n - apiGroups:\n - \"admissionregistration.k8s.io\"\n resources:\n - validatingwebhookconfigurations\n verbs:\n - get\n - list\n - watch\n - update\n - patch\n - apiGroups:\n - \"\"\n resources:\n - serviceaccounts\n verbs:\n - create\n - update\n - delete\n - patch\n\n cleanupController:\n rbac:\n clusterRole:\n extraResources:\n - apiGroups:\n - \"\"\n resources:\n - pods\n verbs:\n - delete\n - get\n - list\n - watch\n - apiGroups:\n - apps\n resources:\n - replicasets\n verbs:\n - delete\n - get\n - list\n - watch\n serviceMonitor:\n additionalLabels:\n release: observeability\n enabled: true\n\n reportsController:\n serviceMonitor:\n additionalLabels:\n release: observeability\n enabled: true\n\n grafana:\n enabled: true\n labels:\n grafana_dashboard: \"1\"\n\n config:\n resourceFilters:\n - \"[Event,*,*]\"\n - \"[*/*,kube-system,*]\"\n - \"[*/*,kube-public,*]\"\n - \"[*/*,kube-node-lease,*]\"\n - \"[Node,*,*]\"\n - \"[Node/?*,*,*]\"\n - \"[APIService,*,*]\"\n - \"[APIService/?*,*,*]\"\n - \"[TokenReview,*,*]\"\n - \"[SubjectAccessReview,*,*]\"\n - \"[SelfSubjectAccessReview,*,*]\"\n - \"[Binding,*,*]\"\n - \"[Pod/binding,*,*]\"\n # We comment these out, so we can delete empty replicas\n # - '[ReplicaSet,*,*]'\n # - '[ReplicaSet/?*,*,*]'\n - \"[EphemeralReport,*,*]\"\n - \"[ClusterEphemeralReport,*,*]\"\n # exclude resources from the chart\n - '[ClusterRole,*,{{ template \"kyverno.admission-controller.roleName\" . }}]'\n - '[ClusterRole,*,{{ template \"kyverno.admission-controller.roleName\" . }}:core]'\n - '[ClusterRole,*,{{ template \"kyverno.admission-controller.roleName\" . }}:additional]'\n - '[ClusterRole,*,{{ template \"kyverno.background-controller.roleName\" . }}]'\n - '[ClusterRole,*,{{ template \"kyverno.background-controller.roleName\" . }}:core]'\n - '[ClusterRole,*,{{ template \"kyverno.background-controller.roleName\" . }}:additional]'\n - '[ClusterRole,*,{{ template \"kyverno.cleanup-controller.roleName\" . }}]'\n - '[ClusterRole,*,{{ template \"kyverno.cleanup-controller.roleName\" . }}:core]'\n - '[ClusterRole,*,{{ template \"kyverno.cleanup-controller.roleName\" . }}:additional]'\n - '[ClusterRole,*,{{ template \"kyverno.reports-controller.roleName\" . }}]'\n - '[ClusterRole,*,{{ template \"kyverno.reports-controller.roleName\" . }}:core]'\n - '[ClusterRole,*,{{ template \"kyverno.reports-controller.roleName\" . }}:additional]'\n - '[ClusterRoleBinding,*,{{ template \"kyverno.admission-controller.roleName\" . }}]'\n - '[ClusterRoleBinding,*,{{ template \"kyverno.background-controller.roleName\" . }}]'\n - '[ClusterRoleBinding,*,{{ template \"kyverno.cleanup-controller.roleName\" . }}]'\n - '[ClusterRoleBinding,*,{{ template \"kyverno.reports-controller.roleName\" . }}]'\n - '[ServiceAccount,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceAccountName\" . }}]'\n - '[ServiceAccount/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceAccountName\" . }}]'\n - '[ServiceAccount,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.serviceAccountName\" . }}]'\n - '[ServiceAccount/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.serviceAccountName\" . }}]'\n - '[ServiceAccount,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.serviceAccountName\" . }}]'\n - '[ServiceAccount/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.serviceAccountName\" . }}]'\n - '[ServiceAccount,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.serviceAccountName\" . }}]'\n - '[ServiceAccount/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.serviceAccountName\" . }}]'\n - '[Role,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.roleName\" . }}]'\n - '[Role,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.roleName\" . }}]'\n - '[Role,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.roleName\" . }}]'\n - '[Role,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.roleName\" . }}]'\n - '[RoleBinding,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.roleName\" . }}]'\n - '[RoleBinding,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.roleName\" . }}]'\n - '[RoleBinding,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.roleName\" . }}]'\n - '[RoleBinding,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.roleName\" . }}]'\n - '[ConfigMap,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.config.configMapName\" . }}]'\n - '[ConfigMap,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.config.metricsConfigMapName\" . }}]'\n - '[Deployment,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]'\n - '[Deployment/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]'\n - '[Deployment,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]'\n - '[Deployment/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]'\n - '[Deployment,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]'\n - '[Deployment/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]'\n - '[Deployment,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]'\n - '[Deployment/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]'\n - '[Pod,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}-*]'\n - '[Pod/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}-*]'\n - '[Pod,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}-*]'\n - '[Pod/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}-*]'\n - '[Pod,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}-*]'\n - '[Pod/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}-*]'\n - '[Pod,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}-*]'\n - '[Pod/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}-*]'\n - '[Job,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.fullname\" . }}-hook-pre-delete]'\n - '[Job/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.fullname\" . }}-hook-pre-delete]'\n - '[NetworkPolicy,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]'\n - '[NetworkPolicy/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]'\n - '[NetworkPolicy,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]'\n - '[NetworkPolicy/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]'\n - '[NetworkPolicy,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]'\n - '[NetworkPolicy/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]'\n - '[NetworkPolicy,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]'\n - '[NetworkPolicy/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]'\n - '[PodDisruptionBudget,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]'\n - '[PodDisruptionBudget/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]'\n - '[PodDisruptionBudget,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]'\n - '[PodDisruptionBudget/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]'\n - '[PodDisruptionBudget,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]'\n - '[PodDisruptionBudget/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]'\n - '[PodDisruptionBudget,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]'\n - '[PodDisruptionBudget/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]'\n - '[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceName\" . }}]'\n - '[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceName\" . }}]'\n - '[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceName\" . }}-metrics]'\n - '[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceName\" . }}-metrics]'\n - '[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}-metrics]'\n - '[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}-metrics]'\n - '[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]'\n - '[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]'\n - '[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}-metrics]'\n - '[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}-metrics]'\n - '[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}-metrics]'\n - '[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}-metrics]'\n - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template \"kyverno.namespace\" . }}{{ end }},{{ template \"kyverno.admission-controller.name\" . }}]'\n - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template \"kyverno.namespace\" . }}{{ end }},{{ template \"kyverno.background-controller.name\" . }}]'\n - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template \"kyverno.namespace\" . }}{{ end }},{{ template \"kyverno.cleanup-controller.name\" . }}]'\n - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template \"kyverno.namespace\" . }}{{ end }},{{ template \"kyverno.reports-controller.name\" . }}]'\n - '[Secret,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceName\" . }}.{{ template \"kyverno.namespace\" . }}.svc.*]'\n - '[Secret,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}.{{ template \"kyverno.namespace\" . }}.svc.*]'\n - \"[ValidatingWebhookConfiguration,*,longhorn-webhook-validator]\"\n - \"[MutatingWebhookConfiguration,*,longhorn-webhook-mutator]\"\n" }, { "path": "cluster/homelab/core/kyverno/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/core/kyverno/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: kyverno\n labels:\n monitoring.coreos.com/serviceMonitor: \"true\"\n" }, { "path": "cluster/homelab/core/longhorn-system/db-storageclass.yaml", "content": "---\napiVersion: storage.k8s.io/v1\nkind: StorageClass\nmetadata:\n name: longhorn-db\nparameters:\n dataEngine: v1\n dataLocality: best-effort\n disableRevisionCounter: \"true\"\n fromBackup: \"\"\n fsType: ext4\n numberOfReplicas: \"3\"\n staleReplicaTimeout: \"30\"\n unmapMarkSnapChainRemoved: ignored\nprovisioner: driver.longhorn.io\nreclaimPolicy: Retain\nvolumeBindingMode: Immediate\nallowVolumeExpansion: true\n" }, { "path": "cluster/homelab/core/longhorn-system/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: longhorn-system\n namespace: longhorn-system\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: longhorn\n version: 1.11.1\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: longhorn-system\n namespace: flux-system\n values:\n image:\n longhorn:\n manager:\n tag: v1.11.0-hotfix-1\n instanceManager:\n tag: v1.11.0-hotfix-1\n # REF: https://longhorn.io/docs/1.11.0/important-notes/#longhorn-manager-image\n preUpgradeChecker:\n jobEnabled: true\n upgradeVersionCheck: false\n enablePSP: false\n networkPolicies:\n enabled: true\n type: \"k3s\"\n httproute:\n enabled: true\n parentRefs:\n - name: internal\n namespace: istio-gateway\n hostnames:\n - \"longhorn.sgenov.dev\"\n annotations:\n gethomepage.dev/enabled: \"true\"\n gethomepage.dev/description: Block Storage For Kubernetes\n gethomepage.dev/group: Storage\n gethomepage.dev/icon: longhorn\n gethomepage.dev/name: Longhorn\n longhornManager:\n tolerations:\n - key: \"CriticalAddonsOnly\"\n operator: \"Equal\"\n effect: \"NoSchedule\"\n value:\n longhornDriver:\n tolerations:\n - key: \"CriticalAddonsOnly\"\n operator: \"Equal\"\n effect: \"NoSchedule\"\n value:\n defaultSettings:\n taintToleration: \"CriticalAddonsOnly:NoSchedule\"\n" }, { "path": "cluster/homelab/core/longhorn-system/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n - db-storageclass.yaml\n" }, { "path": "cluster/homelab/core/longhorn-system/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: longhorn-system\n" }, { "path": "cluster/homelab/core/mariadb-operator/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: mariadb-operator\n namespace: mariadb-operator\nspec:\n interval: 10m\n install:\n createNamespace: true\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: mariadb-operator\n version: \"26.3.0\"\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: mariadb-operator\n namespace: flux-system\n values:\n logLevel: INFO\n metrics:\n enabled: true\n serviceMonitor:\n enabled: true\n" }, { "path": "cluster/homelab/core/mariadb-operator/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/core/mariadb-operator/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: mariadb-operator\n" }, { "path": "cluster/homelab/core/metallb/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: metallb\n namespace: metallb-system\nspec:\n interval: 10m\n install:\n createNamespace: true\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: metallb\n version: 0.15.3\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: metallb\n namespace: flux-system\n values:\n controller:\n image:\n repository: quay.io/metallb/controller\n tag: v0.15.3\n speaker:\n tolerations:\n - key: \"CriticalAddonsOnly\"\n operator: \"Equal\"\n effect: \"NoSchedule\"\n value:\n" }, { "path": "cluster/homelab/core/metallb/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/core/metallb/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: metallb-system\n labels:\n pod-security.kubernetes.io/enforce: privileged\n pod-security.kubernetes.io/audit: privileged\n pod-security.kubernetes.io/warn: privileged\n" }, { "path": "cluster/homelab/core/reflector/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: reflector\n namespace: reflector\nspec:\n interval: 10m\n install:\n createNamespace: true\n chart:\n spec:\n chart: reflector\n version: 10.0.40\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: reflector\n namespace: flux-system\n values:\n livenessProbe:\n periodSeconds: 30\n readinessProbe:\n periodSeconds: 10\n" }, { "path": "cluster/homelab/core/reflector/image_pull_secret.sops.yaml", "content": "apiVersion: v1\nkind: Secret\ntype: kubernetes.io/dockerconfigjson\nmetadata:\n name: default-image-pull-secret\n namespace: reflector\n annotations:\n reflector.v1.k8s.emberstack.com/reflection-auto-enabled: ENC[AES256_GCM,data:JMnZKQ==,iv:Z632W6d/L1dX88iZkyYhSRYe0kwAyTqR7NRHmiCve1I=,tag:LRiZQ41cVOfBb+dSwEINXw==,type:str]\n reflector.v1.k8s.emberstack.com/reflection-allowed: ENC[AES256_GCM,data:lUrzvA==,iv:QmzvM0s8eNgP65goqPM4raZQDQkkpCvkT/76NMqU1wM=,tag:uasqBARRkKYElLm/TkvJpw==,type:str]\ndata:\n .dockerconfigjson: ENC[AES256_GCM,data:zOcDxtHJv3iy0MnALoaGkmeXy1V1fcAte1/3X1BjQVUis7Xu/3+ivrl37EW+NAPY1EZxxP3hH66y/WrLDftpwBFYJwdL9wI9z68Umd/P/BY3BSk4C3UGTTpnz6/jJ4PATckpJu/5fgl9ZeP5HMNB5oFi9oxnw9BMCgwXq3CmHJBdkRmc00gOO0+L9+tX5wbY7riHU4A+GNNIecx0RHVSPMXq7S/FRkSv5s2x13t/hYHsb2xjQ7shgqqzNa3DNPzwCcmxQaGstjJuly/tYbSCERaVMqITVLFqlwXjnYr2OtOXDwGPADPqvcFSR4NFk6kHFB9V/Lz6/adRuLplAb3nfA==,iv:0FOjWyCoyTte7dzfujgbeBQK0Q3bx7x8gyZMHXE9sG4=,tag:Nrnhh+JpkMoSWrfU3FGIHg==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTMDFMM0xBczY0Uy9Xc0xW\n T2dzb1o2eGFMSnBCNWVrcUhJNDhWOXl2aVQwCkxuVDMrYmpYTFZFSUZ1TGFEQXF5\n anBneWxnT2ZQWmVaanpQT3hEMVl5TnMKLS0tIHlDSHd2Wk4yeVZqRlpYRUl1eHFX\n QVY5UmxsMjl1WlpNeXlkb1BsWi9jTVkKGMZpwmhisdXI676q6Iggz195AgaAXy/C\n SdbIZlHKWq1UQtmGPu6rEpN9rK0he+R/ZHkGvrP6o+EeRatB3gccIA==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2025-10-24T19:54:45Z\"\n mac: ENC[AES256_GCM,data:uKmSxsJhXAM+TFdgvNhZ3fD3GDbDVmX+oFr/pHPmk1YAZ26GKcjfuVnpV3MJg7+sLQhLVknVYscTLoNafB78fjzj5djqxjtMzig6QQhKpVnXksTaWQxU5qP80lWblmm64qKJXJGrme3TIrOD8MI+iN9JMx19YTvf9BbCN9qFCzg=,iv:QStr2wlMqA5ES9n0/GGq+KKFXPXsz/v43po12Ymj4aU=,tag:uqYgGaPuzHO6IASQL19T2A==,type:str]\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.11.0\n" }, { "path": "cluster/homelab/core/reflector/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n - image_pull_secret.sops.yaml\n" }, { "path": "cluster/homelab/core/reflector/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: reflector\n" }, { "path": "cluster/homelab/core/rook-ceph/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: rook-ceph\n namespace: rook-ceph\nspec:\n interval: 10m\n timeout: 15m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: -1\n upgrade:\n cleanupOnFail: true\n remediation:\n retries: 3\n chart:\n spec:\n chart: rook-ceph\n version: v1.19.5\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: rook-release\n namespace: flux-system\n values:\n image:\n repository: ghcr.io/rook/ceph\n tag: v1.19.5\n pullPolicy: IfNotPresent\n crds:\n # -- Whether the helm chart should create and update the CRDs. If false, the CRDs must be\n # managed independently with deploy/examples/crds.yaml.\n # **WARNING** Only set during first deployment. If later disabled the cluster may be DESTROYED.\n # If the CRDs are deleted in this case, see\n # [the disaster recovery guide](https://rook.io/docs/rook/latest/Troubleshooting/disaster-recovery/#restoring-crds-after-deletion)\n # to restore them.\n enabled: true\n #\n # -- Pod resource requests & limits\n resources:\n limits:\n memory: 512Mi\n requests:\n cpu: 200m\n memory: 128Mi\n\n # -- Global log level for the operator.\n # Options: `ERROR`, `WARNING`, `INFO`, `DEBUG`\n logLevel: INFO\n\n # -- If true, scale down the rook operator.\n # This is useful for administrative actions where the rook operator must be scaled down, while using gitops style tooling\n # to deploy your helm charts.\n scaleDownOperator: false\n\n enableDiscoveryDaemon: true\n\n monitoring:\n # -- Enable monitoring. Requires Prometheus to be pre-installed.\n # Enabling will also create RBAC rules to allow Operator to create ServiceMonitors\n enabled: false\n" }, { "path": "cluster/homelab/core/rook-ceph/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n" }, { "path": "cluster/homelab/core/system-upgrade/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - https://github.com/rancher/system-upgrade-controller.git?ref=v0.19.0 # There is a kustomization spec inside of the git repo, may be good to monitor for new releases in the future\nimages:\n - name: rancher/system-upgrade-controller\n newTag: v0.19.0 # overwrite since there is a newer version\n" }, { "path": "cluster/homelab/core/tofu-controller/helm-release.yaml", "content": "# Ref: https://raw.githubusercontent.com/flux-iac/tofu-controller/main/docs/release.yaml\n---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: tofu-controller\n namespace: flux-system\nspec:\n chart:\n spec:\n chart: tofu-controller\n sourceRef:\n kind: HelmRepository\n name: tofu-controller\n version: \"0.16.2\"\n interval: 10m\n releaseName: tofu-controller\n targetNamespace: flux-system\n install:\n crds: Create\n remediation:\n retries: -1\n upgrade:\n crds: CreateReplace\n remediation:\n retries: -1\n values:\n replicaCount: 1\n concurrency: 24\n resources:\n limits:\n cpu: 1000m\n memory: 2Gi\n requests:\n cpu: 400m\n memory: 64Mi\n caCertValidityDuration: 24h\n certRotationCheckFrequency: 30m\n" }, { "path": "cluster/homelab/core/tofu-controller/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n" }, { "path": "cluster/homelab/core/trivy/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: trivy-operator\n namespace: trivy-system\nspec:\n interval: 10m\n install:\n createNamespace: true\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: trivy-operator\n version: 0.32.1\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: aqua\n namespace: flux-system\n values:\n service:\n headless: true\n metricsPort: 80\n serviceMonitor:\n labels:\n release: observeability\n enabled: true\n trivy:\n ignoreUnfixed: true\n # targetWorkloads: \"pod,statefulset,daemonset,replicaset,cronjob\"\n # Targeting only my specific apps\n targetNamespaces: \"\"\n trivyOperator:\n reportResourceLabels: \"owner,app\"\n operator:\n # -- configAuditScannerEnabled the flag to enable configuration audit scanner\n configAuditScannerEnabled: true\n # -- rbacAssessmentScannerEnabled the flag to enable rbac assessment scanner\n rbacAssessmentScannerEnabled: true\n # -- infraAssessmentScannerEnabled the flag to enable infra assessment scanner\n infraAssessmentScannerEnabled: true\n # -- clusterComplianceEnabled the flag to enable cluster compliance scanner\n clusterComplianceEnabled: true\n metricsFindingsEnabled: true\n\n # -- metricsVulnIdEnabled the flag to enable metrics about cve vulns id\n # be aware of metrics cardinality is significantly increased with this feature enabled.\n metricsVulnIdEnabled: true\n\n # -- exposedSecretScannerEnabled the flag to enable exposed secret scanner\n exposedSecretScannerEnabled: true\n\n # -- MetricsExposedSecretInfo the flag to enable metrics about exposed secrets\n # be aware of metrics cardinality is significantly increased with this feature enabled.\n metricsExposedSecretInfo: true\n\n # -- MetricsConfigAuditInfo the flag to enable metrics about configuration audits\n # be aware of metrics cardinality is significantly increased with this feature enabled.\n metricsConfigAuditInfo: true\n\n # -- MetricsRbacAssessmentInfo the flag to enable metrics about Rbac Assessment\n # be aware of metrics cardinality is significantly increased with this feature enabled.\n metricsRbacAssessmentInfo: true\n\n # -- MetricsInfraAssessmentInfo the flag to enable metrics about Infra Assessment\n # be aware of metrics cardinality is significantly increased with this feature enabled.\n metricsInfraAssessmentInfo: true\n\n # -- MetricsImageInfo the flag to enable metrics about Image Information of scanned images\n # This information has image os information including os family, name/version, and if end of service life has been reached\n # be aware of metrics cardinality is significantly increased with this feature enabled.\n metricsImageInfo: true\n\n # -- MetricsClusterComplianceInfo the flag to enable metrics about Cluster Compliance\n # be aware of metrics cardinality is significantly increased with this feature enabled.\n metricsClusterComplianceInfo: true\n" }, { "path": "cluster/homelab/core/trivy/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/core/trivy/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: trivy-system\n labels:\n monitoring.coreos.com/serviceMonitor: \"true\"\n" }, { "path": "cluster/homelab/core/velero/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: velero\n namespace: velero\nspec:\n interval: 10m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: 3\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: velero\n version: 11.4.0\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: velero\n namespace: flux-system\n values:\n snapshotsEnabled: false\n image:\n repository: velero/velero\n tag: v1.18.0\n upgradeCRDs: true\n initContainers:\n - name: velero-plugin-for-aws\n image: velero/velero-plugin-for-aws:v1.14.0\n volumeMounts:\n - mountPath: /target\n name: plugins\n metrics:\n enabled: false\n scrapeInterval: 120s\n scrapeTimeout: 30s\n deployNodeAgent: true\n\n # Override kubectl image - use Bitnami's AWS ECR repo.. still has versions.\n # Probably will fail at some point\n # Ref: https://github.com/vmware-tanzu/helm-charts/issues/698\n kubectl:\n image:\n repository: public.ecr.aws/bitnami/kubectl\n credentials:\n existingSecret: cloud-credentials-wasabi\n configuration:\n repositoryMaintenanceJob:\n repositoryConfigData:\n global:\n keepLatestMaintenanceJobs: 1\n # features: EnableCSI\n backupStorageLocation:\n - name: default\n provider: aws\n default: true\n bucket: sgenov-velero\n config:\n region: eu-central-2\n s3ForcePathStyle: true\n s3Url: https://s3.eu-central-2.wasabisys.com\n checksumAlgorithm: \"\"\n\n - name: wasabi\n provider: aws\n default: false\n bucket: sgenov-velero\n config:\n region: eu-central-2\n s3ForcePathStyle: true\n s3Url: https://s3.eu-central-2.wasabisys.com\n checksumAlgorithm: \"\"\n" }, { "path": "cluster/homelab/core/velero/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n - secret.sops.yaml\n" }, { "path": "cluster/homelab/core/velero/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: velero\n" }, { "path": "cluster/homelab/core/velero/secret.sops.yaml", "content": "apiVersion: v1\ndata:\n cloud: ENC[AES256_GCM,data:ifpf4GSj3jk+40kBFs3/Uy0dzuz3KhUJFx2eY8WJZa641NDcLhbq53e3VPmwYANkYwKoN28CrlGlqUm8KGX69eH6HCgNEDjdcTfS/2hC729jZP2bM15owahvCtDaubiiMcPb3MeQV51x7yu1HsXO+JJ8+SMx1JGa/skKbENmGCsHH6Ah7YWuGnfaH636GHXJUaQXuQ==,iv:5AA7slnaJD+2rGLYaB3OMpLd3oJjL3wmJIM3XbfIDaA=,tag:DbeoVoOOJvTsNoq0Rt/PXw==,type:str]\nkind: Secret\nmetadata:\n name: cloud-credentials-wasabi\n namespace: velero\ntype: Opaque\nsops:\n kms: []\n gcp_kms: []\n azure_kv: []\n hc_vault: []\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMnRpejIzT1ZzcXlsa2ta\n a2lUeFVyZjBabEo5Mk9OaHd0WGJNS3krMmdnCjZHMGZYODFHdTU5VWU1M3lwaDRS\n OEhPMXQvSldCd3hOejhzaWJRd0lLZ0EKLS0tIGZLdTdsMk1SM3M2THRKaWw4dVlG\n SWRleUpjK2JTMzdSanp3dXdsUVpqL2sKLHkhM+tSaiMC6CBRz2n3cHLQIHqzQSFW\n Nz+m3Ott2Ov2h3oR1JhCRJGaSqrht/jBQykhCchxY4ds602bZfzG3Q==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2024-03-26T13:55:32Z\"\n mac: ENC[AES256_GCM,data:sdbXrEqCGCX001meZziH7cG2k9/gdRGkvUV+zGW/4jwsIc8oCuKPd1aAfn6a5c7MQH5JT3Z2+S2cpAOthaYUuPeKGL26do4D/Na470BHKn/QGkHJsB36MNgLOCzeHIPfWuto5rvIKQbrOcTvXnZx7R7pzZMTkeyFizbfQbkc4sk=,iv:Tv1m8fo+XP2/mkg84ZpKHx2b+PBXgmkqfBuHkdSNDCo=,tag:qwmctWBpPuSq3985p6GnEQ==,type:str]\n pgp: []\n encrypted_regex: ^(data|stringData|annotations|)$\n version: 3.8.1\n" }, { "path": "cluster/homelab/crds/external-snapshotter/crds.yaml", "content": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-csi/external-snapshotter/pull/1337\n controller-gen.kubebuilder.io/version: v0.15.0\n name: volumegroupsnapshotclasses.groupsnapshot.storage.k8s.io\nspec:\n group: groupsnapshot.storage.k8s.io\n names:\n kind: VolumeGroupSnapshotClass\n listKind: VolumeGroupSnapshotClassList\n plural: volumegroupsnapshotclasses\n shortNames:\n - vgsclass\n - vgsclasses\n singular: volumegroupsnapshotclass\n scope: Cluster\n versions:\n - additionalPrinterColumns:\n - jsonPath: .driver\n name: Driver\n type: string\n - description: Determines whether a VolumeGroupSnapshotContent created through\n the VolumeGroupSnapshotClass should be deleted when its bound VolumeGroupSnapshot\n is deleted.\n jsonPath: .deletionPolicy\n name: DeletionPolicy\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n deprecated: true\n name: v1beta1\n schema:\n openAPIV3Schema:\n description: |-\n VolumeGroupSnapshotClass specifies parameters that a underlying storage system\n uses when creating a volume group snapshot. A specific VolumeGroupSnapshotClass\n is used by specifying its name in a VolumeGroupSnapshot object.\n VolumeGroupSnapshotClasses are non-namespaced.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n deletionPolicy:\n description: |-\n DeletionPolicy determines whether a VolumeGroupSnapshotContent created\n through the VolumeGroupSnapshotClass should be deleted when its bound\n VolumeGroupSnapshot is deleted.\n Supported values are \"Retain\" and \"Delete\".\n \"Retain\" means that the VolumeGroupSnapshotContent and its physical group\n snapshot on underlying storage system are kept.\n \"Delete\" means that the VolumeGroupSnapshotContent and its physical group\n snapshot on underlying storage system are deleted.\n Required.\n enum:\n - Delete\n - Retain\n type: string\n driver:\n description: |-\n Driver is the name of the storage driver expected to handle this VolumeGroupSnapshotClass.\n Required.\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n parameters:\n additionalProperties:\n type: string\n description: |-\n Parameters is a key-value map with storage driver specific parameters for\n creating group snapshots.\n These values are opaque to Kubernetes and are passed directly to the driver.\n type: object\n required:\n - deletionPolicy\n - driver\n type: object\n served: true\n storage: false\n subresources: {}\n - additionalPrinterColumns:\n - jsonPath: .driver\n name: Driver\n type: string\n - description: Determines whether a VolumeGroupSnapshotContent created through\n the VolumeGroupSnapshotClass should be deleted when its bound VolumeGroupSnapshot\n is deleted.\n jsonPath: .deletionPolicy\n name: DeletionPolicy\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: |-\n VolumeGroupSnapshotClass specifies parameters that a underlying storage system\n uses when creating a volume group snapshot. A specific VolumeGroupSnapshotClass\n is used by specifying its name in a VolumeGroupSnapshot object.\n VolumeGroupSnapshotClasses are non-namespaced.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n deletionPolicy:\n description: |-\n DeletionPolicy determines whether a VolumeGroupSnapshotContent created\n through the VolumeGroupSnapshotClass should be deleted when its bound\n VolumeGroupSnapshot is deleted.\n Supported values are \"Retain\" and \"Delete\".\n \"Retain\" means that the VolumeGroupSnapshotContent and its physical group\n snapshot on underlying storage system are kept.\n \"Delete\" means that the VolumeGroupSnapshotContent and its physical group\n snapshot on underlying storage system are deleted.\n Required.\n enum:\n - Delete\n - Retain\n type: string\n x-kubernetes-validations:\n - message: deletionPolicy is immutable once set\n rule: self == oldSelf\n driver:\n description: |-\n Driver is the name of the storage driver expected to handle this VolumeGroupSnapshotClass.\n Required.\n type: string\n x-kubernetes-validations:\n - message: driver is immutable once set\n rule: self == oldSelf\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n parameters:\n additionalProperties:\n type: string\n description: |-\n Parameters is a key-value map with storage driver specific parameters for\n creating group snapshots.\n These values are opaque to Kubernetes and are passed directly to the driver.\n type: object\n x-kubernetes-validations:\n - message: parameters are immutable once set\n rule: self == oldSelf\n required:\n - deletionPolicy\n - driver\n type: object\n served: true\n storage: true\n subresources: {}\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-csi/external-snapshotter/pull/1337\n controller-gen.kubebuilder.io/version: v0.15.0\n name: volumegroupsnapshotcontents.groupsnapshot.storage.k8s.io\nspec:\n conversion:\n strategy: Webhook\n webhook:\n clientConfig:\n service:\n name: snapshot-conversion-webhook-service\n namespace: default\n path: /convert\n conversionReviewVersions:\n - v1\n group: groupsnapshot.storage.k8s.io\n names:\n kind: VolumeGroupSnapshotContent\n listKind: VolumeGroupSnapshotContentList\n plural: volumegroupsnapshotcontents\n shortNames:\n - vgsc\n - vgscs\n singular: volumegroupsnapshotcontent\n scope: Cluster\n versions:\n - additionalPrinterColumns:\n - description: Indicates if all the individual snapshots in the group are ready\n to be used to restore a group of volumes.\n jsonPath: .status.readyToUse\n name: ReadyToUse\n type: boolean\n - description: Determines whether this VolumeGroupSnapshotContent and its physical\n group snapshot on the underlying storage system should be deleted when its\n bound VolumeGroupSnapshot is deleted.\n jsonPath: .spec.deletionPolicy\n name: DeletionPolicy\n type: string\n - description: Name of the CSI driver used to create the physical group snapshot\n on the underlying storage system.\n jsonPath: .spec.driver\n name: Driver\n type: string\n - description: Name of the VolumeGroupSnapshotClass from which this group snapshot\n was (or will be) created.\n jsonPath: .spec.volumeGroupSnapshotClassName\n name: VolumeGroupSnapshotClass\n type: string\n - description: Namespace of the VolumeGroupSnapshot object to which this VolumeGroupSnapshotContent\n object is bound.\n jsonPath: .spec.volumeGroupSnapshotRef.namespace\n name: VolumeGroupSnapshotNamespace\n type: string\n - description: Name of the VolumeGroupSnapshot object to which this VolumeGroupSnapshotContent\n object is bound.\n jsonPath: .spec.volumeGroupSnapshotRef.name\n name: VolumeGroupSnapshot\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n deprecated: true\n name: v1beta1\n schema:\n openAPIV3Schema:\n description: |-\n VolumeGroupSnapshotContent represents the actual \"on-disk\" group snapshot object\n in the underlying storage system\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n Spec defines properties of a VolumeGroupSnapshotContent created by the underlying storage system.\n Required.\n properties:\n deletionPolicy:\n description: |-\n DeletionPolicy determines whether this VolumeGroupSnapshotContent and the\n physical group snapshot on the underlying storage system should be deleted\n when the bound VolumeGroupSnapshot is deleted.\n Supported values are \"Retain\" and \"Delete\".\n \"Retain\" means that the VolumeGroupSnapshotContent and its physical group\n snapshot on underlying storage system are kept.\n \"Delete\" means that the VolumeGroupSnapshotContent and its physical group\n snapshot on underlying storage system are deleted.\n For dynamically provisioned group snapshots, this field will automatically\n be filled in by the CSI snapshotter sidecar with the \"DeletionPolicy\" field\n defined in the corresponding VolumeGroupSnapshotClass.\n For pre-existing snapshots, users MUST specify this field when creating the\n VolumeGroupSnapshotContent object.\n Required.\n enum:\n - Delete\n - Retain\n type: string\n driver:\n description: |-\n Driver is the name of the CSI driver used to create the physical group snapshot on\n the underlying storage system.\n This MUST be the same as the name returned by the CSI GetPluginName() call for\n that driver.\n Required.\n type: string\n source:\n description: |-\n Source specifies whether the snapshot is (or should be) dynamically provisioned\n or already exists, and just requires a Kubernetes object representation.\n This field is immutable after creation.\n Required.\n properties:\n groupSnapshotHandles:\n description: |-\n GroupSnapshotHandles specifies the CSI \"group_snapshot_id\" of a pre-existing\n group snapshot and a list of CSI \"snapshot_id\" of pre-existing snapshots\n on the underlying storage system for which a Kubernetes object\n representation was (or should be) created.\n This field is immutable.\n properties:\n volumeGroupSnapshotHandle:\n description: |-\n VolumeGroupSnapshotHandle specifies the CSI \"group_snapshot_id\" of a pre-existing\n group snapshot on the underlying storage system for which a Kubernetes object\n representation was (or should be) created.\n This field is immutable.\n Required.\n type: string\n volumeSnapshotHandles:\n description: |-\n VolumeSnapshotHandles is a list of CSI \"snapshot_id\" of pre-existing\n snapshots on the underlying storage system for which Kubernetes objects\n representation were (or should be) created.\n This field is immutable.\n Required.\n items:\n type: string\n type: array\n required:\n - volumeGroupSnapshotHandle\n - volumeSnapshotHandles\n type: object\n x-kubernetes-validations:\n - message: groupSnapshotHandles is immutable\n rule: self == oldSelf\n volumeHandles:\n description: |-\n VolumeHandles is a list of volume handles on the backend to be snapshotted\n together. It is specified for dynamic provisioning of the VolumeGroupSnapshot.\n This field is immutable.\n items:\n type: string\n type: array\n x-kubernetes-validations:\n - message: volumeHandles is immutable\n rule: self == oldSelf\n type: object\n x-kubernetes-validations:\n - message: volumeHandles is required once set\n rule: '!has(oldSelf.volumeHandles) || has(self.volumeHandles)'\n - message: groupSnapshotHandles is required once set\n rule: '!has(oldSelf.groupSnapshotHandles) || has(self.groupSnapshotHandles)'\n - message: exactly one of volumeHandles and groupSnapshotHandles must\n be set\n rule: (has(self.volumeHandles) && !has(self.groupSnapshotHandles))\n || (!has(self.volumeHandles) && has(self.groupSnapshotHandles))\n volumeGroupSnapshotClassName:\n description: |-\n VolumeGroupSnapshotClassName is the name of the VolumeGroupSnapshotClass from\n which this group snapshot was (or will be) created.\n Note that after provisioning, the VolumeGroupSnapshotClass may be deleted or\n recreated with different set of values, and as such, should not be referenced\n post-snapshot creation.\n For dynamic provisioning, this field must be set.\n This field may be unset for pre-provisioned snapshots.\n type: string\n volumeGroupSnapshotRef:\n description: |-\n VolumeGroupSnapshotRef specifies the VolumeGroupSnapshot object to which this\n VolumeGroupSnapshotContent object is bound.\n VolumeGroupSnapshot.Spec.VolumeGroupSnapshotContentName field must reference to\n this VolumeGroupSnapshotContent's name for the bidirectional binding to be valid.\n For a pre-existing VolumeGroupSnapshotContent object, name and namespace of the\n VolumeGroupSnapshot object MUST be provided for binding to happen.\n This field is immutable after creation.\n Required.\n properties:\n apiVersion:\n description: API version of the referent.\n type: string\n fieldPath:\n description: |-\n If referring to a piece of an object instead of an entire object, this string\n should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].\n For example, if the object reference is to a container within a pod, this would take on a value like:\n \"spec.containers{name}\" (where \"name\" refers to the name of the container that triggered\n the event) or if no container name is specified \"spec.containers[2]\" (container with\n index 2 in this pod). This syntax is chosen only to have some well-defined way of\n referencing a part of an object.\n TODO: this design is not final and this field is subject to change in the future.\n type: string\n kind:\n description: |-\n Kind of the referent.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n name:\n description: |-\n Name of the referent.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\n type: string\n namespace:\n description: |-\n Namespace of the referent.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/\n type: string\n resourceVersion:\n description: |-\n Specific resourceVersion to which this reference is made, if any.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency\n type: string\n uid:\n description: |-\n UID of the referent.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids\n type: string\n type: object\n x-kubernetes-map-type: atomic\n x-kubernetes-validations:\n - message: both volumeGroupSnapshotRef.name and volumeGroupSnapshotRef.namespace\n must be set\n rule: has(self.name) && has(self.__namespace__)\n required:\n - deletionPolicy\n - driver\n - source\n - volumeGroupSnapshotRef\n type: object\n status:\n description: status represents the current information of a group snapshot.\n properties:\n creationTime:\n description: |-\n CreationTime is the timestamp when the point-in-time group snapshot is taken\n by the underlying storage system.\n If not specified, it indicates the creation time is unknown.\n If not specified, it means the readiness of a group snapshot is unknown.\n The format of this field is a Unix nanoseconds time encoded as an int64.\n On Unix, the command date +%s%N returns the current time in nanoseconds\n since 1970-01-01 00:00:00 UTC.\n This field is the source for the CreationTime field in VolumeGroupSnapshotStatus\n format: date-time\n type: string\n error:\n description: |-\n Error is the last observed error during group snapshot creation, if any.\n Upon success after retry, this error field will be cleared.\n properties:\n message:\n description: |-\n message is a string detailing the encountered error during snapshot\n creation if specified.\n NOTE: message may be logged, and it should not contain sensitive\n information.\n type: string\n time:\n description: time is the timestamp when the error was encountered.\n format: date-time\n type: string\n type: object\n readyToUse:\n description: |-\n ReadyToUse indicates if all the individual snapshots in the group are ready to be\n used to restore a group of volumes.\n ReadyToUse becomes true when ReadyToUse of all individual snapshots become true.\n type: boolean\n volumeGroupSnapshotHandle:\n description: |-\n VolumeGroupSnapshotHandle is a unique id returned by the CSI driver\n to identify the VolumeGroupSnapshot on the storage system.\n If a storage system does not provide such an id, the\n CSI driver can choose to return the VolumeGroupSnapshot name.\n type: string\n volumeSnapshotHandlePairList:\n description: |-\n VolumeSnapshotHandlePairList is a list of CSI \"volume_id\" and \"snapshot_id\"\n pair returned by the CSI driver to identify snapshots and their source volumes\n on the storage system.\n items:\n description: VolumeSnapshotHandlePair defines a pair of a source\n volume handle and a snapshot handle\n properties:\n snapshotHandle:\n description: |-\n SnapshotHandle is a unique id returned by the CSI driver to identify a volume\n snapshot on the storage system\n Required.\n type: string\n volumeHandle:\n description: |-\n VolumeHandle is a unique id returned by the CSI driver to identify a volume\n on the storage system\n Required.\n type: string\n required:\n - snapshotHandle\n - volumeHandle\n type: object\n type: array\n type: object\n required:\n - spec\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n - additionalPrinterColumns:\n - description: Indicates if all the individual snapshots in the group are ready\n to be used to restore a group of volumes.\n jsonPath: .status.readyToUse\n name: ReadyToUse\n type: boolean\n - description: Determines whether this VolumeGroupSnapshotContent and its physical\n group snapshot on the underlying storage system should be deleted when its\n bound VolumeGroupSnapshot is deleted.\n jsonPath: .spec.deletionPolicy\n name: DeletionPolicy\n type: string\n - description: Name of the CSI driver used to create the physical group snapshot\n on the underlying storage system.\n jsonPath: .spec.driver\n name: Driver\n type: string\n - description: Name of the VolumeGroupSnapshotClass from which this group snapshot\n was (or will be) created.\n jsonPath: .spec.volumeGroupSnapshotClassName\n name: VolumeGroupSnapshotClass\n type: string\n - description: Namespace of the VolumeGroupSnapshot object to which this VolumeGroupSnapshotContent\n object is bound.\n jsonPath: .spec.volumeGroupSnapshotRef.namespace\n name: VolumeGroupSnapshotNamespace\n type: string\n - description: Name of the VolumeGroupSnapshot object to which this VolumeGroupSnapshotContent\n object is bound.\n jsonPath: .spec.volumeGroupSnapshotRef.name\n name: VolumeGroupSnapshot\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: |-\n VolumeGroupSnapshotContent represents the actual \"on-disk\" group snapshot object\n in the underlying storage system\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n Spec defines properties of a VolumeGroupSnapshotContent created by the underlying storage system.\n Required.\n properties:\n deletionPolicy:\n description: |-\n DeletionPolicy determines whether this VolumeGroupSnapshotContent and the\n physical group snapshot on the underlying storage system should be deleted\n when the bound VolumeGroupSnapshot is deleted.\n Supported values are \"Retain\" and \"Delete\".\n \"Retain\" means that the VolumeGroupSnapshotContent and its physical group\n snapshot on underlying storage system are kept.\n \"Delete\" means that the VolumeGroupSnapshotContent and its physical group\n snapshot on underlying storage system are deleted.\n For dynamically provisioned group snapshots, this field will automatically\n be filled in by the CSI snapshotter sidecar with the \"DeletionPolicy\" field\n defined in the corresponding VolumeGroupSnapshotClass.\n For pre-existing snapshots, users MUST specify this field when creating the\n VolumeGroupSnapshotContent object.\n Required.\n enum:\n - Delete\n - Retain\n type: string\n driver:\n description: |-\n Driver is the name of the CSI driver used to create the physical group snapshot on\n the underlying storage system.\n This MUST be the same as the name returned by the CSI GetPluginName() call for\n that driver.\n Required.\n type: string\n x-kubernetes-validations:\n - message: driver is immutable once set\n rule: self == oldSelf\n source:\n description: |-\n Source specifies whether the snapshot is (or should be) dynamically provisioned\n or already exists, and just requires a Kubernetes object representation.\n This field is immutable after creation.\n Required.\n properties:\n groupSnapshotHandles:\n description: |-\n GroupSnapshotHandles specifies the CSI \"group_snapshot_id\" of a pre-existing\n group snapshot and a list of CSI \"snapshot_id\" of pre-existing snapshots\n on the underlying storage system for which a Kubernetes object\n representation was (or should be) created.\n This field is immutable.\n properties:\n volumeGroupSnapshotHandle:\n description: |-\n VolumeGroupSnapshotHandle specifies the CSI \"group_snapshot_id\" of a pre-existing\n group snapshot on the underlying storage system for which a Kubernetes object\n representation was (or should be) created.\n This field is immutable.\n Required.\n type: string\n volumeSnapshotHandles:\n description: |-\n VolumeSnapshotHandles is a list of CSI \"snapshot_id\" of pre-existing\n snapshots on the underlying storage system for which Kubernetes objects\n representation were (or should be) created.\n This field is immutable.\n Required.\n items:\n type: string\n type: array\n required:\n - volumeGroupSnapshotHandle\n - volumeSnapshotHandles\n type: object\n x-kubernetes-validations:\n - message: groupSnapshotHandles is immutable\n rule: self == oldSelf\n volumeHandles:\n description: |-\n VolumeHandles is a list of volume handles on the backend to be snapshotted\n together. It is specified for dynamic provisioning of the VolumeGroupSnapshot.\n This field is immutable.\n items:\n type: string\n type: array\n x-kubernetes-validations:\n - message: volumeHandles is immutable\n rule: self == oldSelf\n type: object\n x-kubernetes-validations:\n - message: volumeHandles is required once set\n rule: '!has(oldSelf.volumeHandles) || has(self.volumeHandles)'\n - message: groupSnapshotHandles is required once set\n rule: '!has(oldSelf.groupSnapshotHandles) || has(self.groupSnapshotHandles)'\n - message: exactly one of volumeHandles and groupSnapshotHandles must\n be set\n rule: (has(self.volumeHandles) && !has(self.groupSnapshotHandles))\n || (!has(self.volumeHandles) && has(self.groupSnapshotHandles))\n volumeGroupSnapshotClassName:\n description: |-\n VolumeGroupSnapshotClassName is the name of the VolumeGroupSnapshotClass from\n which this group snapshot was (or will be) created.\n Note that after provisioning, the VolumeGroupSnapshotClass may be deleted or\n recreated with different set of values, and as such, should not be referenced\n post-snapshot creation.\n For dynamic provisioning, this field must be set.\n This field may be unset for pre-provisioned snapshots.\n type: string\n x-kubernetes-validations:\n - message: volumeGroupSnapshotClassName is immutable once set\n rule: self == oldSelf\n volumeGroupSnapshotRef:\n description: |-\n VolumeGroupSnapshotRef specifies the VolumeGroupSnapshot object to which this\n VolumeGroupSnapshotContent object is bound.\n VolumeGroupSnapshot.Spec.VolumeGroupSnapshotContentName field must reference to\n this VolumeGroupSnapshotContent's name for the bidirectional binding to be valid.\n For a pre-existing VolumeGroupSnapshotContent object, name and namespace of the\n VolumeGroupSnapshot object MUST be provided for binding to happen.\n This field is immutable after creation.\n Required.\n properties:\n apiVersion:\n description: API version of the referent.\n type: string\n fieldPath:\n description: |-\n If referring to a piece of an object instead of an entire object, this string\n should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].\n For example, if the object reference is to a container within a pod, this would take on a value like:\n \"spec.containers{name}\" (where \"name\" refers to the name of the container that triggered\n the event) or if no container name is specified \"spec.containers[2]\" (container with\n index 2 in this pod). This syntax is chosen only to have some well-defined way of\n referencing a part of an object.\n TODO: this design is not final and this field is subject to change in the future.\n type: string\n kind:\n description: |-\n Kind of the referent.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n name:\n description: |-\n Name of the referent.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\n type: string\n namespace:\n description: |-\n Namespace of the referent.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/\n type: string\n resourceVersion:\n description: |-\n Specific resourceVersion to which this reference is made, if any.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency\n type: string\n uid:\n description: |-\n UID of the referent.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids\n type: string\n type: object\n x-kubernetes-map-type: atomic\n x-kubernetes-validations:\n - message: both volumeGroupSnapshotRef.name and volumeGroupSnapshotRef.namespace\n must be set\n rule: has(self.name) && has(self.__namespace__)\n - message: volumeGroupSnapshotRef.name and volumeGroupSnapshotRef.namespace\n are immutable\n rule: self.name == oldSelf.name && self.__namespace__ == oldSelf.__namespace__\n - message: volumeGroupSnapshotRef.uid is immutable once set\n rule: '!has(oldSelf.uid) || (has(self.uid) && self.uid == oldSelf.uid)'\n required:\n - deletionPolicy\n - driver\n - source\n - volumeGroupSnapshotRef\n type: object\n status:\n description: status represents the current information of a group snapshot.\n properties:\n creationTime:\n description: |-\n CreationTime is the timestamp when the point-in-time group snapshot is taken\n by the underlying storage system.\n If not specified, it indicates the creation time is unknown.\n If not specified, it means the readiness of a group snapshot is unknown.\n This field is the source for the CreationTime field in VolumeGroupSnapshotStatus\n format: date-time\n type: string\n error:\n description: |-\n Error is the last observed error during group snapshot creation, if any.\n Upon success after retry, this error field will be cleared.\n properties:\n message:\n description: |-\n message is a string detailing the encountered error during snapshot\n creation if specified.\n NOTE: message may be logged, and it should not contain sensitive\n information.\n type: string\n time:\n description: time is the timestamp when the error was encountered.\n format: date-time\n type: string\n type: object\n readyToUse:\n description: |-\n ReadyToUse indicates if all the individual snapshots in the group are ready to be\n used to restore a group of volumes.\n ReadyToUse becomes true when ReadyToUse of all individual snapshots become true.\n type: boolean\n volumeGroupSnapshotHandle:\n description: |-\n VolumeGroupSnapshotHandle is a unique id returned by the CSI driver\n to identify the VolumeGroupSnapshot on the storage system.\n If a storage system does not provide such an id, the\n CSI driver can choose to return the VolumeGroupSnapshot name.\n type: string\n x-kubernetes-validations:\n - message: volumeGroupSnapshotHandle is immutable once set\n rule: self == oldSelf\n volumeSnapshotInfoList:\n description: |-\n This field is introduced in v1beta2\n It is replacing VolumeSnapshotHandlePairList\n VolumeSnapshotInfoList is a list of snapshot information returned by\n by the CSI driver to identify snapshots on the storage system.\n items:\n description: |-\n The VolumeSnapshotInfo struct is added in v1beta2\n VolumeSnapshotInfo contains information for a snapshot\n properties:\n creationTime:\n description: |-\n creationTime is the timestamp when the point-in-time snapshot is taken\n by the underlying storage system.\n format: int64\n type: integer\n readyToUse:\n description: ReadyToUse indicates if the snapshot is ready to\n be used to restore a volume.\n type: boolean\n restoreSize:\n description: |-\n RestoreSize represents the minimum size of volume required to create a volume\n from this snapshot.\n format: int64\n type: integer\n snapshotHandle:\n description: SnapshotHandle is the CSI \"snapshot_id\" of this\n snapshot on the underlying storage system.\n type: string\n volumeHandle:\n description: |-\n VolumeHandle specifies the CSI \"volume_id\" of the volume from which this snapshot\n was taken from.\n type: string\n type: object\n type: array\n type: object\n required:\n - spec\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-csi/external-snapshotter/pull/1337\n controller-gen.kubebuilder.io/version: v0.15.0\n name: volumegroupsnapshots.groupsnapshot.storage.k8s.io\nspec:\n group: groupsnapshot.storage.k8s.io\n names:\n kind: VolumeGroupSnapshot\n listKind: VolumeGroupSnapshotList\n plural: volumegroupsnapshots\n shortNames:\n - vgs\n singular: volumegroupsnapshot\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - description: Indicates if all the individual snapshots in the group are ready\n to be used to restore a group of volumes.\n jsonPath: .status.readyToUse\n name: ReadyToUse\n type: boolean\n - description: The name of the VolumeGroupSnapshotClass requested by the VolumeGroupSnapshot.\n jsonPath: .spec.volumeGroupSnapshotClassName\n name: VolumeGroupSnapshotClass\n type: string\n - description: Name of the VolumeGroupSnapshotContent object to which the VolumeGroupSnapshot\n object intends to bind to. Please note that verification of binding actually\n requires checking both VolumeGroupSnapshot and VolumeGroupSnapshotContent\n to ensure both are pointing at each other. Binding MUST be verified prior\n to usage of this object.\n jsonPath: .status.boundVolumeGroupSnapshotContentName\n name: VolumeGroupSnapshotContent\n type: string\n - description: Timestamp when the point-in-time group snapshot was taken by the\n underlying storage system.\n jsonPath: .status.creationTime\n name: CreationTime\n type: date\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n deprecated: true\n name: v1beta1\n schema:\n openAPIV3Schema:\n description: |-\n VolumeGroupSnapshot is a user's request for creating either a point-in-time\n group snapshot or binding to a pre-existing group snapshot.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n Spec defines the desired characteristics of a group snapshot requested by a user.\n Required.\n properties:\n source:\n description: |-\n Source specifies where a group snapshot will be created from.\n This field is immutable after creation.\n Required.\n properties:\n selector:\n description: |-\n Selector is a label query over persistent volume claims that are to be\n grouped together for snapshotting.\n This labelSelector will be used to match the label added to a PVC.\n If the label is added or removed to a volume after a group snapshot\n is created, the existing group snapshots won't be modified.\n Once a VolumeGroupSnapshotContent is created and the sidecar starts to process\n it, the volume list will not change with retries.\n properties:\n matchExpressions:\n description: matchExpressions is a list of label selector\n requirements. The requirements are ANDed.\n items:\n description: |-\n A label selector requirement is a selector that contains values, a key, and an operator that\n relates the key and values.\n properties:\n key:\n description: key is the label key that the selector\n applies to.\n type: string\n operator:\n description: |-\n operator represents a key's relationship to a set of values.\n Valid operators are In, NotIn, Exists and DoesNotExist.\n type: string\n values:\n description: |-\n values is an array of string values. If the operator is In or NotIn,\n the values array must be non-empty. If the operator is Exists or DoesNotExist,\n the values array must be empty. This array is replaced during a strategic\n merge patch.\n items:\n type: string\n type: array\n x-kubernetes-list-type: atomic\n required:\n - key\n - operator\n type: object\n type: array\n x-kubernetes-list-type: atomic\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n type: object\n type: object\n x-kubernetes-map-type: atomic\n x-kubernetes-validations:\n - message: selector is immutable\n rule: self == oldSelf\n volumeGroupSnapshotContentName:\n description: |-\n VolumeGroupSnapshotContentName specifies the name of a pre-existing VolumeGroupSnapshotContent\n object representing an existing volume group snapshot.\n This field should be set if the volume group snapshot already exists and\n only needs a representation in Kubernetes.\n This field is immutable.\n type: string\n x-kubernetes-validations:\n - message: volumeGroupSnapshotContentName is immutable\n rule: self == oldSelf\n type: object\n x-kubernetes-validations:\n - message: selector is required once set\n rule: '!has(oldSelf.selector) || has(self.selector)'\n - message: volumeGroupSnapshotContentName is required once set\n rule: '!has(oldSelf.volumeGroupSnapshotContentName) || has(self.volumeGroupSnapshotContentName)'\n - message: exactly one of selector and volumeGroupSnapshotContentName\n must be set\n rule: (has(self.selector) && !has(self.volumeGroupSnapshotContentName))\n || (!has(self.selector) && has(self.volumeGroupSnapshotContentName))\n volumeGroupSnapshotClassName:\n description: |-\n VolumeGroupSnapshotClassName is the name of the VolumeGroupSnapshotClass\n requested by the VolumeGroupSnapshot.\n VolumeGroupSnapshotClassName may be left nil to indicate that the default\n class will be used.\n Empty string is not allowed for this field.\n type: string\n x-kubernetes-validations:\n - message: volumeGroupSnapshotClassName must not be the empty string\n when set\n rule: size(self) > 0\n required:\n - source\n type: object\n status:\n description: |-\n Status represents the current information of a group snapshot.\n Consumers must verify binding between VolumeGroupSnapshot and\n VolumeGroupSnapshotContent objects is successful (by validating that both\n VolumeGroupSnapshot and VolumeGroupSnapshotContent point to each other) before\n using this object.\n properties:\n boundVolumeGroupSnapshotContentName:\n description: |-\n BoundVolumeGroupSnapshotContentName is the name of the VolumeGroupSnapshotContent\n object to which this VolumeGroupSnapshot object intends to bind to.\n If not specified, it indicates that the VolumeGroupSnapshot object has not\n been successfully bound to a VolumeGroupSnapshotContent object yet.\n NOTE: To avoid possible security issues, consumers must verify binding between\n VolumeGroupSnapshot and VolumeGroupSnapshotContent objects is successful\n (by validating that both VolumeGroupSnapshot and VolumeGroupSnapshotContent\n point at each other) before using this object.\n type: string\n creationTime:\n description: |-\n CreationTime is the timestamp when the point-in-time group snapshot is taken\n by the underlying storage system.\n If not specified, it may indicate that the creation time of the group snapshot\n is unknown.\n The format of this field is a Unix nanoseconds time encoded as an int64.\n On Unix, the command date +%s%N returns the current time in nanoseconds\n since 1970-01-01 00:00:00 UTC.\n This field is updated based on the CreationTime field in VolumeGroupSnapshotContentStatus\n format: date-time\n type: string\n error:\n description: |-\n Error is the last observed error during group snapshot creation, if any.\n This field could be helpful to upper level controllers (i.e., application\n controller) to decide whether they should continue on waiting for the group\n snapshot to be created based on the type of error reported.\n The snapshot controller will keep retrying when an error occurs during the\n group snapshot creation. Upon success, this error field will be cleared.\n properties:\n message:\n description: |-\n message is a string detailing the encountered error during snapshot\n creation if specified.\n NOTE: message may be logged, and it should not contain sensitive\n information.\n type: string\n time:\n description: time is the timestamp when the error was encountered.\n format: date-time\n type: string\n type: object\n readyToUse:\n description: |-\n ReadyToUse indicates if all the individual snapshots in the group are ready\n to be used to restore a group of volumes.\n ReadyToUse becomes true when ReadyToUse of all individual snapshots become true.\n If not specified, it means the readiness of a group snapshot is unknown.\n type: boolean\n type: object\n required:\n - spec\n type: object\n served: true\n storage: false\n subresources:\n status: {}\n - additionalPrinterColumns:\n - description: Indicates if all the individual snapshots in the group are ready\n to be used to restore a group of volumes.\n jsonPath: .status.readyToUse\n name: ReadyToUse\n type: boolean\n - description: The name of the VolumeGroupSnapshotClass requested by the VolumeGroupSnapshot.\n jsonPath: .spec.volumeGroupSnapshotClassName\n name: VolumeGroupSnapshotClass\n type: string\n - description: Name of the VolumeGroupSnapshotContent object to which the VolumeGroupSnapshot\n object intends to bind to. Please note that verification of binding actually\n requires checking both VolumeGroupSnapshot and VolumeGroupSnapshotContent\n to ensure both are pointing at each other. Binding MUST be verified prior\n to usage of this object.\n jsonPath: .status.boundVolumeGroupSnapshotContentName\n name: VolumeGroupSnapshotContent\n type: string\n - description: Timestamp when the point-in-time group snapshot was taken by the\n underlying storage system.\n jsonPath: .status.creationTime\n name: CreationTime\n type: date\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1beta2\n schema:\n openAPIV3Schema:\n description: |-\n VolumeGroupSnapshot is a user's request for creating either a point-in-time\n group snapshot or binding to a pre-existing group snapshot.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n Spec defines the desired characteristics of a group snapshot requested by a user.\n Required.\n properties:\n source:\n description: |-\n Source specifies where a group snapshot will be created from.\n This field is immutable after creation.\n Required.\n properties:\n selector:\n description: |-\n Selector is a label query over persistent volume claims that are to be\n grouped together for snapshotting.\n This labelSelector will be used to match the label added to a PVC.\n If the label is added or removed to a volume after a group snapshot\n is created, the existing group snapshots won't be modified.\n Once a VolumeGroupSnapshotContent is created and the sidecar starts to process\n it, the volume list will not change with retries.\n properties:\n matchExpressions:\n description: matchExpressions is a list of label selector\n requirements. The requirements are ANDed.\n items:\n description: |-\n A label selector requirement is a selector that contains values, a key, and an operator that\n relates the key and values.\n properties:\n key:\n description: key is the label key that the selector\n applies to.\n type: string\n operator:\n description: |-\n operator represents a key's relationship to a set of values.\n Valid operators are In, NotIn, Exists and DoesNotExist.\n type: string\n values:\n description: |-\n values is an array of string values. If the operator is In or NotIn,\n the values array must be non-empty. If the operator is Exists or DoesNotExist,\n the values array must be empty. This array is replaced during a strategic\n merge patch.\n items:\n type: string\n type: array\n x-kubernetes-list-type: atomic\n required:\n - key\n - operator\n type: object\n type: array\n x-kubernetes-list-type: atomic\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n type: object\n type: object\n x-kubernetes-map-type: atomic\n x-kubernetes-validations:\n - message: selector is immutable\n rule: self == oldSelf\n volumeGroupSnapshotContentName:\n description: |-\n VolumeGroupSnapshotContentName specifies the name of a pre-existing VolumeGroupSnapshotContent\n object representing an existing volume group snapshot.\n This field should be set if the volume group snapshot already exists and\n only needs a representation in Kubernetes.\n This field is immutable.\n type: string\n x-kubernetes-validations:\n - message: volumeGroupSnapshotContentName is immutable\n rule: self == oldSelf\n type: object\n x-kubernetes-validations:\n - message: selector is required once set\n rule: '!has(oldSelf.selector) || has(self.selector)'\n - message: volumeGroupSnapshotContentName is required once set\n rule: '!has(oldSelf.volumeGroupSnapshotContentName) || has(self.volumeGroupSnapshotContentName)'\n - message: exactly one of selector and volumeGroupSnapshotContentName\n must be set\n rule: (has(self.selector) && !has(self.volumeGroupSnapshotContentName))\n || (!has(self.selector) && has(self.volumeGroupSnapshotContentName))\n volumeGroupSnapshotClassName:\n description: |-\n VolumeGroupSnapshotClassName is the name of the VolumeGroupSnapshotClass\n requested by the VolumeGroupSnapshot.\n VolumeGroupSnapshotClassName may be left nil to indicate that the default\n class will be used.\n Empty string is not allowed for this field.\n type: string\n x-kubernetes-validations:\n - message: volumeGroupSnapshotClassName must not be the empty string\n when set\n rule: size(self) > 0\n required:\n - source\n type: object\n status:\n description: |-\n Status represents the current information of a group snapshot.\n Consumers must verify binding between VolumeGroupSnapshot and\n VolumeGroupSnapshotContent objects is successful (by validating that both\n VolumeGroupSnapshot and VolumeGroupSnapshotContent point to each other) before\n using this object.\n properties:\n boundVolumeGroupSnapshotContentName:\n description: |-\n BoundVolumeGroupSnapshotContentName is the name of the VolumeGroupSnapshotContent\n object to which this VolumeGroupSnapshot object intends to bind to.\n If not specified, it indicates that the VolumeGroupSnapshot object has not\n been successfully bound to a VolumeGroupSnapshotContent object yet.\n NOTE: To avoid possible security issues, consumers must verify binding between\n VolumeGroupSnapshot and VolumeGroupSnapshotContent objects is successful\n (by validating that both VolumeGroupSnapshot and VolumeGroupSnapshotContent\n point at each other) before using this object.\n type: string\n x-kubernetes-validations:\n - message: boundVolumeGroupSnapshotContentName is immutable once set\n rule: self == oldSelf\n creationTime:\n description: |-\n CreationTime is the timestamp when the point-in-time group snapshot is taken\n by the underlying storage system.\n If not specified, it may indicate that the creation time of the group snapshot\n is unknown.\n This field is updated based on the CreationTime field in VolumeGroupSnapshotContentStatus\n format: date-time\n type: string\n error:\n description: |-\n Error is the last observed error during group snapshot creation, if any.\n This field could be helpful to upper level controllers (i.e., application\n controller) to decide whether they should continue on waiting for the group\n snapshot to be created based on the type of error reported.\n The snapshot controller will keep retrying when an error occurs during the\n group snapshot creation. Upon success, this error field will be cleared.\n properties:\n message:\n description: |-\n message is a string detailing the encountered error during snapshot\n creation if specified.\n NOTE: message may be logged, and it should not contain sensitive\n information.\n type: string\n time:\n description: time is the timestamp when the error was encountered.\n format: date-time\n type: string\n type: object\n readyToUse:\n description: |-\n ReadyToUse indicates if all the individual snapshots in the group are ready\n to be used to restore a group of volumes.\n ReadyToUse becomes true when ReadyToUse of all individual snapshots become true.\n If not specified, it means the readiness of a group snapshot is unknown.\n type: boolean\n type: object\n required:\n - spec\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-csi/external-snapshotter/pull/814\n controller-gen.kubebuilder.io/version: v0.15.0\n name: volumesnapshotclasses.snapshot.storage.k8s.io\nspec:\n group: snapshot.storage.k8s.io\n names:\n kind: VolumeSnapshotClass\n listKind: VolumeSnapshotClassList\n plural: volumesnapshotclasses\n shortNames:\n - vsclass\n - vsclasses\n singular: volumesnapshotclass\n scope: Cluster\n versions:\n - additionalPrinterColumns:\n - jsonPath: .driver\n name: Driver\n type: string\n - description: Determines whether a VolumeSnapshotContent created through the\n VolumeSnapshotClass should be deleted when its bound VolumeSnapshot is deleted.\n jsonPath: .deletionPolicy\n name: DeletionPolicy\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1\n schema:\n openAPIV3Schema:\n description: |-\n VolumeSnapshotClass specifies parameters that a underlying storage system uses when\n creating a volume snapshot. A specific VolumeSnapshotClass is used by specifying its\n name in a VolumeSnapshot object.\n VolumeSnapshotClasses are non-namespaced\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n deletionPolicy:\n description: |-\n deletionPolicy determines whether a VolumeSnapshotContent created through\n the VolumeSnapshotClass should be deleted when its bound VolumeSnapshot is deleted.\n Supported values are \"Retain\" and \"Delete\".\n \"Retain\" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are kept.\n \"Delete\" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are deleted.\n Required.\n enum:\n - Delete\n - Retain\n type: string\n driver:\n description: |-\n driver is the name of the storage driver that handles this VolumeSnapshotClass.\n Required.\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n parameters:\n additionalProperties:\n type: string\n description: |-\n parameters is a key-value map with storage driver specific parameters for creating snapshots.\n These values are opaque to Kubernetes.\n type: object\n required:\n - deletionPolicy\n - driver\n type: object\n served: true\n storage: true\n subresources: {}\n - additionalPrinterColumns:\n - jsonPath: .driver\n name: Driver\n type: string\n - description: Determines whether a VolumeSnapshotContent created through the\n VolumeSnapshotClass should be deleted when its bound VolumeSnapshot is deleted.\n jsonPath: .deletionPolicy\n name: DeletionPolicy\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n deprecated: true\n deprecationWarning: snapshot.storage.k8s.io/v1beta1 VolumeSnapshotClass is deprecated;\n use snapshot.storage.k8s.io/v1 VolumeSnapshotClass\n name: v1beta1\n schema:\n openAPIV3Schema:\n description: VolumeSnapshotClass specifies parameters that a underlying storage\n system uses when creating a volume snapshot. A specific VolumeSnapshotClass\n is used by specifying its name in a VolumeSnapshot object. VolumeSnapshotClasses\n are non-namespaced\n properties:\n apiVersion:\n description: 'APIVersion defines the versioned schema of this representation\n of an object. Servers should convert recognized schemas to the latest\n internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n type: string\n deletionPolicy:\n description: deletionPolicy determines whether a VolumeSnapshotContent\n created through the VolumeSnapshotClass should be deleted when its bound\n VolumeSnapshot is deleted. Supported values are \"Retain\" and \"Delete\".\n \"Retain\" means that the VolumeSnapshotContent and its physical snapshot\n on underlying storage system are kept. \"Delete\" means that the VolumeSnapshotContent\n and its physical snapshot on underlying storage system are deleted.\n Required.\n enum:\n - Delete\n - Retain\n type: string\n driver:\n description: driver is the name of the storage driver that handles this\n VolumeSnapshotClass. Required.\n type: string\n kind:\n description: 'Kind is a string value representing the REST resource this\n object represents. Servers may infer this from the endpoint the client\n submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n type: string\n parameters:\n additionalProperties:\n type: string\n description: parameters is a key-value map with storage driver specific\n parameters for creating snapshots. These values are opaque to Kubernetes.\n type: object\n required:\n - deletionPolicy\n - driver\n type: object\n served: false\n storage: false\n subresources: {}\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: []\n storedVersions: []\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-csi/external-snapshotter/pull/955\n controller-gen.kubebuilder.io/version: v0.15.0\n name: volumesnapshotcontents.snapshot.storage.k8s.io\nspec:\n group: snapshot.storage.k8s.io\n names:\n kind: VolumeSnapshotContent\n listKind: VolumeSnapshotContentList\n plural: volumesnapshotcontents\n shortNames:\n - vsc\n - vscs\n singular: volumesnapshotcontent\n scope: Cluster\n versions:\n - additionalPrinterColumns:\n - description: Indicates if the snapshot is ready to be used to restore a volume.\n jsonPath: .status.readyToUse\n name: ReadyToUse\n type: boolean\n - description: Represents the complete size of the snapshot in bytes\n jsonPath: .status.restoreSize\n name: RestoreSize\n type: integer\n - description: Determines whether this VolumeSnapshotContent and its physical\n snapshot on the underlying storage system should be deleted when its bound\n VolumeSnapshot is deleted.\n jsonPath: .spec.deletionPolicy\n name: DeletionPolicy\n type: string\n - description: Name of the CSI driver used to create the physical snapshot on\n the underlying storage system.\n jsonPath: .spec.driver\n name: Driver\n type: string\n - description: Name of the VolumeSnapshotClass to which this snapshot belongs.\n jsonPath: .spec.volumeSnapshotClassName\n name: VolumeSnapshotClass\n type: string\n - description: Name of the VolumeSnapshot object to which this VolumeSnapshotContent\n object is bound.\n jsonPath: .spec.volumeSnapshotRef.name\n name: VolumeSnapshot\n type: string\n - description: Namespace of the VolumeSnapshot object to which this VolumeSnapshotContent\n object is bound.\n jsonPath: .spec.volumeSnapshotRef.namespace\n name: VolumeSnapshotNamespace\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1\n schema:\n openAPIV3Schema:\n description: |-\n VolumeSnapshotContent represents the actual \"on-disk\" snapshot object in the\n underlying storage system\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n spec defines properties of a VolumeSnapshotContent created by the underlying storage system.\n Required.\n properties:\n deletionPolicy:\n description: |-\n deletionPolicy determines whether this VolumeSnapshotContent and its physical snapshot on\n the underlying storage system should be deleted when its bound VolumeSnapshot is deleted.\n Supported values are \"Retain\" and \"Delete\".\n \"Retain\" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are kept.\n \"Delete\" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are deleted.\n For dynamically provisioned snapshots, this field will automatically be filled in by the\n CSI snapshotter sidecar with the \"DeletionPolicy\" field defined in the corresponding\n VolumeSnapshotClass.\n For pre-existing snapshots, users MUST specify this field when creating the\n VolumeSnapshotContent object.\n Required.\n enum:\n - Delete\n - Retain\n type: string\n driver:\n description: |-\n driver is the name of the CSI driver used to create the physical snapshot on\n the underlying storage system.\n This MUST be the same as the name returned by the CSI GetPluginName() call for\n that driver.\n Required.\n type: string\n source:\n description: |-\n source specifies whether the snapshot is (or should be) dynamically provisioned\n or already exists, and just requires a Kubernetes object representation.\n This field is immutable after creation.\n Required.\n properties:\n snapshotHandle:\n description: |-\n snapshotHandle specifies the CSI \"snapshot_id\" of a pre-existing snapshot on\n the underlying storage system for which a Kubernetes object representation\n was (or should be) created.\n This field is immutable.\n type: string\n x-kubernetes-validations:\n - message: snapshotHandle is immutable\n rule: self == oldSelf\n volumeHandle:\n description: |-\n volumeHandle specifies the CSI \"volume_id\" of the volume from which a snapshot\n should be dynamically taken from.\n This field is immutable.\n type: string\n x-kubernetes-validations:\n - message: volumeHandle is immutable\n rule: self == oldSelf\n type: object\n x-kubernetes-validations:\n - message: volumeHandle is required once set\n rule: '!has(oldSelf.volumeHandle) || has(self.volumeHandle)'\n - message: snapshotHandle is required once set\n rule: '!has(oldSelf.snapshotHandle) || has(self.snapshotHandle)'\n - message: exactly one of volumeHandle and snapshotHandle must be\n set\n rule: (has(self.volumeHandle) && !has(self.snapshotHandle)) || (!has(self.volumeHandle)\n && has(self.snapshotHandle))\n sourceVolumeMode:\n description: |-\n SourceVolumeMode is the mode of the volume whose snapshot is taken.\n Can be either “Filesystem” or “Block”.\n If not specified, it indicates the source volume's mode is unknown.\n This field is immutable.\n This field is an alpha field.\n type: string\n x-kubernetes-validations:\n - message: sourceVolumeMode is immutable\n rule: self == oldSelf\n volumeSnapshotClassName:\n description: |-\n name of the VolumeSnapshotClass from which this snapshot was (or will be)\n created.\n Note that after provisioning, the VolumeSnapshotClass may be deleted or\n recreated with different set of values, and as such, should not be referenced\n post-snapshot creation.\n type: string\n volumeSnapshotRef:\n description: |-\n volumeSnapshotRef specifies the VolumeSnapshot object to which this\n VolumeSnapshotContent object is bound.\n VolumeSnapshot.Spec.VolumeSnapshotContentName field must reference to\n this VolumeSnapshotContent's name for the bidirectional binding to be valid.\n For a pre-existing VolumeSnapshotContent object, name and namespace of the\n VolumeSnapshot object MUST be provided for binding to happen.\n This field is immutable after creation.\n Required.\n properties:\n apiVersion:\n description: API version of the referent.\n type: string\n fieldPath:\n description: |-\n If referring to a piece of an object instead of an entire object, this string\n should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].\n For example, if the object reference is to a container within a pod, this would take on a value like:\n \"spec.containers{name}\" (where \"name\" refers to the name of the container that triggered\n the event) or if no container name is specified \"spec.containers[2]\" (container with\n index 2 in this pod). This syntax is chosen only to have some well-defined way of\n referencing a part of an object.\n TODO: this design is not final and this field is subject to change in the future.\n type: string\n kind:\n description: |-\n Kind of the referent.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n name:\n description: |-\n Name of the referent.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\n type: string\n namespace:\n description: |-\n Namespace of the referent.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/\n type: string\n resourceVersion:\n description: |-\n Specific resourceVersion to which this reference is made, if any.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency\n type: string\n uid:\n description: |-\n UID of the referent.\n More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids\n type: string\n type: object\n x-kubernetes-map-type: atomic\n x-kubernetes-validations:\n - message: both spec.volumeSnapshotRef.name and spec.volumeSnapshotRef.namespace\n must be set\n rule: has(self.name) && has(self.__namespace__)\n required:\n - deletionPolicy\n - driver\n - source\n - volumeSnapshotRef\n type: object\n x-kubernetes-validations:\n - message: sourceVolumeMode is required once set\n rule: '!has(oldSelf.sourceVolumeMode) || has(self.sourceVolumeMode)'\n status:\n description: status represents the current information of a snapshot.\n properties:\n creationTime:\n description: |-\n creationTime is the timestamp when the point-in-time snapshot is taken\n by the underlying storage system.\n In dynamic snapshot creation case, this field will be filled in by the\n CSI snapshotter sidecar with the \"creation_time\" value returned from CSI\n \"CreateSnapshot\" gRPC call.\n For a pre-existing snapshot, this field will be filled with the \"creation_time\"\n value returned from the CSI \"ListSnapshots\" gRPC call if the driver supports it.\n If not specified, it indicates the creation time is unknown.\n The format of this field is a Unix nanoseconds time encoded as an int64.\n On Unix, the command `date +%s%N` returns the current time in nanoseconds\n since 1970-01-01 00:00:00 UTC.\n format: int64\n type: integer\n error:\n description: |-\n error is the last observed error during snapshot creation, if any.\n Upon success after retry, this error field will be cleared.\n properties:\n message:\n description: |-\n message is a string detailing the encountered error during snapshot\n creation if specified.\n NOTE: message may be logged, and it should not contain sensitive\n information.\n type: string\n time:\n description: time is the timestamp when the error was encountered.\n format: date-time\n type: string\n type: object\n readyToUse:\n description: |-\n readyToUse indicates if a snapshot is ready to be used to restore a volume.\n In dynamic snapshot creation case, this field will be filled in by the\n CSI snapshotter sidecar with the \"ready_to_use\" value returned from CSI\n \"CreateSnapshot\" gRPC call.\n For a pre-existing snapshot, this field will be filled with the \"ready_to_use\"\n value returned from the CSI \"ListSnapshots\" gRPC call if the driver supports it,\n otherwise, this field will be set to \"True\".\n If not specified, it means the readiness of a snapshot is unknown.\n type: boolean\n restoreSize:\n description: |-\n restoreSize represents the complete size of the snapshot in bytes.\n In dynamic snapshot creation case, this field will be filled in by the\n CSI snapshotter sidecar with the \"size_bytes\" value returned from CSI\n \"CreateSnapshot\" gRPC call.\n For a pre-existing snapshot, this field will be filled with the \"size_bytes\"\n value returned from the CSI \"ListSnapshots\" gRPC call if the driver supports it.\n When restoring a volume from this snapshot, the size of the volume MUST NOT\n be smaller than the restoreSize if it is specified, otherwise the restoration will fail.\n If not specified, it indicates that the size is unknown.\n format: int64\n minimum: 0\n type: integer\n snapshotHandle:\n description: |-\n snapshotHandle is the CSI \"snapshot_id\" of a snapshot on the underlying storage system.\n If not specified, it indicates that dynamic snapshot creation has either failed\n or it is still in progress.\n type: string\n volumeGroupSnapshotHandle:\n description: |-\n VolumeGroupSnapshotHandle is the CSI \"group_snapshot_id\" of a group snapshot\n on the underlying storage system.\n type: string\n type: object\n required:\n - spec\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - description: Indicates if the snapshot is ready to be used to restore a volume.\n jsonPath: .status.readyToUse\n name: ReadyToUse\n type: boolean\n - description: Represents the complete size of the snapshot in bytes\n jsonPath: .status.restoreSize\n name: RestoreSize\n type: integer\n - description: Determines whether this VolumeSnapshotContent and its physical\n snapshot on the underlying storage system should be deleted when its bound\n VolumeSnapshot is deleted.\n jsonPath: .spec.deletionPolicy\n name: DeletionPolicy\n type: string\n - description: Name of the CSI driver used to create the physical snapshot on\n the underlying storage system.\n jsonPath: .spec.driver\n name: Driver\n type: string\n - description: Name of the VolumeSnapshotClass to which this snapshot belongs.\n jsonPath: .spec.volumeSnapshotClassName\n name: VolumeSnapshotClass\n type: string\n - description: Name of the VolumeSnapshot object to which this VolumeSnapshotContent\n object is bound.\n jsonPath: .spec.volumeSnapshotRef.name\n name: VolumeSnapshot\n type: string\n - description: Namespace of the VolumeSnapshot object to which this VolumeSnapshotContent\n object is bound.\n jsonPath: .spec.volumeSnapshotRef.namespace\n name: VolumeSnapshotNamespace\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n deprecated: true\n deprecationWarning: snapshot.storage.k8s.io/v1beta1 VolumeSnapshotContent is deprecated;\n use snapshot.storage.k8s.io/v1 VolumeSnapshotContent\n name: v1beta1\n schema:\n openAPIV3Schema:\n description: VolumeSnapshotContent represents the actual \"on-disk\" snapshot\n object in the underlying storage system\n properties:\n apiVersion:\n description: 'APIVersion defines the versioned schema of this representation\n of an object. Servers should convert recognized schemas to the latest\n internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n type: string\n kind:\n description: 'Kind is a string value representing the REST resource this\n object represents. Servers may infer this from the endpoint the client\n submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n type: string\n spec:\n description: spec defines properties of a VolumeSnapshotContent created\n by the underlying storage system. Required.\n properties:\n deletionPolicy:\n description: deletionPolicy determines whether this VolumeSnapshotContent\n and its physical snapshot on the underlying storage system should\n be deleted when its bound VolumeSnapshot is deleted. Supported values\n are \"Retain\" and \"Delete\". \"Retain\" means that the VolumeSnapshotContent\n and its physical snapshot on underlying storage system are kept.\n \"Delete\" means that the VolumeSnapshotContent and its physical snapshot\n on underlying storage system are deleted. For dynamically provisioned\n snapshots, this field will automatically be filled in by the CSI\n snapshotter sidecar with the \"DeletionPolicy\" field defined in the\n corresponding VolumeSnapshotClass. For pre-existing snapshots, users\n MUST specify this field when creating the VolumeSnapshotContent\n object. Required.\n enum:\n - Delete\n - Retain\n type: string\n driver:\n description: driver is the name of the CSI driver used to create the\n physical snapshot on the underlying storage system. This MUST be\n the same as the name returned by the CSI GetPluginName() call for\n that driver. Required.\n type: string\n source:\n description: source specifies whether the snapshot is (or should be)\n dynamically provisioned or already exists, and just requires a Kubernetes\n object representation. This field is immutable after creation. Required.\n properties:\n snapshotHandle:\n description: snapshotHandle specifies the CSI \"snapshot_id\" of\n a pre-existing snapshot on the underlying storage system for\n which a Kubernetes object representation was (or should be)\n created. This field is immutable.\n type: string\n volumeHandle:\n description: volumeHandle specifies the CSI \"volume_id\" of the\n volume from which a snapshot should be dynamically taken from.\n This field is immutable.\n type: string\n type: object\n volumeSnapshotClassName:\n description: name of the VolumeSnapshotClass from which this snapshot\n was (or will be) created. Note that after provisioning, the VolumeSnapshotClass\n may be deleted or recreated with different set of values, and as\n such, should not be referenced post-snapshot creation.\n type: string\n volumeSnapshotRef:\n description: volumeSnapshotRef specifies the VolumeSnapshot object\n to which this VolumeSnapshotContent object is bound. VolumeSnapshot.Spec.VolumeSnapshotContentName\n field must reference to this VolumeSnapshotContent's name for the\n bidirectional binding to be valid. For a pre-existing VolumeSnapshotContent\n object, name and namespace of the VolumeSnapshot object MUST be\n provided for binding to happen. This field is immutable after creation.\n Required.\n properties:\n apiVersion:\n description: API version of the referent.\n type: string\n fieldPath:\n description: 'If referring to a piece of an object instead of\n an entire object, this string should contain a valid JSON/Go\n field access statement, such as desiredState.manifest.containers[2].\n For example, if the object reference is to a container within\n a pod, this would take on a value like: \"spec.containers{name}\"\n (where \"name\" refers to the name of the container that triggered\n the event) or if no container name is specified \"spec.containers[2]\"\n (container with index 2 in this pod). This syntax is chosen\n only to have some well-defined way of referencing a part of\n an object. TODO: this design is not final and this field is\n subject to change in the future.'\n type: string\n kind:\n description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n type: string\n name:\n description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'\n type: string\n namespace:\n description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'\n type: string\n resourceVersion:\n description: 'Specific resourceVersion to which this reference\n is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'\n type: string\n uid:\n description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'\n type: string\n type: object\n required:\n - deletionPolicy\n - driver\n - source\n - volumeSnapshotRef\n type: object\n status:\n description: status represents the current information of a snapshot.\n properties:\n creationTime:\n description: creationTime is the timestamp when the point-in-time\n snapshot is taken by the underlying storage system. In dynamic snapshot\n creation case, this field will be filled in by the CSI snapshotter\n sidecar with the \"creation_time\" value returned from CSI \"CreateSnapshot\"\n gRPC call. For a pre-existing snapshot, this field will be filled\n with the \"creation_time\" value returned from the CSI \"ListSnapshots\"\n gRPC call if the driver supports it. If not specified, it indicates\n the creation time is unknown. The format of this field is a Unix\n nanoseconds time encoded as an int64. On Unix, the command `date\n +%s%N` returns the current time in nanoseconds since 1970-01-01\n 00:00:00 UTC.\n format: int64\n type: integer\n error:\n description: error is the last observed error during snapshot creation,\n if any. Upon success after retry, this error field will be cleared.\n properties:\n message:\n description: 'message is a string detailing the encountered error\n during snapshot creation if specified. NOTE: message may be\n logged, and it should not contain sensitive information.'\n type: string\n time:\n description: time is the timestamp when the error was encountered.\n format: date-time\n type: string\n type: object\n readyToUse:\n description: readyToUse indicates if a snapshot is ready to be used\n to restore a volume. In dynamic snapshot creation case, this field\n will be filled in by the CSI snapshotter sidecar with the \"ready_to_use\"\n value returned from CSI \"CreateSnapshot\" gRPC call. For a pre-existing\n snapshot, this field will be filled with the \"ready_to_use\" value\n returned from the CSI \"ListSnapshots\" gRPC call if the driver supports\n it, otherwise, this field will be set to \"True\". If not specified,\n it means the readiness of a snapshot is unknown.\n type: boolean\n restoreSize:\n description: restoreSize represents the complete size of the snapshot\n in bytes. In dynamic snapshot creation case, this field will be\n filled in by the CSI snapshotter sidecar with the \"size_bytes\" value\n returned from CSI \"CreateSnapshot\" gRPC call. For a pre-existing\n snapshot, this field will be filled with the \"size_bytes\" value\n returned from the CSI \"ListSnapshots\" gRPC call if the driver supports\n it. When restoring a volume from this snapshot, the size of the\n volume MUST NOT be smaller than the restoreSize if it is specified,\n otherwise the restoration will fail. If not specified, it indicates\n that the size is unknown.\n format: int64\n minimum: 0\n type: integer\n snapshotHandle:\n description: snapshotHandle is the CSI \"snapshot_id\" of a snapshot\n on the underlying storage system. If not specified, it indicates\n that dynamic snapshot creation has either failed or it is still\n in progress.\n type: string\n type: object\n required:\n - spec\n type: object\n served: false\n storage: false\n subresources:\n status: {}\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: []\n storedVersions: []\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-csi/external-snapshotter/pull/814\n controller-gen.kubebuilder.io/version: v0.15.0\n name: volumesnapshots.snapshot.storage.k8s.io\nspec:\n group: snapshot.storage.k8s.io\n names:\n kind: VolumeSnapshot\n listKind: VolumeSnapshotList\n plural: volumesnapshots\n shortNames:\n - vs\n singular: volumesnapshot\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - description: Indicates if the snapshot is ready to be used to restore a volume.\n jsonPath: .status.readyToUse\n name: ReadyToUse\n type: boolean\n - description: If a new snapshot needs to be created, this contains the name of\n the source PVC from which this snapshot was (or will be) created.\n jsonPath: .spec.source.persistentVolumeClaimName\n name: SourcePVC\n type: string\n - description: If a snapshot already exists, this contains the name of the existing\n VolumeSnapshotContent object representing the existing snapshot.\n jsonPath: .spec.source.volumeSnapshotContentName\n name: SourceSnapshotContent\n type: string\n - description: Represents the minimum size of volume required to rehydrate from\n this snapshot.\n jsonPath: .status.restoreSize\n name: RestoreSize\n type: string\n - description: The name of the VolumeSnapshotClass requested by the VolumeSnapshot.\n jsonPath: .spec.volumeSnapshotClassName\n name: SnapshotClass\n type: string\n - description: Name of the VolumeSnapshotContent object to which the VolumeSnapshot\n object intends to bind to. Please note that verification of binding actually\n requires checking both VolumeSnapshot and VolumeSnapshotContent to ensure\n both are pointing at each other. Binding MUST be verified prior to usage of\n this object.\n jsonPath: .status.boundVolumeSnapshotContentName\n name: SnapshotContent\n type: string\n - description: Timestamp when the point-in-time snapshot was taken by the underlying\n storage system.\n jsonPath: .status.creationTime\n name: CreationTime\n type: date\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1\n schema:\n openAPIV3Schema:\n description: |-\n VolumeSnapshot is a user's request for either creating a point-in-time\n snapshot of a persistent volume, or binding to a pre-existing snapshot.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: |-\n spec defines the desired characteristics of a snapshot requested by a user.\n More info: https://kubernetes.io/docs/concepts/storage/volume-snapshots#volumesnapshots\n Required.\n properties:\n source:\n description: |-\n source specifies where a snapshot will be created from.\n This field is immutable after creation.\n Required.\n properties:\n persistentVolumeClaimName:\n description: |-\n persistentVolumeClaimName specifies the name of the PersistentVolumeClaim\n object representing the volume from which a snapshot should be created.\n This PVC is assumed to be in the same namespace as the VolumeSnapshot\n object.\n This field should be set if the snapshot does not exists, and needs to be\n created.\n This field is immutable.\n type: string\n x-kubernetes-validations:\n - message: persistentVolumeClaimName is immutable\n rule: self == oldSelf\n volumeSnapshotContentName:\n description: |-\n volumeSnapshotContentName specifies the name of a pre-existing VolumeSnapshotContent\n object representing an existing volume snapshot.\n This field should be set if the snapshot already exists and only needs a representation in Kubernetes.\n This field is immutable.\n type: string\n x-kubernetes-validations:\n - message: volumeSnapshotContentName is immutable\n rule: self == oldSelf\n type: object\n x-kubernetes-validations:\n - message: persistentVolumeClaimName is required once set\n rule: '!has(oldSelf.persistentVolumeClaimName) || has(self.persistentVolumeClaimName)'\n - message: volumeSnapshotContentName is required once set\n rule: '!has(oldSelf.volumeSnapshotContentName) || has(self.volumeSnapshotContentName)'\n - message: exactly one of volumeSnapshotContentName and persistentVolumeClaimName\n must be set\n rule: (has(self.volumeSnapshotContentName) && !has(self.persistentVolumeClaimName))\n || (!has(self.volumeSnapshotContentName) && has(self.persistentVolumeClaimName))\n volumeSnapshotClassName:\n description: |-\n VolumeSnapshotClassName is the name of the VolumeSnapshotClass\n requested by the VolumeSnapshot.\n VolumeSnapshotClassName may be left nil to indicate that the default\n SnapshotClass should be used.\n A given cluster may have multiple default Volume SnapshotClasses: one\n default per CSI Driver. If a VolumeSnapshot does not specify a SnapshotClass,\n VolumeSnapshotSource will be checked to figure out what the associated\n CSI Driver is, and the default VolumeSnapshotClass associated with that\n CSI Driver will be used. If more than one VolumeSnapshotClass exist for\n a given CSI Driver and more than one have been marked as default,\n CreateSnapshot will fail and generate an event.\n Empty string is not allowed for this field.\n type: string\n x-kubernetes-validations:\n - message: volumeSnapshotClassName must not be the empty string when\n set\n rule: size(self) > 0\n required:\n - source\n type: object\n status:\n description: |-\n status represents the current information of a snapshot.\n Consumers must verify binding between VolumeSnapshot and\n VolumeSnapshotContent objects is successful (by validating that both\n VolumeSnapshot and VolumeSnapshotContent point at each other) before\n using this object.\n properties:\n boundVolumeSnapshotContentName:\n description: |-\n boundVolumeSnapshotContentName is the name of the VolumeSnapshotContent\n object to which this VolumeSnapshot object intends to bind to.\n If not specified, it indicates that the VolumeSnapshot object has not been\n successfully bound to a VolumeSnapshotContent object yet.\n NOTE: To avoid possible security issues, consumers must verify binding between\n VolumeSnapshot and VolumeSnapshotContent objects is successful (by validating that\n both VolumeSnapshot and VolumeSnapshotContent point at each other) before using\n this object.\n type: string\n creationTime:\n description: |-\n creationTime is the timestamp when the point-in-time snapshot is taken\n by the underlying storage system.\n In dynamic snapshot creation case, this field will be filled in by the\n snapshot controller with the \"creation_time\" value returned from CSI\n \"CreateSnapshot\" gRPC call.\n For a pre-existing snapshot, this field will be filled with the \"creation_time\"\n value returned from the CSI \"ListSnapshots\" gRPC call if the driver supports it.\n If not specified, it may indicate that the creation time of the snapshot is unknown.\n format: date-time\n type: string\n error:\n description: |-\n error is the last observed error during snapshot creation, if any.\n This field could be helpful to upper level controllers(i.e., application controller)\n to decide whether they should continue on waiting for the snapshot to be created\n based on the type of error reported.\n The snapshot controller will keep retrying when an error occurs during the\n snapshot creation. Upon success, this error field will be cleared.\n properties:\n message:\n description: |-\n message is a string detailing the encountered error during snapshot\n creation if specified.\n NOTE: message may be logged, and it should not contain sensitive\n information.\n type: string\n time:\n description: time is the timestamp when the error was encountered.\n format: date-time\n type: string\n type: object\n readyToUse:\n description: |-\n readyToUse indicates if the snapshot is ready to be used to restore a volume.\n In dynamic snapshot creation case, this field will be filled in by the\n snapshot controller with the \"ready_to_use\" value returned from CSI\n \"CreateSnapshot\" gRPC call.\n For a pre-existing snapshot, this field will be filled with the \"ready_to_use\"\n value returned from the CSI \"ListSnapshots\" gRPC call if the driver supports it,\n otherwise, this field will be set to \"True\".\n If not specified, it means the readiness of a snapshot is unknown.\n type: boolean\n restoreSize:\n description: |-\n restoreSize represents the minimum size of volume required to create a volume\n from this snapshot.\n In dynamic snapshot creation case, this field will be filled in by the\n snapshot controller with the \"size_bytes\" value returned from CSI\n \"CreateSnapshot\" gRPC call.\n For a pre-existing snapshot, this field will be filled with the \"size_bytes\"\n value returned from the CSI \"ListSnapshots\" gRPC call if the driver supports it.\n When restoring a volume from this snapshot, the size of the volume MUST NOT\n be smaller than the restoreSize if it is specified, otherwise the restoration will fail.\n If not specified, it indicates that the size is unknown.\n pattern: ^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$\n type: string\n x-kubernetes-int-or-string: true\n volumeGroupSnapshotName:\n description: |-\n VolumeGroupSnapshotName is the name of the VolumeGroupSnapshot of which this\n VolumeSnapshot is a part of.\n type: string\n type: object\n required:\n - spec\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - description: Indicates if the snapshot is ready to be used to restore a volume.\n jsonPath: .status.readyToUse\n name: ReadyToUse\n type: boolean\n - description: If a new snapshot needs to be created, this contains the name of\n the source PVC from which this snapshot was (or will be) created.\n jsonPath: .spec.source.persistentVolumeClaimName\n name: SourcePVC\n type: string\n - description: If a snapshot already exists, this contains the name of the existing\n VolumeSnapshotContent object representing the existing snapshot.\n jsonPath: .spec.source.volumeSnapshotContentName\n name: SourceSnapshotContent\n type: string\n - description: Represents the minimum size of volume required to rehydrate from\n this snapshot.\n jsonPath: .status.restoreSize\n name: RestoreSize\n type: string\n - description: The name of the VolumeSnapshotClass requested by the VolumeSnapshot.\n jsonPath: .spec.volumeSnapshotClassName\n name: SnapshotClass\n type: string\n - description: Name of the VolumeSnapshotContent object to which the VolumeSnapshot\n object intends to bind to. Please note that verification of binding actually\n requires checking both VolumeSnapshot and VolumeSnapshotContent to ensure\n both are pointing at each other. Binding MUST be verified prior to usage of\n this object.\n jsonPath: .status.boundVolumeSnapshotContentName\n name: SnapshotContent\n type: string\n - description: Timestamp when the point-in-time snapshot was taken by the underlying\n storage system.\n jsonPath: .status.creationTime\n name: CreationTime\n type: date\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n deprecated: true\n deprecationWarning: snapshot.storage.k8s.io/v1beta1 VolumeSnapshot is deprecated;\n use snapshot.storage.k8s.io/v1 VolumeSnapshot\n name: v1beta1\n schema:\n openAPIV3Schema:\n description: VolumeSnapshot is a user's request for either creating a point-in-time\n snapshot of a persistent volume, or binding to a pre-existing snapshot.\n properties:\n apiVersion:\n description: 'APIVersion defines the versioned schema of this representation\n of an object. Servers should convert recognized schemas to the latest\n internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n type: string\n kind:\n description: 'Kind is a string value representing the REST resource this\n object represents. Servers may infer this from the endpoint the client\n submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n type: string\n spec:\n description: 'spec defines the desired characteristics of a snapshot requested\n by a user. More info: https://kubernetes.io/docs/concepts/storage/volume-snapshots#volumesnapshots\n Required.'\n properties:\n source:\n description: source specifies where a snapshot will be created from.\n This field is immutable after creation. Required.\n properties:\n persistentVolumeClaimName:\n description: persistentVolumeClaimName specifies the name of the\n PersistentVolumeClaim object representing the volume from which\n a snapshot should be created. This PVC is assumed to be in the\n same namespace as the VolumeSnapshot object. This field should\n be set if the snapshot does not exists, and needs to be created.\n This field is immutable.\n type: string\n volumeSnapshotContentName:\n description: volumeSnapshotContentName specifies the name of a\n pre-existing VolumeSnapshotContent object representing an existing\n volume snapshot. This field should be set if the snapshot already\n exists and only needs a representation in Kubernetes. This field\n is immutable.\n type: string\n type: object\n volumeSnapshotClassName:\n description: 'VolumeSnapshotClassName is the name of the VolumeSnapshotClass\n requested by the VolumeSnapshot. VolumeSnapshotClassName may be\n left nil to indicate that the default SnapshotClass should be used.\n A given cluster may have multiple default Volume SnapshotClasses:\n one default per CSI Driver. If a VolumeSnapshot does not specify\n a SnapshotClass, VolumeSnapshotSource will be checked to figure\n out what the associated CSI Driver is, and the default VolumeSnapshotClass\n associated with that CSI Driver will be used. If more than one VolumeSnapshotClass\n exist for a given CSI Driver and more than one have been marked\n as default, CreateSnapshot will fail and generate an event. Empty\n string is not allowed for this field.'\n type: string\n required:\n - source\n type: object\n status:\n description: status represents the current information of a snapshot.\n Consumers must verify binding between VolumeSnapshot and VolumeSnapshotContent\n objects is successful (by validating that both VolumeSnapshot and VolumeSnapshotContent\n point at each other) before using this object.\n properties:\n boundVolumeSnapshotContentName:\n description: 'boundVolumeSnapshotContentName is the name of the VolumeSnapshotContent\n object to which this VolumeSnapshot object intends to bind to. If\n not specified, it indicates that the VolumeSnapshot object has not\n been successfully bound to a VolumeSnapshotContent object yet. NOTE:\n To avoid possible security issues, consumers must verify binding\n between VolumeSnapshot and VolumeSnapshotContent objects is successful\n (by validating that both VolumeSnapshot and VolumeSnapshotContent\n point at each other) before using this object.'\n type: string\n creationTime:\n description: creationTime is the timestamp when the point-in-time\n snapshot is taken by the underlying storage system. In dynamic snapshot\n creation case, this field will be filled in by the snapshot controller\n with the \"creation_time\" value returned from CSI \"CreateSnapshot\"\n gRPC call. For a pre-existing snapshot, this field will be filled\n with the \"creation_time\" value returned from the CSI \"ListSnapshots\"\n gRPC call if the driver supports it. If not specified, it may indicate\n that the creation time of the snapshot is unknown.\n format: date-time\n type: string\n error:\n description: error is the last observed error during snapshot creation,\n if any. This field could be helpful to upper level controllers(i.e.,\n application controller) to decide whether they should continue on\n waiting for the snapshot to be created based on the type of error\n reported. The snapshot controller will keep retrying when an error\n occurs during the snapshot creation. Upon success, this error field\n will be cleared.\n properties:\n message:\n description: 'message is a string detailing the encountered error\n during snapshot creation if specified. NOTE: message may be\n logged, and it should not contain sensitive information.'\n type: string\n time:\n description: time is the timestamp when the error was encountered.\n format: date-time\n type: string\n type: object\n readyToUse:\n description: readyToUse indicates if the snapshot is ready to be used\n to restore a volume. In dynamic snapshot creation case, this field\n will be filled in by the snapshot controller with the \"ready_to_use\"\n value returned from CSI \"CreateSnapshot\" gRPC call. For a pre-existing\n snapshot, this field will be filled with the \"ready_to_use\" value\n returned from the CSI \"ListSnapshots\" gRPC call if the driver supports\n it, otherwise, this field will be set to \"True\". If not specified,\n it means the readiness of a snapshot is unknown.\n type: boolean\n restoreSize:\n description: restoreSize represents the minimum size of volume required\n to create a volume from this snapshot. In dynamic snapshot creation\n case, this field will be filled in by the snapshot controller with\n the \"size_bytes\" value returned from CSI \"CreateSnapshot\" gRPC call.\n For a pre-existing snapshot, this field will be filled with the\n \"size_bytes\" value returned from the CSI \"ListSnapshots\" gRPC call\n if the driver supports it. When restoring a volume from this snapshot,\n the size of the volume MUST NOT be smaller than the restoreSize\n if it is specified, otherwise the restoration will fail. If not\n specified, it indicates that the size is unknown.\n pattern: ^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$\n type: string\n x-kubernetes-int-or-string: true\n type: object\n required:\n - spec\n type: object\n served: false\n storage: false\n subresources:\n status: {}\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: []\n storedVersions: []\n" }, { "path": "cluster/homelab/crds/external-snapshotter/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - crds.yaml\n" }, { "path": "cluster/homelab/crds/gateway-api/crds.yaml", "content": "# Generated with: kubectl kustomize \"github.com/kubernetes-sigs/gateway-api/config/crd?ref=v1.4.0\"\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328\n gateway.networking.k8s.io/bundle-version: v1.4.0\n gateway.networking.k8s.io/channel: standard\n labels:\n gateway.networking.k8s.io/policy: Direct\n name: backendtlspolicies.gateway.networking.k8s.io\nspec:\n group: gateway.networking.k8s.io\n names:\n categories:\n - gateway-api\n kind: BackendTLSPolicy\n listKind: BackendTLSPolicyList\n plural: backendtlspolicies\n shortNames:\n - btlspolicy\n singular: backendtlspolicy\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1\n schema:\n openAPIV3Schema:\n description: |-\n BackendTLSPolicy provides a way to configure how a Gateway\n connects to a Backend via TLS.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: Spec defines the desired state of BackendTLSPolicy.\n properties:\n options:\n additionalProperties:\n description: |-\n AnnotationValue is the value of an annotation in Gateway API. This is used\n for validation of maps such as TLS options. This roughly matches Kubernetes\n annotation validation, although the length validation in that case is based\n on the entire size of the annotations struct.\n maxLength: 4096\n minLength: 0\n type: string\n description: |-\n Options are a list of key/value pairs to enable extended TLS\n configuration for each implementation. For example, configuring the\n minimum TLS version or supported cipher suites.\n\n A set of common keys MAY be defined by the API in the future. To avoid\n any ambiguity, implementation-specific definitions MUST use\n domain-prefixed names, such as `example.com/my-custom-option`.\n Un-prefixed names are reserved for key names defined by Gateway API.\n\n Support: Implementation-specific\n maxProperties: 16\n type: object\n targetRefs:\n description: |-\n TargetRefs identifies an API object to apply the policy to.\n Only Services have Extended support. Implementations MAY support\n additional objects, with Implementation Specific support.\n Note that this config applies to the entire referenced resource\n by default, but this default may change in the future to provide\n a more granular application of the policy.\n\n TargetRefs must be _distinct_. This means either that:\n\n * They select different targets. If this is the case, then targetRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, and `name` must\n be unique across all targetRef entries in the BackendTLSPolicy.\n * They select different sectionNames in the same target.\n\n When more than one BackendTLSPolicy selects the same target and\n sectionName, implementations MUST determine precedence using the\n following criteria, continuing on ties:\n\n * The older policy by creation timestamp takes precedence. For\n example, a policy with a creation timestamp of \"2021-07-15\n 01:02:03\" MUST be given precedence over a policy with a\n creation timestamp of \"2021-07-15 01:02:04\".\n * The policy appearing first in alphabetical order by {name}.\n For example, a policy named `bar` is given precedence over a\n policy named `baz`.\n\n For any BackendTLSPolicy that does not take precedence, the\n implementation MUST ensure the `Accepted` Condition is set to\n `status: False`, with Reason `Conflicted`.\n\n Support: Extended for Kubernetes Service\n\n Support: Implementation-specific for any other resource\n items:\n description: |-\n LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a\n direct policy to. This should be used as part of Policy resources that can\n target single resources. For more information on how this policy attachment\n mode works, and a sample Policy resource, refer to the policy attachment\n documentation for Gateway API.\n\n Note: This should only be used for direct policy attachment when references\n to SectionName are actually needed. In all other cases,\n LocalPolicyTargetReference should be used.\n properties:\n group:\n description: Group is the group of the target resource.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the target resource.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the target resource.\n maxLength: 253\n minLength: 1\n type: string\n sectionName:\n description: |-\n SectionName is the name of a section within the target resource. When\n unspecified, this targetRef targets the entire resource. In the following\n resources, SectionName is interpreted as the following:\n\n * Gateway: Listener name\n * HTTPRoute: HTTPRouteRule name\n * Service: Port name\n\n If a SectionName is specified, but does not exist on the targeted object,\n the Policy must fail to attach, and the policy implementation should record\n a `ResolvedRefs` or similar Condition in the Policy's status.\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n required:\n - group\n - kind\n - name\n type: object\n maxItems: 16\n minItems: 1\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: sectionName must be specified when targetRefs includes\n 2 or more references to the same target\n rule: \"self.all(p1, self.all(p2, p1.group == p2.group && p1.kind\n == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName\n == '') == (!has(p2.sectionName) || p2.sectionName == ''))\n : true))\"\n - message: sectionName must be unique when targetRefs includes 2 or\n more references to the same target\n rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind\n == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) ||\n p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName\n == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName\n == p2.sectionName))))\n validation:\n description: Validation contains backend TLS validation configuration.\n properties:\n caCertificateRefs:\n description: |-\n CACertificateRefs contains one or more references to Kubernetes objects that\n contain a PEM-encoded TLS CA certificate bundle, which is used to\n validate a TLS handshake between the Gateway and backend Pod.\n\n If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be\n specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,\n not both. If CACertificateRefs is empty or unspecified, the configuration for\n WellKnownCACertificates MUST be honored instead if supported by the implementation.\n\n A CACertificateRef is invalid if:\n\n * It refers to a resource that cannot be resolved (e.g., the referenced resource\n does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key\n named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`\n and the Message of the Condition must indicate which reference is invalid and why.\n\n * It refers to an unknown or unsupported kind of resource. In this case, the Reason\n must be set to `InvalidKind` and the Message of the Condition must explain which\n kind of resource is unknown or unsupported.\n\n * It refers to a resource in another namespace. This may change in future\n spec updates.\n\n Implementations MAY choose to perform further validation of the certificate\n content (e.g., checking expiry or enforcing specific formats). In such cases,\n an implementation-specific Reason and Message must be set for the invalid reference.\n\n In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on\n the BackendTLSPolicy is set to `status: False`, with a Reason and Message\n that indicate the cause of the error. Connections using an invalid\n CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error\n response. If ALL CACertificateRefs are invalid, the implementation MUST also\n ensure the `Accepted` Condition on the BackendTLSPolicy is set to\n `status: False`, with a Reason `NoValidCACertificate`.\n\n A single CACertificateRef to a Kubernetes ConfigMap kind has \"Core\" support.\n Implementations MAY choose to support attaching multiple certificates to\n a backend, but this behavior is implementation-specific.\n\n Support: Core - An optional single reference to a Kubernetes ConfigMap,\n with the CA certificate in a key named `ca.crt`.\n\n Support: Implementation-specific - More than one reference, other kinds\n of resources, or a single reference that includes multiple certificates.\n items:\n description: |-\n LocalObjectReference identifies an API object within the namespace of the\n referrer.\n The API object must be valid in the cluster; the Group and Kind must\n be registered in the cluster for this reference to be valid.\n\n References to objects with invalid Group and Kind are not valid, and must\n be rejected by the implementation, with appropriate Conditions set\n on the containing object.\n properties:\n group:\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent. For example \"HTTPRoute\"\n or \"Service\".\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - group\n - kind\n - name\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-type: atomic\n hostname:\n description: |-\n Hostname is used for two purposes in the connection between Gateways and\n backends:\n\n 1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).\n 2. Hostname MUST be used for authentication and MUST match the certificate\n served by the matching backend, unless SubjectAltNames is specified.\n 3. If SubjectAltNames are specified, Hostname can be used for certificate selection\n but MUST NOT be used for authentication. If you want to use the value\n of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n subjectAltNames:\n description: |-\n SubjectAltNames contains one or more Subject Alternative Names.\n When specified the certificate served from the backend MUST\n have at least one Subject Alternate Name matching one of the specified SubjectAltNames.\n\n Support: Extended\n items:\n description: SubjectAltName represents Subject Alternative Name.\n properties:\n hostname:\n description: |-\n Hostname contains Subject Alternative Name specified in DNS name format.\n Required when Type is set to Hostname, ignored otherwise.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n type:\n description: |-\n Type determines the format of the Subject Alternative Name. Always required.\n\n Support: Core\n enum:\n - Hostname\n - URI\n type: string\n uri:\n description: |-\n URI contains Subject Alternative Name specified in a full URI format.\n It MUST include both a scheme (e.g., \"http\" or \"ftp\") and a scheme-specific-part.\n Common values include SPIFFE IDs like \"spiffe://mycluster.example.com/ns/myns/sa/svc1sa\".\n Required when Type is set to URI, ignored otherwise.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\\?([^#]*))?(#(.*))?\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: SubjectAltName element must contain Hostname, if\n Type is set to Hostname\n rule: '!(self.type == \"Hostname\" && (!has(self.hostname) ||\n self.hostname == \"\"))'\n - message: SubjectAltName element must not contain Hostname,\n if Type is not set to Hostname\n rule: '!(self.type != \"Hostname\" && has(self.hostname) &&\n self.hostname != \"\")'\n - message: SubjectAltName element must contain URI, if Type\n is set to URI\n rule: '!(self.type == \"URI\" && (!has(self.uri) || self.uri\n == \"\"))'\n - message: SubjectAltName element must not contain URI, if Type\n is not set to URI\n rule: '!(self.type != \"URI\" && has(self.uri) && self.uri !=\n \"\")'\n maxItems: 5\n type: array\n x-kubernetes-list-type: atomic\n wellKnownCACertificates:\n description: |-\n WellKnownCACertificates specifies whether system CA certificates may be used in\n the TLS handshake between the gateway and backend pod.\n\n If WellKnownCACertificates is unspecified or empty (\"\"), then CACertificateRefs\n must be specified with at least one entry for a valid configuration. Only one of\n CACertificateRefs or WellKnownCACertificates may be specified, not both.\n If an implementation does not support the WellKnownCACertificates field, or\n the supplied value is not recognized, the implementation MUST ensure the\n `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with\n a Reason `Invalid`.\n\n Support: Implementation-specific\n enum:\n - System\n type: string\n required:\n - hostname\n type: object\n x-kubernetes-validations:\n - message: must not contain both CACertificateRefs and WellKnownCACertificates\n rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs)\n > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates\n != \"\")'\n - message: must specify either CACertificateRefs or WellKnownCACertificates\n rule: (has(self.caCertificateRefs) && size(self.caCertificateRefs)\n > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates\n != \"\")\n required:\n - targetRefs\n - validation\n type: object\n status:\n description: Status defines the current state of BackendTLSPolicy.\n properties:\n ancestors:\n description: |-\n Ancestors is a list of ancestor resources (usually Gateways) that are\n associated with the policy, and the status of the policy with respect to\n each ancestor. When this policy attaches to a parent, the controller that\n manages the parent and the ancestors MUST add an entry to this list when\n the controller first sees the policy and SHOULD update the entry as\n appropriate when the relevant ancestor is modified.\n\n Note that choosing the relevant ancestor is left to the Policy designers;\n an important part of Policy design is designing the right object level at\n which to namespace this status.\n\n Note also that implementations MUST ONLY populate ancestor status for\n the Ancestor resources they are responsible for. Implementations MUST\n use the ControllerName field to uniquely identify the entries in this list\n that they are responsible for.\n\n Note that to achieve this, the list of PolicyAncestorStatus structs\n MUST be treated as a map with a composite key, made up of the AncestorRef\n and ControllerName fields combined.\n\n A maximum of 16 ancestors will be represented in this list. An empty list\n means the Policy is not relevant for any ancestors.\n\n If this slice is full, implementations MUST NOT add further entries.\n Instead they MUST consider the policy unimplementable and signal that\n on any related resources such as the ancestor that would be referenced\n here. For example, if this list was full on BackendTLSPolicy, no\n additional Gateways would be able to reference the Service targeted by\n the BackendTLSPolicy.\n items:\n description: |-\n PolicyAncestorStatus describes the status of a route with respect to an\n associated Ancestor.\n\n Ancestors refer to objects that are either the Target of a policy or above it\n in terms of object hierarchy. For example, if a policy targets a Service, the\n Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and\n the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most\n useful object to place Policy status on, so we recommend that implementations\n SHOULD use Gateway as the PolicyAncestorStatus object unless the designers\n have a _very_ good reason otherwise.\n\n In the context of policy attachment, the Ancestor is used to distinguish which\n resource results in a distinct application of this policy. For example, if a policy\n targets a Service, it may have a distinct result per attached Gateway.\n\n Policies targeting the same resource may have different effects depending on the\n ancestors of those resources. For example, different Gateways targeting the same\n Service may have different capabilities, especially if they have different underlying\n implementations.\n\n For example, in BackendTLSPolicy, the Policy attaches to a Service that is\n used as a backend in a HTTPRoute that is itself attached to a Gateway.\n In this case, the relevant object for status is the Gateway, and that is the\n ancestor object referred to in this status.\n\n Note that a parent is also an ancestor, so for objects where the parent is the\n relevant object for status, this struct SHOULD still be used.\n\n This struct is intended to be used in a slice that's effectively a map,\n with a composite key made up of the AncestorRef and the ControllerName.\n properties:\n ancestorRef:\n description: |-\n AncestorRef corresponds with a ParentRef in the spec that this\n PolicyAncestorStatus struct describes the status of.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: |-\n Group is the group of the referent.\n When unspecified, \"gateway.networking.k8s.io\" is inferred.\n To set the core API group (such as for a \"Service\" kind referent),\n Group must be explicitly set to \"\" (empty string).\n\n Support: Core\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Gateway\n description: |-\n Kind is kind of the referent.\n\n There are two kinds of parent resources with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n Support for other resources is Implementation-Specific.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: |-\n Name is the name of the referent.\n\n Support: Core\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referent. When unspecified, this refers\n to the local namespace of the Route.\n\n Note that there are specific rules for ParentRefs which cross namespace\n boundaries. Cross-namespace references are only valid if they are explicitly\n allowed by something in the namespace they are referring to. For example:\n Gateway has the AllowedRoutes field, and ReferenceGrant provides a\n generic way to enable any other kind of cross-namespace reference.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port is the network port this Route targets. It can be interpreted\n differently based on the type of parent resource.\n\n When the parent resource is a Gateway, this targets all listeners\n listening on the specified port that also support this kind of Route(and\n select this Route). It's not recommended to set `Port` unless the\n networking behaviors specified in a Route must apply to a specific port\n as opposed to a listener(s) whose port(s) may be changed. When both Port\n and SectionName are specified, the name and port of the selected listener\n must match both specified values.\n\n Implementations MAY choose to support other parent resources.\n Implementations supporting other types of parent resources MUST clearly\n document how/if Port is interpreted.\n\n For the purpose of status, an attachment is considered successful as\n long as the parent resource accepts it partially. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment\n from the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route,\n the Route MUST be considered detached from the Gateway.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n sectionName:\n description: |-\n SectionName is the name of a section within the target resource. In the\n following resources, SectionName is interpreted as the following:\n\n * Gateway: Listener name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n * Service: Port name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n\n Implementations MAY choose to support attaching Routes to other resources.\n If that is the case, they MUST clearly document how SectionName is\n interpreted.\n\n When unspecified (empty string), this will reference the entire resource.\n For the purpose of status, an attachment is considered successful if at\n least one section in the parent resource accepts it. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\n the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route, the\n Route MUST be considered detached from the Gateway.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n required:\n - name\n type: object\n conditions:\n description: Conditions describes the status of the Policy with\n respect to the given Ancestor.\n items:\n description: Condition contains details for one aspect of\n the current state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False,\n Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n maxItems: 8\n minItems: 1\n type: array\n x-kubernetes-list-map-keys:\n - type\n x-kubernetes-list-type: map\n controllerName:\n description: |-\n ControllerName is a domain/path string that indicates the name of the\n controller that wrote this status. This corresponds with the\n controllerName field on GatewayClass.\n\n Example: \"example.net/gateway-controller\".\n\n The format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\n valid Kubernetes names\n (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\n Controllers MUST populate this field when writing status. Controllers should ensure that\n entries to status populated with their ControllerName are cleaned up when they are no\n longer necessary.\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$\n type: string\n required:\n - ancestorRef\n - conditions\n - controllerName\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n required:\n - ancestors\n type: object\n required:\n - spec\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - deprecated: true\n deprecationWarning: The v1alpha3 version of BackendTLSPolicy has been deprecated\n and will be removed in a future release of the API. Please upgrade to v1.\n name: v1alpha3\n schema:\n openAPIV3Schema:\n description: |-\n BackendTLSPolicy provides a way to configure how a Gateway\n connects to a Backend via TLS.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: Spec defines the desired state of BackendTLSPolicy.\n properties:\n options:\n additionalProperties:\n description: |-\n AnnotationValue is the value of an annotation in Gateway API. This is used\n for validation of maps such as TLS options. This roughly matches Kubernetes\n annotation validation, although the length validation in that case is based\n on the entire size of the annotations struct.\n maxLength: 4096\n minLength: 0\n type: string\n description: |-\n Options are a list of key/value pairs to enable extended TLS\n configuration for each implementation. For example, configuring the\n minimum TLS version or supported cipher suites.\n\n A set of common keys MAY be defined by the API in the future. To avoid\n any ambiguity, implementation-specific definitions MUST use\n domain-prefixed names, such as `example.com/my-custom-option`.\n Un-prefixed names are reserved for key names defined by Gateway API.\n\n Support: Implementation-specific\n maxProperties: 16\n type: object\n targetRefs:\n description: |-\n TargetRefs identifies an API object to apply the policy to.\n Only Services have Extended support. Implementations MAY support\n additional objects, with Implementation Specific support.\n Note that this config applies to the entire referenced resource\n by default, but this default may change in the future to provide\n a more granular application of the policy.\n\n TargetRefs must be _distinct_. This means either that:\n\n * They select different targets. If this is the case, then targetRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, and `name` must\n be unique across all targetRef entries in the BackendTLSPolicy.\n * They select different sectionNames in the same target.\n\n When more than one BackendTLSPolicy selects the same target and\n sectionName, implementations MUST determine precedence using the\n following criteria, continuing on ties:\n\n * The older policy by creation timestamp takes precedence. For\n example, a policy with a creation timestamp of \"2021-07-15\n 01:02:03\" MUST be given precedence over a policy with a\n creation timestamp of \"2021-07-15 01:02:04\".\n * The policy appearing first in alphabetical order by {name}.\n For example, a policy named `bar` is given precedence over a\n policy named `baz`.\n\n For any BackendTLSPolicy that does not take precedence, the\n implementation MUST ensure the `Accepted` Condition is set to\n `status: False`, with Reason `Conflicted`.\n\n Support: Extended for Kubernetes Service\n\n Support: Implementation-specific for any other resource\n items:\n description: |-\n LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a\n direct policy to. This should be used as part of Policy resources that can\n target single resources. For more information on how this policy attachment\n mode works, and a sample Policy resource, refer to the policy attachment\n documentation for Gateway API.\n\n Note: This should only be used for direct policy attachment when references\n to SectionName are actually needed. In all other cases,\n LocalPolicyTargetReference should be used.\n properties:\n group:\n description: Group is the group of the target resource.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the target resource.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the target resource.\n maxLength: 253\n minLength: 1\n type: string\n sectionName:\n description: |-\n SectionName is the name of a section within the target resource. When\n unspecified, this targetRef targets the entire resource. In the following\n resources, SectionName is interpreted as the following:\n\n * Gateway: Listener name\n * HTTPRoute: HTTPRouteRule name\n * Service: Port name\n\n If a SectionName is specified, but does not exist on the targeted object,\n the Policy must fail to attach, and the policy implementation should record\n a `ResolvedRefs` or similar Condition in the Policy's status.\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n required:\n - group\n - kind\n - name\n type: object\n maxItems: 16\n minItems: 1\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: sectionName must be specified when targetRefs includes\n 2 or more references to the same target\n rule: \"self.all(p1, self.all(p2, p1.group == p2.group && p1.kind\n == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName\n == '') == (!has(p2.sectionName) || p2.sectionName == ''))\n : true))\"\n - message: sectionName must be unique when targetRefs includes 2 or\n more references to the same target\n rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind\n == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) ||\n p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName\n == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName\n == p2.sectionName))))\n validation:\n description: Validation contains backend TLS validation configuration.\n properties:\n caCertificateRefs:\n description: |-\n CACertificateRefs contains one or more references to Kubernetes objects that\n contain a PEM-encoded TLS CA certificate bundle, which is used to\n validate a TLS handshake between the Gateway and backend Pod.\n\n If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be\n specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,\n not both. If CACertificateRefs is empty or unspecified, the configuration for\n WellKnownCACertificates MUST be honored instead if supported by the implementation.\n\n A CACertificateRef is invalid if:\n\n * It refers to a resource that cannot be resolved (e.g., the referenced resource\n does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key\n named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`\n and the Message of the Condition must indicate which reference is invalid and why.\n\n * It refers to an unknown or unsupported kind of resource. In this case, the Reason\n must be set to `InvalidKind` and the Message of the Condition must explain which\n kind of resource is unknown or unsupported.\n\n * It refers to a resource in another namespace. This may change in future\n spec updates.\n\n Implementations MAY choose to perform further validation of the certificate\n content (e.g., checking expiry or enforcing specific formats). In such cases,\n an implementation-specific Reason and Message must be set for the invalid reference.\n\n In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on\n the BackendTLSPolicy is set to `status: False`, with a Reason and Message\n that indicate the cause of the error. Connections using an invalid\n CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error\n response. If ALL CACertificateRefs are invalid, the implementation MUST also\n ensure the `Accepted` Condition on the BackendTLSPolicy is set to\n `status: False`, with a Reason `NoValidCACertificate`.\n\n A single CACertificateRef to a Kubernetes ConfigMap kind has \"Core\" support.\n Implementations MAY choose to support attaching multiple certificates to\n a backend, but this behavior is implementation-specific.\n\n Support: Core - An optional single reference to a Kubernetes ConfigMap,\n with the CA certificate in a key named `ca.crt`.\n\n Support: Implementation-specific - More than one reference, other kinds\n of resources, or a single reference that includes multiple certificates.\n items:\n description: |-\n LocalObjectReference identifies an API object within the namespace of the\n referrer.\n The API object must be valid in the cluster; the Group and Kind must\n be registered in the cluster for this reference to be valid.\n\n References to objects with invalid Group and Kind are not valid, and must\n be rejected by the implementation, with appropriate Conditions set\n on the containing object.\n properties:\n group:\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent. For example \"HTTPRoute\"\n or \"Service\".\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - group\n - kind\n - name\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-type: atomic\n hostname:\n description: |-\n Hostname is used for two purposes in the connection between Gateways and\n backends:\n\n 1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).\n 2. Hostname MUST be used for authentication and MUST match the certificate\n served by the matching backend, unless SubjectAltNames is specified.\n 3. If SubjectAltNames are specified, Hostname can be used for certificate selection\n but MUST NOT be used for authentication. If you want to use the value\n of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n subjectAltNames:\n description: |-\n SubjectAltNames contains one or more Subject Alternative Names.\n When specified the certificate served from the backend MUST\n have at least one Subject Alternate Name matching one of the specified SubjectAltNames.\n\n Support: Extended\n items:\n description: SubjectAltName represents Subject Alternative Name.\n properties:\n hostname:\n description: |-\n Hostname contains Subject Alternative Name specified in DNS name format.\n Required when Type is set to Hostname, ignored otherwise.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n type:\n description: |-\n Type determines the format of the Subject Alternative Name. Always required.\n\n Support: Core\n enum:\n - Hostname\n - URI\n type: string\n uri:\n description: |-\n URI contains Subject Alternative Name specified in a full URI format.\n It MUST include both a scheme (e.g., \"http\" or \"ftp\") and a scheme-specific-part.\n Common values include SPIFFE IDs like \"spiffe://mycluster.example.com/ns/myns/sa/svc1sa\".\n Required when Type is set to URI, ignored otherwise.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\\?([^#]*))?(#(.*))?\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: SubjectAltName element must contain Hostname, if\n Type is set to Hostname\n rule: '!(self.type == \"Hostname\" && (!has(self.hostname) ||\n self.hostname == \"\"))'\n - message: SubjectAltName element must not contain Hostname,\n if Type is not set to Hostname\n rule: '!(self.type != \"Hostname\" && has(self.hostname) &&\n self.hostname != \"\")'\n - message: SubjectAltName element must contain URI, if Type\n is set to URI\n rule: '!(self.type == \"URI\" && (!has(self.uri) || self.uri\n == \"\"))'\n - message: SubjectAltName element must not contain URI, if Type\n is not set to URI\n rule: '!(self.type != \"URI\" && has(self.uri) && self.uri !=\n \"\")'\n maxItems: 5\n type: array\n x-kubernetes-list-type: atomic\n wellKnownCACertificates:\n description: |-\n WellKnownCACertificates specifies whether system CA certificates may be used in\n the TLS handshake between the gateway and backend pod.\n\n If WellKnownCACertificates is unspecified or empty (\"\"), then CACertificateRefs\n must be specified with at least one entry for a valid configuration. Only one of\n CACertificateRefs or WellKnownCACertificates may be specified, not both.\n If an implementation does not support the WellKnownCACertificates field, or\n the supplied value is not recognized, the implementation MUST ensure the\n `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with\n a Reason `Invalid`.\n\n Support: Implementation-specific\n enum:\n - System\n type: string\n required:\n - hostname\n type: object\n x-kubernetes-validations:\n - message: must not contain both CACertificateRefs and WellKnownCACertificates\n rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs)\n > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates\n != \"\")'\n - message: must specify either CACertificateRefs or WellKnownCACertificates\n rule: (has(self.caCertificateRefs) && size(self.caCertificateRefs)\n > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates\n != \"\")\n required:\n - targetRefs\n - validation\n type: object\n status:\n description: Status defines the current state of BackendTLSPolicy.\n properties:\n ancestors:\n description: |-\n Ancestors is a list of ancestor resources (usually Gateways) that are\n associated with the policy, and the status of the policy with respect to\n each ancestor. When this policy attaches to a parent, the controller that\n manages the parent and the ancestors MUST add an entry to this list when\n the controller first sees the policy and SHOULD update the entry as\n appropriate when the relevant ancestor is modified.\n\n Note that choosing the relevant ancestor is left to the Policy designers;\n an important part of Policy design is designing the right object level at\n which to namespace this status.\n\n Note also that implementations MUST ONLY populate ancestor status for\n the Ancestor resources they are responsible for. Implementations MUST\n use the ControllerName field to uniquely identify the entries in this list\n that they are responsible for.\n\n Note that to achieve this, the list of PolicyAncestorStatus structs\n MUST be treated as a map with a composite key, made up of the AncestorRef\n and ControllerName fields combined.\n\n A maximum of 16 ancestors will be represented in this list. An empty list\n means the Policy is not relevant for any ancestors.\n\n If this slice is full, implementations MUST NOT add further entries.\n Instead they MUST consider the policy unimplementable and signal that\n on any related resources such as the ancestor that would be referenced\n here. For example, if this list was full on BackendTLSPolicy, no\n additional Gateways would be able to reference the Service targeted by\n the BackendTLSPolicy.\n items:\n description: |-\n PolicyAncestorStatus describes the status of a route with respect to an\n associated Ancestor.\n\n Ancestors refer to objects that are either the Target of a policy or above it\n in terms of object hierarchy. For example, if a policy targets a Service, the\n Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and\n the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most\n useful object to place Policy status on, so we recommend that implementations\n SHOULD use Gateway as the PolicyAncestorStatus object unless the designers\n have a _very_ good reason otherwise.\n\n In the context of policy attachment, the Ancestor is used to distinguish which\n resource results in a distinct application of this policy. For example, if a policy\n targets a Service, it may have a distinct result per attached Gateway.\n\n Policies targeting the same resource may have different effects depending on the\n ancestors of those resources. For example, different Gateways targeting the same\n Service may have different capabilities, especially if they have different underlying\n implementations.\n\n For example, in BackendTLSPolicy, the Policy attaches to a Service that is\n used as a backend in a HTTPRoute that is itself attached to a Gateway.\n In this case, the relevant object for status is the Gateway, and that is the\n ancestor object referred to in this status.\n\n Note that a parent is also an ancestor, so for objects where the parent is the\n relevant object for status, this struct SHOULD still be used.\n\n This struct is intended to be used in a slice that's effectively a map,\n with a composite key made up of the AncestorRef and the ControllerName.\n properties:\n ancestorRef:\n description: |-\n AncestorRef corresponds with a ParentRef in the spec that this\n PolicyAncestorStatus struct describes the status of.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: |-\n Group is the group of the referent.\n When unspecified, \"gateway.networking.k8s.io\" is inferred.\n To set the core API group (such as for a \"Service\" kind referent),\n Group must be explicitly set to \"\" (empty string).\n\n Support: Core\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Gateway\n description: |-\n Kind is kind of the referent.\n\n There are two kinds of parent resources with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n Support for other resources is Implementation-Specific.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: |-\n Name is the name of the referent.\n\n Support: Core\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referent. When unspecified, this refers\n to the local namespace of the Route.\n\n Note that there are specific rules for ParentRefs which cross namespace\n boundaries. Cross-namespace references are only valid if they are explicitly\n allowed by something in the namespace they are referring to. For example:\n Gateway has the AllowedRoutes field, and ReferenceGrant provides a\n generic way to enable any other kind of cross-namespace reference.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port is the network port this Route targets. It can be interpreted\n differently based on the type of parent resource.\n\n When the parent resource is a Gateway, this targets all listeners\n listening on the specified port that also support this kind of Route(and\n select this Route). It's not recommended to set `Port` unless the\n networking behaviors specified in a Route must apply to a specific port\n as opposed to a listener(s) whose port(s) may be changed. When both Port\n and SectionName are specified, the name and port of the selected listener\n must match both specified values.\n\n Implementations MAY choose to support other parent resources.\n Implementations supporting other types of parent resources MUST clearly\n document how/if Port is interpreted.\n\n For the purpose of status, an attachment is considered successful as\n long as the parent resource accepts it partially. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment\n from the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route,\n the Route MUST be considered detached from the Gateway.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n sectionName:\n description: |-\n SectionName is the name of a section within the target resource. In the\n following resources, SectionName is interpreted as the following:\n\n * Gateway: Listener name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n * Service: Port name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n\n Implementations MAY choose to support attaching Routes to other resources.\n If that is the case, they MUST clearly document how SectionName is\n interpreted.\n\n When unspecified (empty string), this will reference the entire resource.\n For the purpose of status, an attachment is considered successful if at\n least one section in the parent resource accepts it. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\n the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route, the\n Route MUST be considered detached from the Gateway.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n required:\n - name\n type: object\n conditions:\n description: Conditions describes the status of the Policy with\n respect to the given Ancestor.\n items:\n description: Condition contains details for one aspect of\n the current state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False,\n Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n maxItems: 8\n minItems: 1\n type: array\n x-kubernetes-list-map-keys:\n - type\n x-kubernetes-list-type: map\n controllerName:\n description: |-\n ControllerName is a domain/path string that indicates the name of the\n controller that wrote this status. This corresponds with the\n controllerName field on GatewayClass.\n\n Example: \"example.net/gateway-controller\".\n\n The format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\n valid Kubernetes names\n (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\n Controllers MUST populate this field when writing status. Controllers should ensure that\n entries to status populated with their ControllerName are cleaned up when they are no\n longer necessary.\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$\n type: string\n required:\n - ancestorRef\n - conditions\n - controllerName\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n required:\n - ancestors\n type: object\n required:\n - spec\n type: object\n served: false\n storage: false\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: null\n storedVersions: null\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328\n gateway.networking.k8s.io/bundle-version: v1.4.0\n gateway.networking.k8s.io/channel: standard\n name: gatewayclasses.gateway.networking.k8s.io\nspec:\n group: gateway.networking.k8s.io\n names:\n categories:\n - gateway-api\n kind: GatewayClass\n listKind: GatewayClassList\n plural: gatewayclasses\n shortNames:\n - gc\n singular: gatewayclass\n scope: Cluster\n versions:\n - additionalPrinterColumns:\n - jsonPath: .spec.controllerName\n name: Controller\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Accepted\")].status\n name: Accepted\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .spec.description\n name: Description\n priority: 1\n type: string\n name: v1\n schema:\n openAPIV3Schema:\n description: |-\n GatewayClass describes a class of Gateways available to the user for creating\n Gateway resources.\n\n It is recommended that this resource be used as a template for Gateways. This\n means that a Gateway is based on the state of the GatewayClass at the time it\n was created and changes to the GatewayClass or associated parameters are not\n propagated down to existing Gateways. This recommendation is intended to\n limit the blast radius of changes to GatewayClass or associated parameters.\n If implementations choose to propagate GatewayClass changes to existing\n Gateways, that MUST be clearly documented by the implementation.\n\n Whenever one or more Gateways are using a GatewayClass, implementations SHOULD\n add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the\n associated GatewayClass. This ensures that a GatewayClass associated with a\n Gateway is not deleted while in use.\n\n GatewayClass is a Cluster level resource.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: Spec defines the desired state of GatewayClass.\n properties:\n controllerName:\n description: |-\n ControllerName is the name of the controller that is managing Gateways of\n this class. The value of this field MUST be a domain prefixed path.\n\n Example: \"example.net/gateway-controller\".\n\n This field is not mutable and cannot be empty.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$\n type: string\n x-kubernetes-validations:\n - message: Value is immutable\n rule: self == oldSelf\n description:\n description: Description helps describe a GatewayClass with more details.\n maxLength: 64\n type: string\n parametersRef:\n description: |-\n ParametersRef is a reference to a resource that contains the configuration\n parameters corresponding to the GatewayClass. This is optional if the\n controller does not require any additional configuration.\n\n ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,\n or an implementation-specific custom resource. The resource can be\n cluster-scoped or namespace-scoped.\n\n If the referent cannot be found, refers to an unsupported kind, or when\n the data within that resource is malformed, the GatewayClass SHOULD be\n rejected with the \"Accepted\" status condition set to \"False\" and an\n \"InvalidParameters\" reason.\n\n A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,\n the merging behavior is implementation specific.\n It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.\n\n Support: Implementation-specific\n properties:\n group:\n description: Group is the group of the referent.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referent.\n This field is required when referring to a Namespace-scoped resource and\n MUST be unset when referring to a Cluster-scoped resource.\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n required:\n - group\n - kind\n - name\n type: object\n required:\n - controllerName\n type: object\n status:\n default:\n conditions:\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Accepted\n description: |-\n Status defines the current state of GatewayClass.\n\n Implementations MUST populate status on all GatewayClass resources which\n specify their controller name.\n properties:\n conditions:\n default:\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Accepted\n description: |-\n Conditions is the current status from the controller for\n this GatewayClass.\n\n Controllers should prefer to publish conditions using values\n of GatewayClassConditionType for the type of each Condition.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-map-keys:\n - type\n x-kubernetes-list-type: map\n supportedFeatures:\n description: |-\n SupportedFeatures is the set of features the GatewayClass support.\n It MUST be sorted in ascending alphabetical order by the Name key.\n items:\n properties:\n name:\n description: |-\n FeatureName is used to describe distinct features that are covered by\n conformance tests.\n type: string\n required:\n - name\n type: object\n maxItems: 64\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n required:\n - spec\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .spec.controllerName\n name: Controller\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Accepted\")].status\n name: Accepted\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n - jsonPath: .spec.description\n name: Description\n priority: 1\n type: string\n name: v1beta1\n schema:\n openAPIV3Schema:\n description: |-\n GatewayClass describes a class of Gateways available to the user for creating\n Gateway resources.\n\n It is recommended that this resource be used as a template for Gateways. This\n means that a Gateway is based on the state of the GatewayClass at the time it\n was created and changes to the GatewayClass or associated parameters are not\n propagated down to existing Gateways. This recommendation is intended to\n limit the blast radius of changes to GatewayClass or associated parameters.\n If implementations choose to propagate GatewayClass changes to existing\n Gateways, that MUST be clearly documented by the implementation.\n\n Whenever one or more Gateways are using a GatewayClass, implementations SHOULD\n add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the\n associated GatewayClass. This ensures that a GatewayClass associated with a\n Gateway is not deleted while in use.\n\n GatewayClass is a Cluster level resource.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: Spec defines the desired state of GatewayClass.\n properties:\n controllerName:\n description: |-\n ControllerName is the name of the controller that is managing Gateways of\n this class. The value of this field MUST be a domain prefixed path.\n\n Example: \"example.net/gateway-controller\".\n\n This field is not mutable and cannot be empty.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$\n type: string\n x-kubernetes-validations:\n - message: Value is immutable\n rule: self == oldSelf\n description:\n description: Description helps describe a GatewayClass with more details.\n maxLength: 64\n type: string\n parametersRef:\n description: |-\n ParametersRef is a reference to a resource that contains the configuration\n parameters corresponding to the GatewayClass. This is optional if the\n controller does not require any additional configuration.\n\n ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,\n or an implementation-specific custom resource. The resource can be\n cluster-scoped or namespace-scoped.\n\n If the referent cannot be found, refers to an unsupported kind, or when\n the data within that resource is malformed, the GatewayClass SHOULD be\n rejected with the \"Accepted\" status condition set to \"False\" and an\n \"InvalidParameters\" reason.\n\n A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,\n the merging behavior is implementation specific.\n It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.\n\n Support: Implementation-specific\n properties:\n group:\n description: Group is the group of the referent.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referent.\n This field is required when referring to a Namespace-scoped resource and\n MUST be unset when referring to a Cluster-scoped resource.\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n required:\n - group\n - kind\n - name\n type: object\n required:\n - controllerName\n type: object\n status:\n default:\n conditions:\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Accepted\n description: |-\n Status defines the current state of GatewayClass.\n\n Implementations MUST populate status on all GatewayClass resources which\n specify their controller name.\n properties:\n conditions:\n default:\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Accepted\n description: |-\n Conditions is the current status from the controller for\n this GatewayClass.\n\n Controllers should prefer to publish conditions using values\n of GatewayClassConditionType for the type of each Condition.\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-map-keys:\n - type\n x-kubernetes-list-type: map\n supportedFeatures:\n description: |-\n SupportedFeatures is the set of features the GatewayClass support.\n It MUST be sorted in ascending alphabetical order by the Name key.\n items:\n properties:\n name:\n description: |-\n FeatureName is used to describe distinct features that are covered by\n conformance tests.\n type: string\n required:\n - name\n type: object\n maxItems: 64\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n required:\n - spec\n type: object\n served: true\n storage: false\n subresources:\n status: {}\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: null\n storedVersions: null\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328\n gateway.networking.k8s.io/bundle-version: v1.4.0\n gateway.networking.k8s.io/channel: standard\n name: gateways.gateway.networking.k8s.io\nspec:\n group: gateway.networking.k8s.io\n names:\n categories:\n - gateway-api\n kind: Gateway\n listKind: GatewayList\n plural: gateways\n shortNames:\n - gtw\n singular: gateway\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .spec.gatewayClassName\n name: Class\n type: string\n - jsonPath: .status.addresses[*].value\n name: Address\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Programmed\")].status\n name: Programmed\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1\n schema:\n openAPIV3Schema:\n description: |-\n Gateway represents an instance of a service-traffic handling infrastructure\n by binding Listeners to a set of IP addresses.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: Spec defines the desired state of Gateway.\n properties:\n addresses:\n description: |-\n Addresses requested for this Gateway. This is optional and behavior can\n depend on the implementation. If a value is set in the spec and the\n requested address is invalid or unavailable, the implementation MUST\n indicate this in an associated entry in GatewayStatus.Conditions.\n\n The Addresses field represents a request for the address(es) on the\n \"outside of the Gateway\", that traffic bound for this Gateway will use.\n This could be the IP address or hostname of an external load balancer or\n other networking infrastructure, or some other address that traffic will\n be sent to.\n\n If no Addresses are specified, the implementation MAY schedule the\n Gateway in an implementation-specific manner, assigning an appropriate\n set of Addresses.\n\n The implementation MUST bind all Listeners to every GatewayAddress that\n it assigns to the Gateway and add a corresponding entry in\n GatewayStatus.Addresses.\n\n Support: Extended\n items:\n description: GatewaySpecAddress describes an address that can be\n bound to a Gateway.\n oneOf:\n - properties:\n type:\n enum:\n - IPAddress\n value:\n anyOf:\n - format: ipv4\n - format: ipv6\n - properties:\n type:\n not:\n enum:\n - IPAddress\n properties:\n type:\n default: IPAddress\n description: Type of the address.\n maxLength: 253\n minLength: 1\n pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$\n type: string\n value:\n description: |-\n When a value is unspecified, an implementation SHOULD automatically\n assign an address matching the requested type if possible.\n\n If an implementation does not support an empty value, they MUST set the\n \"Programmed\" condition in status to False with a reason of \"AddressNotAssigned\".\n\n Examples: `1.2.3.4`, `128::1`, `my-ip-address`.\n maxLength: 253\n type: string\n type: object\n x-kubernetes-validations:\n - message: Hostname value must be empty or contain only valid characters\n (matching ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)\n rule: 'self.type == ''Hostname'' ? (!has(self.value) || self.value.matches(r\"\"\"^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\"\"\")):\n true'\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: IPAddress values must be unique\n rule: \"self.all(a1, a1.type == 'IPAddress' && has(a1.value) ?\n self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value\n == a1.value) : true )\"\n - message: Hostname values must be unique\n rule: \"self.all(a1, a1.type == 'Hostname' && has(a1.value) ?\n self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value\n == a1.value) : true )\"\n gatewayClassName:\n description: |-\n GatewayClassName used for this Gateway. This is the name of a\n GatewayClass resource.\n maxLength: 253\n minLength: 1\n type: string\n infrastructure:\n description: |-\n Infrastructure defines infrastructure level attributes about this Gateway instance.\n\n Support: Extended\n properties:\n annotations:\n additionalProperties:\n description: |-\n AnnotationValue is the value of an annotation in Gateway API. This is used\n for validation of maps such as TLS options. This roughly matches Kubernetes\n annotation validation, although the length validation in that case is based\n on the entire size of the annotations struct.\n maxLength: 4096\n minLength: 0\n type: string\n description: |-\n Annotations that SHOULD be applied to any resources created in response to this Gateway.\n\n For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources.\n For other implementations, this refers to any relevant (implementation specific) \"annotations\" concepts.\n\n An implementation may chose to add additional implementation-specific annotations as they see fit.\n\n Support: Extended\n maxProperties: 8\n type: object\n x-kubernetes-validations:\n - message: Annotation keys must be in the form of an optional\n DNS subdomain prefix followed by a required name segment of\n up to 63 characters.\n rule: self.all(key, key.matches(r\"\"\"^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$\"\"\"))\n - message: If specified, the annotation key's prefix must be a\n DNS subdomain not longer than 253 characters in total.\n rule: self.all(key, key.split(\"/\")[0].size() < 253)\n labels:\n additionalProperties:\n description: |-\n LabelValue is the value of a label in the Gateway API. This is used for validation\n of maps such as Gateway infrastructure labels. This matches the Kubernetes\n label validation rules:\n * must be 63 characters or less (can be empty),\n * unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),\n * could contain dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n Valid values include:\n\n * MyValue\n * my.name\n * 123-my-value\n maxLength: 63\n minLength: 0\n pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\n type: string\n description: |-\n Labels that SHOULD be applied to any resources created in response to this Gateway.\n\n For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources.\n For other implementations, this refers to any relevant (implementation specific) \"labels\" concepts.\n\n An implementation may chose to add additional implementation-specific labels as they see fit.\n\n If an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels\n change, it SHOULD clearly warn about this behavior in documentation.\n\n Support: Extended\n maxProperties: 8\n type: object\n x-kubernetes-validations:\n - message: Label keys must be in the form of an optional DNS subdomain\n prefix followed by a required name segment of up to 63 characters.\n rule: self.all(key, key.matches(r\"\"\"^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$\"\"\"))\n - message: If specified, the label key's prefix must be a DNS\n subdomain not longer than 253 characters in total.\n rule: self.all(key, key.split(\"/\")[0].size() < 253)\n parametersRef:\n description: |-\n ParametersRef is a reference to a resource that contains the configuration\n parameters corresponding to the Gateway. This is optional if the\n controller does not require any additional configuration.\n\n This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis\n\n The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified,\n the merging behavior is implementation specific.\n It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.\n\n If the referent cannot be found, refers to an unsupported kind, or when\n the data within that resource is malformed, the Gateway SHOULD be\n rejected with the \"Accepted\" status condition set to \"False\" and an\n \"InvalidParameters\" reason.\n\n Support: Implementation-specific\n properties:\n group:\n description: Group is the group of the referent.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - group\n - kind\n - name\n type: object\n type: object\n listeners:\n description: |-\n Listeners associated with this Gateway. Listeners define\n logical endpoints that are bound on this Gateway's addresses.\n At least one Listener MUST be specified.\n\n ## Distinct Listeners\n\n Each Listener in a set of Listeners (for example, in a single Gateway)\n MUST be _distinct_, in that a traffic flow MUST be able to be assigned to\n exactly one listener. (This section uses \"set of Listeners\" rather than\n \"Listeners in a single Gateway\" because implementations MAY merge configuration\n from multiple Gateways onto a single data plane, and these rules _also_\n apply in that case).\n\n Practically, this means that each listener in a set MUST have a unique\n combination of Port, Protocol, and, if supported by the protocol, Hostname.\n\n Some combinations of port, protocol, and TLS settings are considered\n Core support and MUST be supported by implementations based on the objects\n they support:\n\n HTTPRoute\n\n 1. HTTPRoute, Port: 80, Protocol: HTTP\n 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided\n\n TLSRoute\n\n 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough\n\n \"Distinct\" Listeners have the following property:\n\n **The implementation can match inbound requests to a single distinct\n Listener**.\n\n When multiple Listeners share values for fields (for\n example, two Listeners with the same Port value), the implementation\n can match requests to only one of the Listeners using other\n Listener fields.\n\n When multiple listeners have the same value for the Protocol field, then\n each of the Listeners with matching Protocol values MUST have different\n values for other fields.\n\n The set of fields that MUST be different for a Listener differs per protocol.\n The following rules define the rules for what fields MUST be considered for\n Listeners to be distinct with each protocol currently defined in the\n Gateway API spec.\n\n The set of listeners that all share a protocol value MUST have _different_\n values for _at least one_ of these fields to be distinct:\n\n * **HTTP, HTTPS, TLS**: Port, Hostname\n * **TCP, UDP**: Port\n\n One **very** important rule to call out involves what happens when an\n implementation:\n\n * Supports TCP protocol Listeners, as well as HTTP, HTTPS, or TLS protocol\n Listeners, and\n * sees HTTP, HTTPS, or TLS protocols with the same `port` as one with TCP\n Protocol.\n\n In this case all the Listeners that share a port with the\n TCP Listener are not distinct and so MUST NOT be accepted.\n\n If an implementation does not support TCP Protocol Listeners, then the\n previous rule does not apply, and the TCP Listeners SHOULD NOT be\n accepted.\n\n Note that the `tls` field is not used for determining if a listener is distinct, because\n Listeners that _only_ differ on TLS config will still conflict in all cases.\n\n ### Listeners that are distinct only by Hostname\n\n When the Listeners are distinct based only on Hostname, inbound request\n hostnames MUST match from the most specific to least specific Hostname\n values to choose the correct Listener and its associated set of Routes.\n\n Exact matches MUST be processed before wildcard matches, and wildcard\n matches MUST be processed before fallback (empty Hostname value)\n matches. For example, `\"foo.example.com\"` takes precedence over\n `\"*.example.com\"`, and `\"*.example.com\"` takes precedence over `\"\"`.\n\n Additionally, if there are multiple wildcard entries, more specific\n wildcard entries must be processed before less specific wildcard entries.\n For example, `\"*.foo.example.com\"` takes precedence over `\"*.example.com\"`.\n\n The precise definition here is that the higher the number of dots in the\n hostname to the right of the wildcard character, the higher the precedence.\n\n The wildcard character will match any number of characters _and dots_ to\n the left, however, so `\"*.example.com\"` will match both\n `\"foo.bar.example.com\"` _and_ `\"bar.example.com\"`.\n\n ## Handling indistinct Listeners\n\n If a set of Listeners contains Listeners that are not distinct, then those\n Listeners are _Conflicted_, and the implementation MUST set the \"Conflicted\"\n condition in the Listener Status to \"True\".\n\n The words \"indistinct\" and \"conflicted\" are considered equivalent for the\n purpose of this documentation.\n\n Implementations MAY choose to accept a Gateway with some Conflicted\n Listeners only if they only accept the partial Listener set that contains\n no Conflicted Listeners.\n\n Specifically, an implementation MAY accept a partial Listener set subject to\n the following rules:\n\n * The implementation MUST NOT pick one conflicting Listener as the winner.\n ALL indistinct Listeners must not be accepted for processing.\n * At least one distinct Listener MUST be present, or else the Gateway effectively\n contains _no_ Listeners, and must be rejected from processing as a whole.\n\n The implementation MUST set a \"ListenersNotValid\" condition on the\n Gateway Status when the Gateway contains Conflicted Listeners whether or\n not they accept the Gateway. That Condition SHOULD clearly\n indicate in the Message which Listeners are conflicted, and which are\n Accepted. Additionally, the Listener status for those listeners SHOULD\n indicate which Listeners are conflicted and not Accepted.\n\n ## General Listener behavior\n\n Note that, for all distinct Listeners, requests SHOULD match at most one Listener.\n For example, if Listeners are defined for \"foo.example.com\" and \"*.example.com\", a\n request to \"foo.example.com\" SHOULD only be routed using routes attached\n to the \"foo.example.com\" Listener (and not the \"*.example.com\" Listener).\n\n This concept is known as \"Listener Isolation\", and it is an Extended feature\n of Gateway API. Implementations that do not support Listener Isolation MUST\n clearly document this, and MUST NOT claim support for the\n `GatewayHTTPListenerIsolation` feature.\n\n Implementations that _do_ support Listener Isolation SHOULD claim support\n for the Extended `GatewayHTTPListenerIsolation` feature and pass the associated\n conformance tests.\n\n ## Compatible Listeners\n\n A Gateway's Listeners are considered _compatible_ if:\n\n 1. They are distinct.\n 2. The implementation can serve them in compliance with the Addresses\n requirement that all Listeners are available on all assigned\n addresses.\n\n Compatible combinations in Extended support are expected to vary across\n implementations. A combination that is compatible for one implementation\n may not be compatible for another.\n\n For example, an implementation that cannot serve both TCP and UDP listeners\n on the same address, or cannot mix HTTPS and generic TLS listens on the same port\n would not consider those cases compatible, even though they are distinct.\n\n Implementations MAY merge separate Gateways onto a single set of\n Addresses if all Listeners across all Gateways are compatible.\n\n In a future release the MinItems=1 requirement MAY be dropped.\n\n Support: Core\n items:\n description: |-\n Listener embodies the concept of a logical endpoint where a Gateway accepts\n network connections.\n properties:\n allowedRoutes:\n default:\n namespaces:\n from: Same\n description: |-\n AllowedRoutes defines the types of routes that MAY be attached to a\n Listener and the trusted namespaces where those Route resources MAY be\n present.\n\n Although a client request may match multiple route rules, only one rule\n may ultimately receive the request. Matching precedence MUST be\n determined in order of the following criteria:\n\n * The most specific match as defined by the Route type.\n * The oldest Route based on creation timestamp. For example, a Route with\n a creation timestamp of \"2020-09-08 01:02:03\" is given precedence over\n a Route with a creation timestamp of \"2020-09-08 01:02:04\".\n * If everything else is equivalent, the Route appearing first in\n alphabetical order (namespace/name) should be given precedence. For\n example, foo/bar is given precedence over foo/baz.\n\n All valid rules within a Route attached to this Listener should be\n implemented. Invalid Route rules can be ignored (sometimes that will mean\n the full Route). If a Route rule transitions from valid to invalid,\n support for that Route rule should be dropped to ensure consistency. For\n example, even if a filter specified by a Route rule is invalid, the rest\n of the rules within that Route should still be supported.\n\n Support: Core\n properties:\n kinds:\n description: |-\n Kinds specifies the groups and kinds of Routes that are allowed to bind\n to this Gateway Listener. When unspecified or empty, the kinds of Routes\n selected are determined using the Listener protocol.\n\n A RouteGroupKind MUST correspond to kinds of Routes that are compatible\n with the application protocol specified in the Listener's Protocol field.\n If an implementation does not support or recognize this resource type, it\n MUST set the \"ResolvedRefs\" condition to False for this Listener with the\n \"InvalidRouteKinds\" reason.\n\n Support: Core\n items:\n description: RouteGroupKind indicates the group and kind\n of a Route resource.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: Group is the group of the Route.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is the kind of the Route.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n required:\n - kind\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-type: atomic\n namespaces:\n default:\n from: Same\n description: |-\n Namespaces indicates namespaces from which Routes may be attached to this\n Listener. This is restricted to the namespace of this Gateway by default.\n\n Support: Core\n properties:\n from:\n default: Same\n description: |-\n From indicates where Routes will be selected for this Gateway. Possible\n values are:\n\n * All: Routes in all namespaces may be used by this Gateway.\n * Selector: Routes in namespaces selected by the selector may be used by\n this Gateway.\n * Same: Only Routes in the same namespace may be used by this Gateway.\n\n Support: Core\n enum:\n - All\n - Selector\n - Same\n type: string\n selector:\n description: |-\n Selector must be specified when From is set to \"Selector\". In that case,\n only Routes in Namespaces matching this Selector will be selected by this\n Gateway. This field is ignored for other values of \"From\".\n\n Support: Core\n properties:\n matchExpressions:\n description: matchExpressions is a list of label\n selector requirements. The requirements are ANDed.\n items:\n description: |-\n A label selector requirement is a selector that contains values, a key, and an operator that\n relates the key and values.\n properties:\n key:\n description: key is the label key that the\n selector applies to.\n type: string\n operator:\n description: |-\n operator represents a key's relationship to a set of values.\n Valid operators are In, NotIn, Exists and DoesNotExist.\n type: string\n values:\n description: |-\n values is an array of string values. If the operator is In or NotIn,\n the values array must be non-empty. If the operator is Exists or DoesNotExist,\n the values array must be empty. This array is replaced during a strategic\n merge patch.\n items:\n type: string\n type: array\n x-kubernetes-list-type: atomic\n required:\n - key\n - operator\n type: object\n type: array\n x-kubernetes-list-type: atomic\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n type: object\n type: object\n x-kubernetes-map-type: atomic\n type: object\n type: object\n hostname:\n description: |-\n Hostname specifies the virtual hostname to match for protocol types that\n define this concept. When unspecified, all hostnames are matched. This\n field is ignored for protocols that don't require hostname based\n matching.\n\n Implementations MUST apply Hostname matching appropriately for each of\n the following protocols:\n\n * TLS: The Listener Hostname MUST match the SNI.\n * HTTP: The Listener Hostname MUST match the Host header of the request.\n * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.\n Note that this does not require the SNI and Host header to be the same.\n The semantics of this are described in more detail below.\n\n To ensure security, Section 11.1 of RFC-6066 emphasizes that server\n implementations that rely on SNI hostname matching MUST also verify\n hostnames within the application protocol.\n\n Section 9.1.2 of RFC-7540 provides a mechanism for servers to reject the\n reuse of a connection by responding with the HTTP 421 Misdirected Request\n status code. This indicates that the origin server has rejected the\n request because it appears to have been misdirected.\n\n To detect misdirected requests, Gateways SHOULD match the authority of\n the requests with all the SNI hostname(s) configured across all the\n Gateway Listeners on the same port and protocol:\n\n * If another Listener has an exact match or more specific wildcard entry,\n the Gateway SHOULD return a 421.\n * If the current Listener (selected by SNI matching during ClientHello)\n does not match the Host:\n * If another Listener does match the Host the Gateway SHOULD return a\n 421.\n * If no other Listener matches the Host, the Gateway MUST return a\n 404.\n\n For HTTPRoute and TLSRoute resources, there is an interaction with the\n `spec.hostnames` array. When both listener and route specify hostnames,\n there MUST be an intersection between the values for a Route to be\n accepted. For more information, refer to the Route specific Hostnames\n documentation.\n\n Hostnames that are prefixed with a wildcard label (`*.`) are interpreted\n as a suffix match. That means that a match for `*.example.com` would match\n both `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n name:\n description: |-\n Name is the name of the Listener. This name MUST be unique within a\n Gateway.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n port:\n description: |-\n Port is the network port. Multiple listeners may use the\n same port, subject to the Listener compatibility rules.\n\n Support: Core\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n protocol:\n description: |-\n Protocol specifies the network protocol this listener expects to receive.\n\n Support: Core\n maxLength: 255\n minLength: 1\n pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9]+$\n type: string\n tls:\n description: |-\n TLS is the TLS configuration for the Listener. This field is required if\n the Protocol field is \"HTTPS\" or \"TLS\". It is invalid to set this field\n if the Protocol field is \"HTTP\", \"TCP\", or \"UDP\".\n\n The association of SNIs to Certificate defined in ListenerTLSConfig is\n defined based on the Hostname field for this listener.\n\n The GatewayClass MUST use the longest matching SNI out of all\n available certificates for any TLS handshake.\n\n Support: Core\n properties:\n certificateRefs:\n description: |-\n CertificateRefs contains a series of references to Kubernetes objects that\n contains TLS certificates and private keys. These certificates are used to\n establish a TLS handshake for requests that match the hostname of the\n associated listener.\n\n A single CertificateRef to a Kubernetes Secret has \"Core\" support.\n Implementations MAY choose to support attaching multiple certificates to\n a Listener, but this behavior is implementation-specific.\n\n References to a resource in different namespace are invalid UNLESS there\n is a ReferenceGrant in the target namespace that allows the certificate\n to be attached. If a ReferenceGrant does not allow this reference, the\n \"ResolvedRefs\" condition MUST be set to False for this listener with the\n \"RefNotPermitted\" reason.\n\n This field is required to have at least one element when the mode is set\n to \"Terminate\" (default) and is optional otherwise.\n\n CertificateRefs can reference to standard Kubernetes resources, i.e.\n Secret, or implementation-specific custom resources.\n\n Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls\n\n Support: Implementation-specific (More than one reference or other resource types)\n items:\n description: |-\n SecretObjectReference identifies an API object including its namespace,\n defaulting to Secret.\n\n The API object must be valid in the cluster; the Group and Kind must\n be registered in the cluster for this reference to be valid.\n\n References to objects with invalid Group and Kind are not valid, and must\n be rejected by the implementation, with appropriate Conditions set\n on the containing object.\n properties:\n group:\n default: \"\"\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Secret\n description: Kind is kind of the referent. For example\n \"Secret\".\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referenced object. When unspecified, the local\n namespace is inferred.\n\n Note that when a namespace different than the local namespace is specified,\n a ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n required:\n - name\n type: object\n maxItems: 64\n type: array\n x-kubernetes-list-type: atomic\n mode:\n default: Terminate\n description: |-\n Mode defines the TLS behavior for the TLS session initiated by the client.\n There are two possible modes:\n\n - Terminate: The TLS session between the downstream client and the\n Gateway is terminated at the Gateway. This mode requires certificates\n to be specified in some way, such as populating the certificateRefs\n field.\n - Passthrough: The TLS session is NOT terminated by the Gateway. This\n implies that the Gateway can't decipher the TLS stream except for\n the ClientHello message of the TLS protocol. The certificateRefs field\n is ignored in this mode.\n\n Support: Core\n enum:\n - Terminate\n - Passthrough\n type: string\n options:\n additionalProperties:\n description: |-\n AnnotationValue is the value of an annotation in Gateway API. This is used\n for validation of maps such as TLS options. This roughly matches Kubernetes\n annotation validation, although the length validation in that case is based\n on the entire size of the annotations struct.\n maxLength: 4096\n minLength: 0\n type: string\n description: |-\n Options are a list of key/value pairs to enable extended TLS\n configuration for each implementation. For example, configuring the\n minimum TLS version or supported cipher suites.\n\n A set of common keys MAY be defined by the API in the future. To avoid\n any ambiguity, implementation-specific definitions MUST use\n domain-prefixed names, such as `example.com/my-custom-option`.\n Un-prefixed names are reserved for key names defined by Gateway API.\n\n Support: Implementation-specific\n maxProperties: 16\n type: object\n type: object\n x-kubernetes-validations:\n - message: certificateRefs or options must be specified when\n mode is Terminate\n rule: \"self.mode == 'Terminate' ? size(self.certificateRefs)\n > 0 || size(self.options) > 0 : true\"\n required:\n - name\n - port\n - protocol\n type: object\n maxItems: 64\n minItems: 1\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n x-kubernetes-validations:\n - message: tls must not be specified for protocols ['HTTP', 'TCP',\n 'UDP']\n rule: \"self.all(l, l.protocol in ['HTTP', 'TCP', 'UDP'] ?\n !has(l.tls) : true)\"\n - message: tls mode must be Terminate for protocol HTTPS\n rule: \"self.all(l, (l.protocol == 'HTTPS' && has(l.tls)) ? (l.tls.mode\n == '' || l.tls.mode == 'Terminate') : true)\"\n - message: hostname must not be specified for protocols ['TCP', 'UDP']\n rule: \"self.all(l, l.protocol in ['TCP', 'UDP'] ? (!has(l.hostname)\n || l.hostname == '') : true)\"\n - message: Listener name must be unique within the Gateway\n rule: self.all(l1, self.exists_one(l2, l1.name == l2.name))\n - message: Combination of port, protocol and hostname must be unique\n for each listener\n rule: \"self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol\n == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname\n == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))\"\n required:\n - gatewayClassName\n - listeners\n type: object\n status:\n default:\n conditions:\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Accepted\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Programmed\n description: Status defines the current state of Gateway.\n properties:\n addresses:\n description: |-\n Addresses lists the network addresses that have been bound to the\n Gateway.\n\n This list may differ from the addresses provided in the spec under some\n conditions:\n\n * no addresses are specified, all addresses are dynamically assigned\n * a combination of specified and dynamic addresses are assigned\n * a specified address was unusable (e.g. already in use)\n items:\n description: GatewayStatusAddress describes a network address that\n is bound to a Gateway.\n oneOf:\n - properties:\n type:\n enum:\n - IPAddress\n value:\n anyOf:\n - format: ipv4\n - format: ipv6\n - properties:\n type:\n not:\n enum:\n - IPAddress\n properties:\n type:\n default: IPAddress\n description: Type of the address.\n maxLength: 253\n minLength: 1\n pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$\n type: string\n value:\n description: |-\n Value of the address. The validity of the values will depend\n on the type and support by the controller.\n\n Examples: `1.2.3.4`, `128::1`, `my-ip-address`.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - value\n type: object\n x-kubernetes-validations:\n - message: Hostname value must only contain valid characters (matching\n ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)\n rule: 'self.type == ''Hostname'' ? self.value.matches(r\"\"\"^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\"\"\"):\n true'\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n conditions:\n default:\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Accepted\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Programmed\n description: |-\n Conditions describe the current conditions of the Gateway.\n\n Implementations should prefer to express Gateway conditions\n using the `GatewayConditionType` and `GatewayConditionReason`\n constants so that operators and tools can converge on a common\n vocabulary to describe Gateway state.\n\n Known condition types are:\n\n * \"Accepted\"\n * \"Programmed\"\n * \"Ready\"\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-map-keys:\n - type\n x-kubernetes-list-type: map\n listeners:\n description: Listeners provide status for each unique listener port\n defined in the Spec.\n items:\n description: ListenerStatus is the status associated with a Listener.\n properties:\n attachedRoutes:\n description: |-\n AttachedRoutes represents the total number of Routes that have been\n successfully attached to this Listener.\n\n Successful attachment of a Route to a Listener is based solely on the\n combination of the AllowedRoutes field on the corresponding Listener\n and the Route's ParentRefs field. A Route is successfully attached to\n a Listener when it is selected by the Listener's AllowedRoutes field\n AND the Route has a valid ParentRef selecting the whole Gateway\n resource or a specific Listener as a parent resource (more detail on\n attachment semantics can be found in the documentation on the various\n Route kinds ParentRefs fields). Listener or Route status does not impact\n successful attachment, i.e. the AttachedRoutes field count MUST be set\n for Listeners with condition Accepted: false and MUST count successfully\n attached Routes that may themselves have Accepted: false conditions.\n\n Uses for this field include troubleshooting Route attachment and\n measuring blast radius/impact of changes to a Listener.\n format: int32\n type: integer\n conditions:\n description: Conditions describe the current condition of this\n listener.\n items:\n description: Condition contains details for one aspect of\n the current state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False,\n Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-map-keys:\n - type\n x-kubernetes-list-type: map\n name:\n description: Name is the name of the Listener that this status\n corresponds to.\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n supportedKinds:\n description: |-\n SupportedKinds is the list indicating the Kinds supported by this\n listener. This MUST represent the kinds an implementation supports for\n that Listener configuration.\n\n If kinds are specified in Spec that are not supported, they MUST NOT\n appear in this list and an implementation MUST set the \"ResolvedRefs\"\n condition to \"False\" with the \"InvalidRouteKinds\" reason. If both valid\n and invalid Route kinds are specified, the implementation MUST\n reference the valid Route kinds that have been specified.\n items:\n description: RouteGroupKind indicates the group and kind of\n a Route resource.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: Group is the group of the Route.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is the kind of the Route.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n required:\n - kind\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-type: atomic\n required:\n - attachedRoutes\n - conditions\n - name\n - supportedKinds\n type: object\n maxItems: 64\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n required:\n - spec\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .spec.gatewayClassName\n name: Class\n type: string\n - jsonPath: .status.addresses[*].value\n name: Address\n type: string\n - jsonPath: .status.conditions[?(@.type==\"Programmed\")].status\n name: Programmed\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1beta1\n schema:\n openAPIV3Schema:\n description: |-\n Gateway represents an instance of a service-traffic handling infrastructure\n by binding Listeners to a set of IP addresses.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: Spec defines the desired state of Gateway.\n properties:\n addresses:\n description: |-\n Addresses requested for this Gateway. This is optional and behavior can\n depend on the implementation. If a value is set in the spec and the\n requested address is invalid or unavailable, the implementation MUST\n indicate this in an associated entry in GatewayStatus.Conditions.\n\n The Addresses field represents a request for the address(es) on the\n \"outside of the Gateway\", that traffic bound for this Gateway will use.\n This could be the IP address or hostname of an external load balancer or\n other networking infrastructure, or some other address that traffic will\n be sent to.\n\n If no Addresses are specified, the implementation MAY schedule the\n Gateway in an implementation-specific manner, assigning an appropriate\n set of Addresses.\n\n The implementation MUST bind all Listeners to every GatewayAddress that\n it assigns to the Gateway and add a corresponding entry in\n GatewayStatus.Addresses.\n\n Support: Extended\n items:\n description: GatewaySpecAddress describes an address that can be\n bound to a Gateway.\n oneOf:\n - properties:\n type:\n enum:\n - IPAddress\n value:\n anyOf:\n - format: ipv4\n - format: ipv6\n - properties:\n type:\n not:\n enum:\n - IPAddress\n properties:\n type:\n default: IPAddress\n description: Type of the address.\n maxLength: 253\n minLength: 1\n pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$\n type: string\n value:\n description: |-\n When a value is unspecified, an implementation SHOULD automatically\n assign an address matching the requested type if possible.\n\n If an implementation does not support an empty value, they MUST set the\n \"Programmed\" condition in status to False with a reason of \"AddressNotAssigned\".\n\n Examples: `1.2.3.4`, `128::1`, `my-ip-address`.\n maxLength: 253\n type: string\n type: object\n x-kubernetes-validations:\n - message: Hostname value must be empty or contain only valid characters\n (matching ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)\n rule: 'self.type == ''Hostname'' ? (!has(self.value) || self.value.matches(r\"\"\"^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\"\"\")):\n true'\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: IPAddress values must be unique\n rule: \"self.all(a1, a1.type == 'IPAddress' && has(a1.value) ?\n self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value\n == a1.value) : true )\"\n - message: Hostname values must be unique\n rule: \"self.all(a1, a1.type == 'Hostname' && has(a1.value) ?\n self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value\n == a1.value) : true )\"\n gatewayClassName:\n description: |-\n GatewayClassName used for this Gateway. This is the name of a\n GatewayClass resource.\n maxLength: 253\n minLength: 1\n type: string\n infrastructure:\n description: |-\n Infrastructure defines infrastructure level attributes about this Gateway instance.\n\n Support: Extended\n properties:\n annotations:\n additionalProperties:\n description: |-\n AnnotationValue is the value of an annotation in Gateway API. This is used\n for validation of maps such as TLS options. This roughly matches Kubernetes\n annotation validation, although the length validation in that case is based\n on the entire size of the annotations struct.\n maxLength: 4096\n minLength: 0\n type: string\n description: |-\n Annotations that SHOULD be applied to any resources created in response to this Gateway.\n\n For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources.\n For other implementations, this refers to any relevant (implementation specific) \"annotations\" concepts.\n\n An implementation may chose to add additional implementation-specific annotations as they see fit.\n\n Support: Extended\n maxProperties: 8\n type: object\n x-kubernetes-validations:\n - message: Annotation keys must be in the form of an optional\n DNS subdomain prefix followed by a required name segment of\n up to 63 characters.\n rule: self.all(key, key.matches(r\"\"\"^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$\"\"\"))\n - message: If specified, the annotation key's prefix must be a\n DNS subdomain not longer than 253 characters in total.\n rule: self.all(key, key.split(\"/\")[0].size() < 253)\n labels:\n additionalProperties:\n description: |-\n LabelValue is the value of a label in the Gateway API. This is used for validation\n of maps such as Gateway infrastructure labels. This matches the Kubernetes\n label validation rules:\n * must be 63 characters or less (can be empty),\n * unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),\n * could contain dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n Valid values include:\n\n * MyValue\n * my.name\n * 123-my-value\n maxLength: 63\n minLength: 0\n pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\n type: string\n description: |-\n Labels that SHOULD be applied to any resources created in response to this Gateway.\n\n For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources.\n For other implementations, this refers to any relevant (implementation specific) \"labels\" concepts.\n\n An implementation may chose to add additional implementation-specific labels as they see fit.\n\n If an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels\n change, it SHOULD clearly warn about this behavior in documentation.\n\n Support: Extended\n maxProperties: 8\n type: object\n x-kubernetes-validations:\n - message: Label keys must be in the form of an optional DNS subdomain\n prefix followed by a required name segment of up to 63 characters.\n rule: self.all(key, key.matches(r\"\"\"^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$\"\"\"))\n - message: If specified, the label key's prefix must be a DNS\n subdomain not longer than 253 characters in total.\n rule: self.all(key, key.split(\"/\")[0].size() < 253)\n parametersRef:\n description: |-\n ParametersRef is a reference to a resource that contains the configuration\n parameters corresponding to the Gateway. This is optional if the\n controller does not require any additional configuration.\n\n This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis\n\n The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified,\n the merging behavior is implementation specific.\n It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.\n\n If the referent cannot be found, refers to an unsupported kind, or when\n the data within that resource is malformed, the Gateway SHOULD be\n rejected with the \"Accepted\" status condition set to \"False\" and an\n \"InvalidParameters\" reason.\n\n Support: Implementation-specific\n properties:\n group:\n description: Group is the group of the referent.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - group\n - kind\n - name\n type: object\n type: object\n listeners:\n description: |-\n Listeners associated with this Gateway. Listeners define\n logical endpoints that are bound on this Gateway's addresses.\n At least one Listener MUST be specified.\n\n ## Distinct Listeners\n\n Each Listener in a set of Listeners (for example, in a single Gateway)\n MUST be _distinct_, in that a traffic flow MUST be able to be assigned to\n exactly one listener. (This section uses \"set of Listeners\" rather than\n \"Listeners in a single Gateway\" because implementations MAY merge configuration\n from multiple Gateways onto a single data plane, and these rules _also_\n apply in that case).\n\n Practically, this means that each listener in a set MUST have a unique\n combination of Port, Protocol, and, if supported by the protocol, Hostname.\n\n Some combinations of port, protocol, and TLS settings are considered\n Core support and MUST be supported by implementations based on the objects\n they support:\n\n HTTPRoute\n\n 1. HTTPRoute, Port: 80, Protocol: HTTP\n 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided\n\n TLSRoute\n\n 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough\n\n \"Distinct\" Listeners have the following property:\n\n **The implementation can match inbound requests to a single distinct\n Listener**.\n\n When multiple Listeners share values for fields (for\n example, two Listeners with the same Port value), the implementation\n can match requests to only one of the Listeners using other\n Listener fields.\n\n When multiple listeners have the same value for the Protocol field, then\n each of the Listeners with matching Protocol values MUST have different\n values for other fields.\n\n The set of fields that MUST be different for a Listener differs per protocol.\n The following rules define the rules for what fields MUST be considered for\n Listeners to be distinct with each protocol currently defined in the\n Gateway API spec.\n\n The set of listeners that all share a protocol value MUST have _different_\n values for _at least one_ of these fields to be distinct:\n\n * **HTTP, HTTPS, TLS**: Port, Hostname\n * **TCP, UDP**: Port\n\n One **very** important rule to call out involves what happens when an\n implementation:\n\n * Supports TCP protocol Listeners, as well as HTTP, HTTPS, or TLS protocol\n Listeners, and\n * sees HTTP, HTTPS, or TLS protocols with the same `port` as one with TCP\n Protocol.\n\n In this case all the Listeners that share a port with the\n TCP Listener are not distinct and so MUST NOT be accepted.\n\n If an implementation does not support TCP Protocol Listeners, then the\n previous rule does not apply, and the TCP Listeners SHOULD NOT be\n accepted.\n\n Note that the `tls` field is not used for determining if a listener is distinct, because\n Listeners that _only_ differ on TLS config will still conflict in all cases.\n\n ### Listeners that are distinct only by Hostname\n\n When the Listeners are distinct based only on Hostname, inbound request\n hostnames MUST match from the most specific to least specific Hostname\n values to choose the correct Listener and its associated set of Routes.\n\n Exact matches MUST be processed before wildcard matches, and wildcard\n matches MUST be processed before fallback (empty Hostname value)\n matches. For example, `\"foo.example.com\"` takes precedence over\n `\"*.example.com\"`, and `\"*.example.com\"` takes precedence over `\"\"`.\n\n Additionally, if there are multiple wildcard entries, more specific\n wildcard entries must be processed before less specific wildcard entries.\n For example, `\"*.foo.example.com\"` takes precedence over `\"*.example.com\"`.\n\n The precise definition here is that the higher the number of dots in the\n hostname to the right of the wildcard character, the higher the precedence.\n\n The wildcard character will match any number of characters _and dots_ to\n the left, however, so `\"*.example.com\"` will match both\n `\"foo.bar.example.com\"` _and_ `\"bar.example.com\"`.\n\n ## Handling indistinct Listeners\n\n If a set of Listeners contains Listeners that are not distinct, then those\n Listeners are _Conflicted_, and the implementation MUST set the \"Conflicted\"\n condition in the Listener Status to \"True\".\n\n The words \"indistinct\" and \"conflicted\" are considered equivalent for the\n purpose of this documentation.\n\n Implementations MAY choose to accept a Gateway with some Conflicted\n Listeners only if they only accept the partial Listener set that contains\n no Conflicted Listeners.\n\n Specifically, an implementation MAY accept a partial Listener set subject to\n the following rules:\n\n * The implementation MUST NOT pick one conflicting Listener as the winner.\n ALL indistinct Listeners must not be accepted for processing.\n * At least one distinct Listener MUST be present, or else the Gateway effectively\n contains _no_ Listeners, and must be rejected from processing as a whole.\n\n The implementation MUST set a \"ListenersNotValid\" condition on the\n Gateway Status when the Gateway contains Conflicted Listeners whether or\n not they accept the Gateway. That Condition SHOULD clearly\n indicate in the Message which Listeners are conflicted, and which are\n Accepted. Additionally, the Listener status for those listeners SHOULD\n indicate which Listeners are conflicted and not Accepted.\n\n ## General Listener behavior\n\n Note that, for all distinct Listeners, requests SHOULD match at most one Listener.\n For example, if Listeners are defined for \"foo.example.com\" and \"*.example.com\", a\n request to \"foo.example.com\" SHOULD only be routed using routes attached\n to the \"foo.example.com\" Listener (and not the \"*.example.com\" Listener).\n\n This concept is known as \"Listener Isolation\", and it is an Extended feature\n of Gateway API. Implementations that do not support Listener Isolation MUST\n clearly document this, and MUST NOT claim support for the\n `GatewayHTTPListenerIsolation` feature.\n\n Implementations that _do_ support Listener Isolation SHOULD claim support\n for the Extended `GatewayHTTPListenerIsolation` feature and pass the associated\n conformance tests.\n\n ## Compatible Listeners\n\n A Gateway's Listeners are considered _compatible_ if:\n\n 1. They are distinct.\n 2. The implementation can serve them in compliance with the Addresses\n requirement that all Listeners are available on all assigned\n addresses.\n\n Compatible combinations in Extended support are expected to vary across\n implementations. A combination that is compatible for one implementation\n may not be compatible for another.\n\n For example, an implementation that cannot serve both TCP and UDP listeners\n on the same address, or cannot mix HTTPS and generic TLS listens on the same port\n would not consider those cases compatible, even though they are distinct.\n\n Implementations MAY merge separate Gateways onto a single set of\n Addresses if all Listeners across all Gateways are compatible.\n\n In a future release the MinItems=1 requirement MAY be dropped.\n\n Support: Core\n items:\n description: |-\n Listener embodies the concept of a logical endpoint where a Gateway accepts\n network connections.\n properties:\n allowedRoutes:\n default:\n namespaces:\n from: Same\n description: |-\n AllowedRoutes defines the types of routes that MAY be attached to a\n Listener and the trusted namespaces where those Route resources MAY be\n present.\n\n Although a client request may match multiple route rules, only one rule\n may ultimately receive the request. Matching precedence MUST be\n determined in order of the following criteria:\n\n * The most specific match as defined by the Route type.\n * The oldest Route based on creation timestamp. For example, a Route with\n a creation timestamp of \"2020-09-08 01:02:03\" is given precedence over\n a Route with a creation timestamp of \"2020-09-08 01:02:04\".\n * If everything else is equivalent, the Route appearing first in\n alphabetical order (namespace/name) should be given precedence. For\n example, foo/bar is given precedence over foo/baz.\n\n All valid rules within a Route attached to this Listener should be\n implemented. Invalid Route rules can be ignored (sometimes that will mean\n the full Route). If a Route rule transitions from valid to invalid,\n support for that Route rule should be dropped to ensure consistency. For\n example, even if a filter specified by a Route rule is invalid, the rest\n of the rules within that Route should still be supported.\n\n Support: Core\n properties:\n kinds:\n description: |-\n Kinds specifies the groups and kinds of Routes that are allowed to bind\n to this Gateway Listener. When unspecified or empty, the kinds of Routes\n selected are determined using the Listener protocol.\n\n A RouteGroupKind MUST correspond to kinds of Routes that are compatible\n with the application protocol specified in the Listener's Protocol field.\n If an implementation does not support or recognize this resource type, it\n MUST set the \"ResolvedRefs\" condition to False for this Listener with the\n \"InvalidRouteKinds\" reason.\n\n Support: Core\n items:\n description: RouteGroupKind indicates the group and kind\n of a Route resource.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: Group is the group of the Route.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is the kind of the Route.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n required:\n - kind\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-type: atomic\n namespaces:\n default:\n from: Same\n description: |-\n Namespaces indicates namespaces from which Routes may be attached to this\n Listener. This is restricted to the namespace of this Gateway by default.\n\n Support: Core\n properties:\n from:\n default: Same\n description: |-\n From indicates where Routes will be selected for this Gateway. Possible\n values are:\n\n * All: Routes in all namespaces may be used by this Gateway.\n * Selector: Routes in namespaces selected by the selector may be used by\n this Gateway.\n * Same: Only Routes in the same namespace may be used by this Gateway.\n\n Support: Core\n enum:\n - All\n - Selector\n - Same\n type: string\n selector:\n description: |-\n Selector must be specified when From is set to \"Selector\". In that case,\n only Routes in Namespaces matching this Selector will be selected by this\n Gateway. This field is ignored for other values of \"From\".\n\n Support: Core\n properties:\n matchExpressions:\n description: matchExpressions is a list of label\n selector requirements. The requirements are ANDed.\n items:\n description: |-\n A label selector requirement is a selector that contains values, a key, and an operator that\n relates the key and values.\n properties:\n key:\n description: key is the label key that the\n selector applies to.\n type: string\n operator:\n description: |-\n operator represents a key's relationship to a set of values.\n Valid operators are In, NotIn, Exists and DoesNotExist.\n type: string\n values:\n description: |-\n values is an array of string values. If the operator is In or NotIn,\n the values array must be non-empty. If the operator is Exists or DoesNotExist,\n the values array must be empty. This array is replaced during a strategic\n merge patch.\n items:\n type: string\n type: array\n x-kubernetes-list-type: atomic\n required:\n - key\n - operator\n type: object\n type: array\n x-kubernetes-list-type: atomic\n matchLabels:\n additionalProperties:\n type: string\n description: |-\n matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\n map is equivalent to an element of matchExpressions, whose key field is \"key\", the\n operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\n type: object\n type: object\n x-kubernetes-map-type: atomic\n type: object\n type: object\n hostname:\n description: |-\n Hostname specifies the virtual hostname to match for protocol types that\n define this concept. When unspecified, all hostnames are matched. This\n field is ignored for protocols that don't require hostname based\n matching.\n\n Implementations MUST apply Hostname matching appropriately for each of\n the following protocols:\n\n * TLS: The Listener Hostname MUST match the SNI.\n * HTTP: The Listener Hostname MUST match the Host header of the request.\n * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.\n Note that this does not require the SNI and Host header to be the same.\n The semantics of this are described in more detail below.\n\n To ensure security, Section 11.1 of RFC-6066 emphasizes that server\n implementations that rely on SNI hostname matching MUST also verify\n hostnames within the application protocol.\n\n Section 9.1.2 of RFC-7540 provides a mechanism for servers to reject the\n reuse of a connection by responding with the HTTP 421 Misdirected Request\n status code. This indicates that the origin server has rejected the\n request because it appears to have been misdirected.\n\n To detect misdirected requests, Gateways SHOULD match the authority of\n the requests with all the SNI hostname(s) configured across all the\n Gateway Listeners on the same port and protocol:\n\n * If another Listener has an exact match or more specific wildcard entry,\n the Gateway SHOULD return a 421.\n * If the current Listener (selected by SNI matching during ClientHello)\n does not match the Host:\n * If another Listener does match the Host the Gateway SHOULD return a\n 421.\n * If no other Listener matches the Host, the Gateway MUST return a\n 404.\n\n For HTTPRoute and TLSRoute resources, there is an interaction with the\n `spec.hostnames` array. When both listener and route specify hostnames,\n there MUST be an intersection between the values for a Route to be\n accepted. For more information, refer to the Route specific Hostnames\n documentation.\n\n Hostnames that are prefixed with a wildcard label (`*.`) are interpreted\n as a suffix match. That means that a match for `*.example.com` would match\n both `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n name:\n description: |-\n Name is the name of the Listener. This name MUST be unique within a\n Gateway.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n port:\n description: |-\n Port is the network port. Multiple listeners may use the\n same port, subject to the Listener compatibility rules.\n\n Support: Core\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n protocol:\n description: |-\n Protocol specifies the network protocol this listener expects to receive.\n\n Support: Core\n maxLength: 255\n minLength: 1\n pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9]+$\n type: string\n tls:\n description: |-\n TLS is the TLS configuration for the Listener. This field is required if\n the Protocol field is \"HTTPS\" or \"TLS\". It is invalid to set this field\n if the Protocol field is \"HTTP\", \"TCP\", or \"UDP\".\n\n The association of SNIs to Certificate defined in ListenerTLSConfig is\n defined based on the Hostname field for this listener.\n\n The GatewayClass MUST use the longest matching SNI out of all\n available certificates for any TLS handshake.\n\n Support: Core\n properties:\n certificateRefs:\n description: |-\n CertificateRefs contains a series of references to Kubernetes objects that\n contains TLS certificates and private keys. These certificates are used to\n establish a TLS handshake for requests that match the hostname of the\n associated listener.\n\n A single CertificateRef to a Kubernetes Secret has \"Core\" support.\n Implementations MAY choose to support attaching multiple certificates to\n a Listener, but this behavior is implementation-specific.\n\n References to a resource in different namespace are invalid UNLESS there\n is a ReferenceGrant in the target namespace that allows the certificate\n to be attached. If a ReferenceGrant does not allow this reference, the\n \"ResolvedRefs\" condition MUST be set to False for this listener with the\n \"RefNotPermitted\" reason.\n\n This field is required to have at least one element when the mode is set\n to \"Terminate\" (default) and is optional otherwise.\n\n CertificateRefs can reference to standard Kubernetes resources, i.e.\n Secret, or implementation-specific custom resources.\n\n Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls\n\n Support: Implementation-specific (More than one reference or other resource types)\n items:\n description: |-\n SecretObjectReference identifies an API object including its namespace,\n defaulting to Secret.\n\n The API object must be valid in the cluster; the Group and Kind must\n be registered in the cluster for this reference to be valid.\n\n References to objects with invalid Group and Kind are not valid, and must\n be rejected by the implementation, with appropriate Conditions set\n on the containing object.\n properties:\n group:\n default: \"\"\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Secret\n description: Kind is kind of the referent. For example\n \"Secret\".\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referenced object. When unspecified, the local\n namespace is inferred.\n\n Note that when a namespace different than the local namespace is specified,\n a ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n required:\n - name\n type: object\n maxItems: 64\n type: array\n x-kubernetes-list-type: atomic\n mode:\n default: Terminate\n description: |-\n Mode defines the TLS behavior for the TLS session initiated by the client.\n There are two possible modes:\n\n - Terminate: The TLS session between the downstream client and the\n Gateway is terminated at the Gateway. This mode requires certificates\n to be specified in some way, such as populating the certificateRefs\n field.\n - Passthrough: The TLS session is NOT terminated by the Gateway. This\n implies that the Gateway can't decipher the TLS stream except for\n the ClientHello message of the TLS protocol. The certificateRefs field\n is ignored in this mode.\n\n Support: Core\n enum:\n - Terminate\n - Passthrough\n type: string\n options:\n additionalProperties:\n description: |-\n AnnotationValue is the value of an annotation in Gateway API. This is used\n for validation of maps such as TLS options. This roughly matches Kubernetes\n annotation validation, although the length validation in that case is based\n on the entire size of the annotations struct.\n maxLength: 4096\n minLength: 0\n type: string\n description: |-\n Options are a list of key/value pairs to enable extended TLS\n configuration for each implementation. For example, configuring the\n minimum TLS version or supported cipher suites.\n\n A set of common keys MAY be defined by the API in the future. To avoid\n any ambiguity, implementation-specific definitions MUST use\n domain-prefixed names, such as `example.com/my-custom-option`.\n Un-prefixed names are reserved for key names defined by Gateway API.\n\n Support: Implementation-specific\n maxProperties: 16\n type: object\n type: object\n x-kubernetes-validations:\n - message: certificateRefs or options must be specified when\n mode is Terminate\n rule: \"self.mode == 'Terminate' ? size(self.certificateRefs)\n > 0 || size(self.options) > 0 : true\"\n required:\n - name\n - port\n - protocol\n type: object\n maxItems: 64\n minItems: 1\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n x-kubernetes-validations:\n - message: tls must not be specified for protocols ['HTTP', 'TCP',\n 'UDP']\n rule: \"self.all(l, l.protocol in ['HTTP', 'TCP', 'UDP'] ?\n !has(l.tls) : true)\"\n - message: tls mode must be Terminate for protocol HTTPS\n rule: \"self.all(l, (l.protocol == 'HTTPS' && has(l.tls)) ? (l.tls.mode\n == '' || l.tls.mode == 'Terminate') : true)\"\n - message: hostname must not be specified for protocols ['TCP', 'UDP']\n rule: \"self.all(l, l.protocol in ['TCP', 'UDP'] ? (!has(l.hostname)\n || l.hostname == '') : true)\"\n - message: Listener name must be unique within the Gateway\n rule: self.all(l1, self.exists_one(l2, l1.name == l2.name))\n - message: Combination of port, protocol and hostname must be unique\n for each listener\n rule: \"self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol\n == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname\n == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))\"\n required:\n - gatewayClassName\n - listeners\n type: object\n status:\n default:\n conditions:\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Accepted\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Programmed\n description: Status defines the current state of Gateway.\n properties:\n addresses:\n description: |-\n Addresses lists the network addresses that have been bound to the\n Gateway.\n\n This list may differ from the addresses provided in the spec under some\n conditions:\n\n * no addresses are specified, all addresses are dynamically assigned\n * a combination of specified and dynamic addresses are assigned\n * a specified address was unusable (e.g. already in use)\n items:\n description: GatewayStatusAddress describes a network address that\n is bound to a Gateway.\n oneOf:\n - properties:\n type:\n enum:\n - IPAddress\n value:\n anyOf:\n - format: ipv4\n - format: ipv6\n - properties:\n type:\n not:\n enum:\n - IPAddress\n properties:\n type:\n default: IPAddress\n description: Type of the address.\n maxLength: 253\n minLength: 1\n pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$\n type: string\n value:\n description: |-\n Value of the address. The validity of the values will depend\n on the type and support by the controller.\n\n Examples: `1.2.3.4`, `128::1`, `my-ip-address`.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - value\n type: object\n x-kubernetes-validations:\n - message: Hostname value must only contain valid characters (matching\n ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)\n rule: 'self.type == ''Hostname'' ? self.value.matches(r\"\"\"^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\"\"\"):\n true'\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n conditions:\n default:\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Accepted\n - lastTransitionTime: \"1970-01-01T00:00:00Z\"\n message: Waiting for controller\n reason: Pending\n status: Unknown\n type: Programmed\n description: |-\n Conditions describe the current conditions of the Gateway.\n\n Implementations should prefer to express Gateway conditions\n using the `GatewayConditionType` and `GatewayConditionReason`\n constants so that operators and tools can converge on a common\n vocabulary to describe Gateway state.\n\n Known condition types are:\n\n * \"Accepted\"\n * \"Programmed\"\n * \"Ready\"\n items:\n description: Condition contains details for one aspect of the current\n state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False, Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-map-keys:\n - type\n x-kubernetes-list-type: map\n listeners:\n description: Listeners provide status for each unique listener port\n defined in the Spec.\n items:\n description: ListenerStatus is the status associated with a Listener.\n properties:\n attachedRoutes:\n description: |-\n AttachedRoutes represents the total number of Routes that have been\n successfully attached to this Listener.\n\n Successful attachment of a Route to a Listener is based solely on the\n combination of the AllowedRoutes field on the corresponding Listener\n and the Route's ParentRefs field. A Route is successfully attached to\n a Listener when it is selected by the Listener's AllowedRoutes field\n AND the Route has a valid ParentRef selecting the whole Gateway\n resource or a specific Listener as a parent resource (more detail on\n attachment semantics can be found in the documentation on the various\n Route kinds ParentRefs fields). Listener or Route status does not impact\n successful attachment, i.e. the AttachedRoutes field count MUST be set\n for Listeners with condition Accepted: false and MUST count successfully\n attached Routes that may themselves have Accepted: false conditions.\n\n Uses for this field include troubleshooting Route attachment and\n measuring blast radius/impact of changes to a Listener.\n format: int32\n type: integer\n conditions:\n description: Conditions describe the current condition of this\n listener.\n items:\n description: Condition contains details for one aspect of\n the current state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False,\n Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-map-keys:\n - type\n x-kubernetes-list-type: map\n name:\n description: Name is the name of the Listener that this status\n corresponds to.\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n supportedKinds:\n description: |-\n SupportedKinds is the list indicating the Kinds supported by this\n listener. This MUST represent the kinds an implementation supports for\n that Listener configuration.\n\n If kinds are specified in Spec that are not supported, they MUST NOT\n appear in this list and an implementation MUST set the \"ResolvedRefs\"\n condition to \"False\" with the \"InvalidRouteKinds\" reason. If both valid\n and invalid Route kinds are specified, the implementation MUST\n reference the valid Route kinds that have been specified.\n items:\n description: RouteGroupKind indicates the group and kind of\n a Route resource.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: Group is the group of the Route.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is the kind of the Route.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n required:\n - kind\n type: object\n maxItems: 8\n type: array\n x-kubernetes-list-type: atomic\n required:\n - attachedRoutes\n - conditions\n - name\n - supportedKinds\n type: object\n maxItems: 64\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n required:\n - spec\n type: object\n served: true\n storage: false\n subresources:\n status: {}\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: null\n storedVersions: null\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328\n gateway.networking.k8s.io/bundle-version: v1.4.0\n gateway.networking.k8s.io/channel: standard\n name: grpcroutes.gateway.networking.k8s.io\nspec:\n group: gateway.networking.k8s.io\n names:\n categories:\n - gateway-api\n kind: GRPCRoute\n listKind: GRPCRouteList\n plural: grpcroutes\n singular: grpcroute\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .spec.hostnames\n name: Hostnames\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1\n schema:\n openAPIV3Schema:\n description: |-\n GRPCRoute provides a way to route gRPC requests. This includes the capability\n to match requests by hostname, gRPC service, gRPC method, or HTTP/2 header.\n Filters can be used to specify additional processing steps. Backends specify\n where matching requests will be routed.\n\n GRPCRoute falls under extended support within the Gateway API. Within the\n following specification, the word \"MUST\" indicates that an implementation\n supporting GRPCRoute must conform to the indicated requirement, but an\n implementation not supporting this route type need not follow the requirement\n unless explicitly indicated.\n\n Implementations supporting `GRPCRoute` with the `HTTPS` `ProtocolType` MUST\n accept HTTP/2 connections without an initial upgrade from HTTP/1.1, i.e. via\n ALPN. If the implementation does not support this, then it MUST set the\n \"Accepted\" condition to \"False\" for the affected listener with a reason of\n \"UnsupportedProtocol\". Implementations MAY also accept HTTP/2 connections\n with an upgrade from HTTP/1.\n\n Implementations supporting `GRPCRoute` with the `HTTP` `ProtocolType` MUST\n support HTTP/2 over cleartext TCP (h2c,\n https://www.rfc-editor.org/rfc/rfc7540#section-3.1) without an initial\n upgrade from HTTP/1.1, i.e. with prior knowledge\n (https://www.rfc-editor.org/rfc/rfc7540#section-3.4). If the implementation\n does not support this, then it MUST set the \"Accepted\" condition to \"False\"\n for the affected listener with a reason of \"UnsupportedProtocol\".\n Implementations MAY also accept HTTP/2 connections with an upgrade from\n HTTP/1, i.e. without prior knowledge.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: Spec defines the desired state of GRPCRoute.\n properties:\n hostnames:\n description: |-\n Hostnames defines a set of hostnames to match against the GRPC\n Host header to select a GRPCRoute to process the request. This matches\n the RFC 1123 definition of a hostname with 2 notable exceptions:\n\n 1. IPs are not allowed.\n 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label MUST appear by itself as the first label.\n\n If a hostname is specified by both the Listener and GRPCRoute, there\n MUST be at least one intersecting hostname for the GRPCRoute to be\n attached to the Listener. For example:\n\n * A Listener with `test.example.com` as the hostname matches GRPCRoutes\n that have either not specified any hostnames, or have specified at\n least one of `test.example.com` or `*.example.com`.\n * A Listener with `*.example.com` as the hostname matches GRPCRoutes\n that have either not specified any hostnames or have specified at least\n one hostname that matches the Listener hostname. For example,\n `test.example.com` and `*.example.com` would both match. On the other\n hand, `example.com` and `test.example.net` would not match.\n\n Hostnames that are prefixed with a wildcard label (`*.`) are interpreted\n as a suffix match. That means that a match for `*.example.com` would match\n both `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\n If both the Listener and GRPCRoute have specified hostnames, any\n GRPCRoute hostnames that do not match the Listener hostname MUST be\n ignored. For example, if a Listener specified `*.example.com`, and the\n GRPCRoute specified `test.example.com` and `test.example.net`,\n `test.example.net` MUST NOT be considered for a match.\n\n If both the Listener and GRPCRoute have specified hostnames, and none\n match with the criteria above, then the GRPCRoute MUST NOT be accepted by\n the implementation. The implementation MUST raise an 'Accepted' Condition\n with a status of `False` in the corresponding RouteParentStatus.\n\n If a Route (A) of type HTTPRoute or GRPCRoute is attached to a\n Listener and that listener already has another Route (B) of the other\n type attached and the intersection of the hostnames of A and B is\n non-empty, then the implementation MUST accept exactly one of these two\n routes, determined by the following criteria, in order:\n\n * The oldest Route based on creation timestamp.\n * The Route appearing first in alphabetical order by\n \"{namespace}/{name}\".\n\n The rejected Route MUST raise an 'Accepted' condition with a status of\n 'False' in the corresponding RouteParentStatus.\n\n Support: Core\n items:\n description: |-\n Hostname is the fully qualified domain name of a network host. This matches\n the RFC 1123 definition of a hostname with 2 notable exceptions:\n\n 1. IPs are not allowed.\n 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label must appear by itself as the first label.\n\n Hostname can be \"precise\" which is a domain name without the terminating\n dot of a network host (e.g. \"foo.example.com\") or \"wildcard\", which is a\n domain name prefixed with a single wildcard label (e.g. `*.example.com`).\n\n Note that as per RFC1035 and RFC1123, a *label* must consist of lower case\n alphanumeric characters or '-', and must start and end with an alphanumeric\n character. No other punctuation is allowed.\n maxLength: 253\n minLength: 1\n pattern: ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n parentRefs:\n description: |-\n ParentRefs references the resources (usually Gateways) that a Route wants\n to be attached to. Note that the referenced parent resource needs to\n allow this for the attachment to be complete. For Gateways, that means\n the Gateway needs to allow attachment from Routes of this kind and\n namespace. For Services, that means the Service must either be in the same\n namespace for a \"producer\" route, or the mesh implementation must support\n and allow \"consumer\" routes for the referenced Service. ReferenceGrant is\n not applicable for governing ParentRefs to Services - it is not possible to\n create a \"producer\" route for a Service in a different namespace from the\n Route.\n\n There are two kinds of parent resources with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n This API may be extended in the future to support additional kinds of parent\n resources.\n\n ParentRefs must be _distinct_. This means either that:\n\n * They select different objects. If this is the case, then parentRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, `namespace`, and `name` must\n be unique across all parentRef entries in the Route.\n * They do not select different objects, but for each optional field used,\n each ParentRef that selects the same object must set the same set of\n optional fields to different values. If one ParentRef sets a\n combination of optional fields, all must set the same combination.\n\n Some examples:\n\n * If one ParentRef sets `sectionName`, all ParentRefs referencing the\n same object must also set `sectionName`.\n * If one ParentRef sets `port`, all ParentRefs referencing the same\n object must also set `port`.\n * If one ParentRef sets `sectionName` and `port`, all ParentRefs\n referencing the same object must also set `sectionName` and `port`.\n\n It is possible to separately reference multiple distinct objects that may\n be collapsed by an implementation. For example, some implementations may\n choose to merge compatible Gateway Listeners together. If that is the\n case, the list of routes attached to those resources should also be\n merged.\n\n Note that for ParentRefs that cross namespace boundaries, there are specific\n rules. Cross-namespace references are only valid if they are explicitly\n allowed by something in the namespace they are referring to. For example,\n Gateway has the AllowedRoutes field, and ReferenceGrant provides a\n generic way to enable other kinds of cross-namespace reference.\n items:\n description: |-\n ParentReference identifies an API object (usually a Gateway) that can be considered\n a parent of this resource (usually a route). There are two kinds of parent resources\n with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n This API may be extended in the future to support additional kinds of parent\n resources.\n\n The API object must be valid in the cluster; the Group and Kind must\n be registered in the cluster for this reference to be valid.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: |-\n Group is the group of the referent.\n When unspecified, \"gateway.networking.k8s.io\" is inferred.\n To set the core API group (such as for a \"Service\" kind referent),\n Group must be explicitly set to \"\" (empty string).\n\n Support: Core\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Gateway\n description: |-\n Kind is kind of the referent.\n\n There are two kinds of parent resources with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n Support for other resources is Implementation-Specific.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: |-\n Name is the name of the referent.\n\n Support: Core\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referent. When unspecified, this refers\n to the local namespace of the Route.\n\n Note that there are specific rules for ParentRefs which cross namespace\n boundaries. Cross-namespace references are only valid if they are explicitly\n allowed by something in the namespace they are referring to. For example:\n Gateway has the AllowedRoutes field, and ReferenceGrant provides a\n generic way to enable any other kind of cross-namespace reference.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port is the network port this Route targets. It can be interpreted\n differently based on the type of parent resource.\n\n When the parent resource is a Gateway, this targets all listeners\n listening on the specified port that also support this kind of Route(and\n select this Route). It's not recommended to set `Port` unless the\n networking behaviors specified in a Route must apply to a specific port\n as opposed to a listener(s) whose port(s) may be changed. When both Port\n and SectionName are specified, the name and port of the selected listener\n must match both specified values.\n\n Implementations MAY choose to support other parent resources.\n Implementations supporting other types of parent resources MUST clearly\n document how/if Port is interpreted.\n\n For the purpose of status, an attachment is considered successful as\n long as the parent resource accepts it partially. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment\n from the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route,\n the Route MUST be considered detached from the Gateway.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n sectionName:\n description: |-\n SectionName is the name of a section within the target resource. In the\n following resources, SectionName is interpreted as the following:\n\n * Gateway: Listener name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n * Service: Port name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n\n Implementations MAY choose to support attaching Routes to other resources.\n If that is the case, they MUST clearly document how SectionName is\n interpreted.\n\n When unspecified (empty string), this will reference the entire resource.\n For the purpose of status, an attachment is considered successful if at\n least one section in the parent resource accepts it. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\n the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route, the\n Route MUST be considered detached from the Gateway.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n required:\n - name\n type: object\n maxItems: 32\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: sectionName must be specified when parentRefs includes\n 2 or more references to the same parent\n rule: \"self.all(p1, self.all(p2, p1.group == p2.group && p1.kind\n == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)\n || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__\n == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&\n p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName)\n || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName\n == '')) : true))\"\n - message: sectionName must be unique when parentRefs includes 2 or\n more references to the same parent\n rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind\n == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)\n || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__\n == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&\n p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)\n || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName\n == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName\n == p2.sectionName))))\n rules:\n description: Rules are a list of GRPC matchers, filters and actions.\n items:\n description: |-\n GRPCRouteRule defines the semantics for matching a gRPC request based on\n conditions (matches), processing it (filters), and forwarding the request to\n an API object (backendRefs).\n properties:\n backendRefs:\n description: |-\n BackendRefs defines the backend(s) where matching requests should be\n sent.\n\n Failure behavior here depends on how many BackendRefs are specified and\n how many are invalid.\n\n If *all* entries in BackendRefs are invalid, and there are also no filters\n specified in this route rule, *all* traffic which matches this rule MUST\n receive an `UNAVAILABLE` status.\n\n See the GRPCBackendRef definition for the rules about what makes a single\n GRPCBackendRef invalid.\n\n When a GRPCBackendRef is invalid, `UNAVAILABLE` statuses MUST be returned for\n requests that would have otherwise been routed to an invalid backend. If\n multiple backends are specified, and some are invalid, the proportion of\n requests that would otherwise have been routed to an invalid backend\n MUST receive an `UNAVAILABLE` status.\n\n For example, if two backends are specified with equal weights, and one is\n invalid, 50 percent of traffic MUST receive an `UNAVAILABLE` status.\n Implementations may choose how that 50 percent is determined.\n\n Support: Core for Kubernetes Service\n\n Support: Implementation-specific for any other resource\n\n Support for weight: Core\n items:\n description: |-\n GRPCBackendRef defines how a GRPCRoute forwards a gRPC request.\n\n Note that when a namespace different than the local namespace is specified, a\n ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n properties:\n filters:\n description: |-\n Filters defined at this level MUST be executed if and only if the\n request is being forwarded to the backend defined here.\n\n Support: Implementation-specific (For broader support of filters, use the\n Filters field in GRPCRouteRule.)\n items:\n description: |-\n GRPCRouteFilter defines processing steps that must be completed during the\n request or response lifecycle. GRPCRouteFilters are meant as an extension\n point to express processing that may be done in Gateway implementations. Some\n examples include request or response modification, implementing\n authentication strategies, rate-limiting, and traffic shaping. API\n guarantee/conformance is defined based on the type of the filter.\n properties:\n extensionRef:\n description: |-\n ExtensionRef is an optional, implementation-specific extension to the\n \"filter\" behavior. For example, resource \"myroutefilter\" in group\n \"networking.example.net\"). ExtensionRef MUST NOT be used for core and\n extended filters.\n\n Support: Implementation-specific\n\n This filter can be used multiple times within the same rule.\n properties:\n group:\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent. For\n example \"HTTPRoute\" or \"Service\".\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - group\n - kind\n - name\n type: object\n requestHeaderModifier:\n description: |-\n RequestHeaderModifier defines a schema for a filter that modifies request\n headers.\n\n Support: Core\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n requestMirror:\n description: |-\n RequestMirror defines a schema for a filter that mirrors requests.\n Requests are sent to the specified destination, but responses from\n that destination are ignored.\n\n This filter can be used multiple times within the same rule. Note that\n not all implementations will be able to support mirroring to multiple\n backends.\n\n Support: Extended\n properties:\n backendRef:\n description: |-\n BackendRef references a resource where mirrored requests are sent.\n\n Mirrored requests must be sent only to a single destination endpoint\n within this BackendRef, irrespective of how many endpoints are present\n within this BackendRef.\n\n If the referent cannot be found, this BackendRef is invalid and must be\n dropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\n condition on the Route status is set to `status: False` and not configure\n this backend in the underlying implementation.\n\n If there is a cross-namespace reference to an *existing* object\n that is not allowed by a ReferenceGrant, the controller must ensure the\n \"ResolvedRefs\" condition on the Route is set to `status: False`,\n with the \"RefNotPermitted\" reason and not configure this backend in the\n underlying implementation.\n\n In either error case, the Message of the `ResolvedRefs` Condition\n should be used to provide more detail about the problem.\n\n Support: Extended for Kubernetes Service\n\n Support: Implementation-specific for any other resource\n properties:\n group:\n default: \"\"\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Service\n description: |-\n Kind is the Kubernetes resource kind of the referent. For example\n \"Service\".\n\n Defaults to \"Service\" when not specified.\n\n ExternalName services can refer to CNAME DNS records that may live\n outside of the cluster and as such are difficult to reason about in\n terms of conformance. They also may not be safe to forward to (see\n CVE-2021-25740 for more information). Implementations SHOULD NOT\n support ExternalName Services.\n\n Support: Core (Services with a type other than ExternalName)\n\n Support: Implementation-specific (Services with type ExternalName)\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the backend. When unspecified, the local\n namespace is inferred.\n\n Note that when a namespace different than the local namespace is specified,\n a ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port specifies the destination port number to use for this resource.\n Port is required when the referent is a Kubernetes Service. In this\n case, the port number is the service port number, not the target port.\n For other resources, destination port might be derived from the referent\n resource or this field.\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n required:\n - name\n type: object\n x-kubernetes-validations:\n - message: Must have port for Service reference\n rule: \"(size(self.group) == 0 && self.kind\n == 'Service') ? has(self.port) : true\"\n fraction:\n description: |-\n Fraction represents the fraction of requests that should be\n mirrored to BackendRef.\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n properties:\n denominator:\n default: 100\n format: int32\n minimum: 1\n type: integer\n numerator:\n format: int32\n minimum: 0\n type: integer\n required:\n - numerator\n type: object\n x-kubernetes-validations:\n - message: numerator must be less than or equal\n to denominator\n rule: self.numerator <= self.denominator\n percent:\n description: |-\n Percent represents the percentage of requests that should be\n mirrored to BackendRef. Its minimum value is 0 (indicating 0% of\n requests) and its maximum value is 100 (indicating 100% of requests).\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n format: int32\n maximum: 100\n minimum: 0\n type: integer\n required:\n - backendRef\n type: object\n x-kubernetes-validations:\n - message: Only one of percent or fraction may be\n specified in HTTPRequestMirrorFilter\n rule: \"!(has(self.percent) && has(self.fraction))\"\n responseHeaderModifier:\n description: |-\n ResponseHeaderModifier defines a schema for a filter that modifies response\n headers.\n\n Support: Extended\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n type:\n description: |-\n Type identifies the type of filter to apply. As with other API fields,\n types are classified into three conformance levels:\n\n - Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations supporting GRPCRoute MUST support core filters.\n\n - Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n - Implementation-specific: Filters that are defined and supported by specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` MUST be set to\n \"ExtensionRef\" for custom filters.\n\n Implementers are encouraged to define custom implementation types to\n extend the core API with implementation-specific behavior.\n\n If a reference to a custom filter type cannot be resolved, the filter\n MUST NOT be skipped. Instead, requests that would have been processed by\n that filter MUST receive a HTTP error response.\n enum:\n - ResponseHeaderModifier\n - RequestHeaderModifier\n - RequestMirror\n - ExtensionRef\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: filter.requestHeaderModifier must be nil\n if the filter.type is not RequestHeaderModifier\n rule: \"!(has(self.requestHeaderModifier) && self.type\n != 'RequestHeaderModifier')\"\n - message: filter.requestHeaderModifier must be specified\n for RequestHeaderModifier filter.type\n rule: \"!(!has(self.requestHeaderModifier) && self.type\n == 'RequestHeaderModifier')\"\n - message: filter.responseHeaderModifier must be nil\n if the filter.type is not ResponseHeaderModifier\n rule: \"!(has(self.responseHeaderModifier) && self.type\n != 'ResponseHeaderModifier')\"\n - message: filter.responseHeaderModifier must be specified\n for ResponseHeaderModifier filter.type\n rule: \"!(!has(self.responseHeaderModifier) && self.type\n == 'ResponseHeaderModifier')\"\n - message: filter.requestMirror must be nil if the filter.type\n is not RequestMirror\n rule: \"!(has(self.requestMirror) && self.type != 'RequestMirror')\"\n - message: filter.requestMirror must be specified for\n RequestMirror filter.type\n rule: \"!(!has(self.requestMirror) && self.type ==\n 'RequestMirror')\"\n - message: filter.extensionRef must be nil if the filter.type\n is not ExtensionRef\n rule: \"!(has(self.extensionRef) && self.type != 'ExtensionRef')\"\n - message: filter.extensionRef must be specified for\n ExtensionRef filter.type\n rule: \"!(!has(self.extensionRef) && self.type == 'ExtensionRef')\"\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: RequestHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'RequestHeaderModifier').size()\n <= 1\n - message: ResponseHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()\n <= 1\n group:\n default: \"\"\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Service\n description: |-\n Kind is the Kubernetes resource kind of the referent. For example\n \"Service\".\n\n Defaults to \"Service\" when not specified.\n\n ExternalName services can refer to CNAME DNS records that may live\n outside of the cluster and as such are difficult to reason about in\n terms of conformance. They also may not be safe to forward to (see\n CVE-2021-25740 for more information). Implementations SHOULD NOT\n support ExternalName Services.\n\n Support: Core (Services with a type other than ExternalName)\n\n Support: Implementation-specific (Services with type ExternalName)\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the backend. When unspecified, the local\n namespace is inferred.\n\n Note that when a namespace different than the local namespace is specified,\n a ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port specifies the destination port number to use for this resource.\n Port is required when the referent is a Kubernetes Service. In this\n case, the port number is the service port number, not the target port.\n For other resources, destination port might be derived from the referent\n resource or this field.\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n weight:\n default: 1\n description: |-\n Weight specifies the proportion of requests forwarded to the referenced\n backend. This is computed as weight/(sum of all weights in this\n BackendRefs list). For non-zero values, there may be some epsilon from\n the exact proportion defined here depending on the precision an\n implementation supports. Weight is not a percentage and the sum of\n weights does not need to equal 100.\n\n If only one backend is specified and it has a weight greater than 0, 100%\n of the traffic is forwarded to that backend. If weight is set to 0, no\n traffic should be forwarded for this entry. If unspecified, weight\n defaults to 1.\n\n Support for this field varies based on the context where used.\n format: int32\n maximum: 1000000\n minimum: 0\n type: integer\n required:\n - name\n type: object\n x-kubernetes-validations:\n - message: Must have port for Service reference\n rule: \"(size(self.group) == 0 && self.kind == 'Service')\n ? has(self.port) : true\"\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n filters:\n description: |-\n Filters define the filters that are applied to requests that match\n this rule.\n\n The effects of ordering of multiple behaviors are currently unspecified.\n This can change in the future based on feedback during the alpha stage.\n\n Conformance-levels at this level are defined based on the type of filter:\n\n - ALL core filters MUST be supported by all implementations that support\n GRPCRoute.\n - Implementers are encouraged to support extended filters.\n - Implementation-specific custom filters have no API guarantees across\n implementations.\n\n Specifying the same filter multiple times is not supported unless explicitly\n indicated in the filter.\n\n If an implementation cannot support a combination of filters, it must clearly\n document that limitation. In cases where incompatible or unsupported\n filters are specified and cause the `Accepted` condition to be set to status\n `False`, implementations may use the `IncompatibleFilters` reason to specify\n this configuration error.\n\n Support: Core\n items:\n description: |-\n GRPCRouteFilter defines processing steps that must be completed during the\n request or response lifecycle. GRPCRouteFilters are meant as an extension\n point to express processing that may be done in Gateway implementations. Some\n examples include request or response modification, implementing\n authentication strategies, rate-limiting, and traffic shaping. API\n guarantee/conformance is defined based on the type of the filter.\n properties:\n extensionRef:\n description: |-\n ExtensionRef is an optional, implementation-specific extension to the\n \"filter\" behavior. For example, resource \"myroutefilter\" in group\n \"networking.example.net\"). ExtensionRef MUST NOT be used for core and\n extended filters.\n\n Support: Implementation-specific\n\n This filter can be used multiple times within the same rule.\n properties:\n group:\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent. For example\n \"HTTPRoute\" or \"Service\".\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - group\n - kind\n - name\n type: object\n requestHeaderModifier:\n description: |-\n RequestHeaderModifier defines a schema for a filter that modifies request\n headers.\n\n Support: Core\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n requestMirror:\n description: |-\n RequestMirror defines a schema for a filter that mirrors requests.\n Requests are sent to the specified destination, but responses from\n that destination are ignored.\n\n This filter can be used multiple times within the same rule. Note that\n not all implementations will be able to support mirroring to multiple\n backends.\n\n Support: Extended\n properties:\n backendRef:\n description: |-\n BackendRef references a resource where mirrored requests are sent.\n\n Mirrored requests must be sent only to a single destination endpoint\n within this BackendRef, irrespective of how many endpoints are present\n within this BackendRef.\n\n If the referent cannot be found, this BackendRef is invalid and must be\n dropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\n condition on the Route status is set to `status: False` and not configure\n this backend in the underlying implementation.\n\n If there is a cross-namespace reference to an *existing* object\n that is not allowed by a ReferenceGrant, the controller must ensure the\n \"ResolvedRefs\" condition on the Route is set to `status: False`,\n with the \"RefNotPermitted\" reason and not configure this backend in the\n underlying implementation.\n\n In either error case, the Message of the `ResolvedRefs` Condition\n should be used to provide more detail about the problem.\n\n Support: Extended for Kubernetes Service\n\n Support: Implementation-specific for any other resource\n properties:\n group:\n default: \"\"\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Service\n description: |-\n Kind is the Kubernetes resource kind of the referent. For example\n \"Service\".\n\n Defaults to \"Service\" when not specified.\n\n ExternalName services can refer to CNAME DNS records that may live\n outside of the cluster and as such are difficult to reason about in\n terms of conformance. They also may not be safe to forward to (see\n CVE-2021-25740 for more information). Implementations SHOULD NOT\n support ExternalName Services.\n\n Support: Core (Services with a type other than ExternalName)\n\n Support: Implementation-specific (Services with type ExternalName)\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the backend. When unspecified, the local\n namespace is inferred.\n\n Note that when a namespace different than the local namespace is specified,\n a ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port specifies the destination port number to use for this resource.\n Port is required when the referent is a Kubernetes Service. In this\n case, the port number is the service port number, not the target port.\n For other resources, destination port might be derived from the referent\n resource or this field.\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n required:\n - name\n type: object\n x-kubernetes-validations:\n - message: Must have port for Service reference\n rule: \"(size(self.group) == 0 && self.kind == 'Service')\n ? has(self.port) : true\"\n fraction:\n description: |-\n Fraction represents the fraction of requests that should be\n mirrored to BackendRef.\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n properties:\n denominator:\n default: 100\n format: int32\n minimum: 1\n type: integer\n numerator:\n format: int32\n minimum: 0\n type: integer\n required:\n - numerator\n type: object\n x-kubernetes-validations:\n - message: numerator must be less than or equal to\n denominator\n rule: self.numerator <= self.denominator\n percent:\n description: |-\n Percent represents the percentage of requests that should be\n mirrored to BackendRef. Its minimum value is 0 (indicating 0% of\n requests) and its maximum value is 100 (indicating 100% of requests).\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n format: int32\n maximum: 100\n minimum: 0\n type: integer\n required:\n - backendRef\n type: object\n x-kubernetes-validations:\n - message: Only one of percent or fraction may be specified\n in HTTPRequestMirrorFilter\n rule: \"!(has(self.percent) && has(self.fraction))\"\n responseHeaderModifier:\n description: |-\n ResponseHeaderModifier defines a schema for a filter that modifies response\n headers.\n\n Support: Extended\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n type:\n description: |-\n Type identifies the type of filter to apply. As with other API fields,\n types are classified into three conformance levels:\n\n - Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations supporting GRPCRoute MUST support core filters.\n\n - Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n - Implementation-specific: Filters that are defined and supported by specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` MUST be set to\n \"ExtensionRef\" for custom filters.\n\n Implementers are encouraged to define custom implementation types to\n extend the core API with implementation-specific behavior.\n\n If a reference to a custom filter type cannot be resolved, the filter\n MUST NOT be skipped. Instead, requests that would have been processed by\n that filter MUST receive a HTTP error response.\n enum:\n - ResponseHeaderModifier\n - RequestHeaderModifier\n - RequestMirror\n - ExtensionRef\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: filter.requestHeaderModifier must be nil if the\n filter.type is not RequestHeaderModifier\n rule: \"!(has(self.requestHeaderModifier) && self.type !=\n 'RequestHeaderModifier')\"\n - message: filter.requestHeaderModifier must be specified\n for RequestHeaderModifier filter.type\n rule: \"!(!has(self.requestHeaderModifier) && self.type ==\n 'RequestHeaderModifier')\"\n - message: filter.responseHeaderModifier must be nil if the\n filter.type is not ResponseHeaderModifier\n rule: \"!(has(self.responseHeaderModifier) && self.type !=\n 'ResponseHeaderModifier')\"\n - message: filter.responseHeaderModifier must be specified\n for ResponseHeaderModifier filter.type\n rule: \"!(!has(self.responseHeaderModifier) && self.type\n == 'ResponseHeaderModifier')\"\n - message: filter.requestMirror must be nil if the filter.type\n is not RequestMirror\n rule: \"!(has(self.requestMirror) && self.type != 'RequestMirror')\"\n - message: filter.requestMirror must be specified for RequestMirror\n filter.type\n rule: \"!(!has(self.requestMirror) && self.type == 'RequestMirror')\"\n - message: filter.extensionRef must be nil if the filter.type\n is not ExtensionRef\n rule: \"!(has(self.extensionRef) && self.type != 'ExtensionRef')\"\n - message: filter.extensionRef must be specified for ExtensionRef\n filter.type\n rule: \"!(!has(self.extensionRef) && self.type == 'ExtensionRef')\"\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: RequestHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'RequestHeaderModifier').size()\n <= 1\n - message: ResponseHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()\n <= 1\n matches:\n description: |-\n Matches define conditions used for matching the rule against incoming\n gRPC requests. Each match is independent, i.e. this rule will be matched\n if **any** one of the matches is satisfied.\n\n For example, take the following matches configuration:\n\n ```\n matches:\n - method:\n service: foo.bar\n headers:\n values:\n version: 2\n - method:\n service: foo.bar.v2\n ```\n\n For a request to match against this rule, it MUST satisfy\n EITHER of the two conditions:\n\n - service of foo.bar AND contains the header `version: 2`\n - service of foo.bar.v2\n\n See the documentation for GRPCRouteMatch on how to specify multiple\n match conditions to be ANDed together.\n\n If no matches are specified, the implementation MUST match every gRPC request.\n\n Proxy or Load Balancer routing configuration generated from GRPCRoutes\n MUST prioritize rules based on the following criteria, continuing on\n ties. Merging MUST not be done between GRPCRoutes and HTTPRoutes.\n Precedence MUST be given to the rule with the largest number of:\n\n * Characters in a matching non-wildcard hostname.\n * Characters in a matching hostname.\n * Characters in a matching service.\n * Characters in a matching method.\n * Header matches.\n\n If ties still exist across multiple Routes, matching precedence MUST be\n determined in order of the following criteria, continuing on ties:\n\n * The oldest Route based on creation timestamp.\n * The Route appearing first in alphabetical order by\n \"{namespace}/{name}\".\n\n If ties still exist within the Route that has been given precedence,\n matching precedence MUST be granted to the first matching rule meeting\n the above criteria.\n items:\n description: |-\n GRPCRouteMatch defines the predicate used to match requests to a given\n action. Multiple match types are ANDed together, i.e. the match will\n evaluate to true only if all conditions are satisfied.\n\n For example, the match below will match a gRPC request only if its service\n is `foo` AND it contains the `version: v1` header:\n\n ```\n matches:\n - method:\n type: Exact\n service: \"foo\"\n headers:\n - name: \"version\"\n value \"v1\"\n\n ```\n properties:\n headers:\n description: |-\n Headers specifies gRPC request header matchers. Multiple match values are\n ANDed together, meaning, a request MUST match all the specified headers\n to select the route.\n items:\n description: |-\n GRPCHeaderMatch describes how to select a gRPC route by matching gRPC request\n headers.\n properties:\n name:\n description: |-\n Name is the name of the gRPC Header to be matched.\n\n If multiple entries specify equivalent header names, only the first\n entry with an equivalent name MUST be considered for a match. Subsequent\n entries with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n type:\n default: Exact\n description: Type specifies how to match against\n the value of the header.\n enum:\n - Exact\n - RegularExpression\n type: string\n value:\n description: Value is the value of the gRPC Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n method:\n description: |-\n Method specifies a gRPC request service/method matcher. If this field is\n not specified, all services and methods will match.\n properties:\n method:\n description: |-\n Value of the method to match against. If left empty or omitted, will\n match all services.\n\n At least one of Service and Method MUST be a non-empty string.\n maxLength: 1024\n type: string\n service:\n description: |-\n Value of the service to match against. If left empty or omitted, will\n match any service.\n\n At least one of Service and Method MUST be a non-empty string.\n maxLength: 1024\n type: string\n type:\n default: Exact\n description: |-\n Type specifies how to match against the service and/or method.\n Support: Core (Exact with service and method specified)\n\n Support: Implementation-specific (Exact with method specified but no service specified)\n\n Support: Implementation-specific (RegularExpression)\n enum:\n - Exact\n - RegularExpression\n type: string\n type: object\n x-kubernetes-validations:\n - message: One or both of 'service' or 'method' must be\n specified\n rule: \"has(self.type) ? has(self.service) || has(self.method)\n : true\"\n - message: service must only contain valid characters\n (matching ^(?i)\\.?[a-z_][a-z_0-9]*(\\.[a-z_][a-z_0-9]*)*$)\n rule: '(!has(self.type) || self.type == ''Exact'') &&\n has(self.service) ? self.service.matches(r\"\"\"^(?i)\\.?[a-z_][a-z_0-9]*(\\.[a-z_][a-z_0-9]*)*$\"\"\"):\n true'\n - message: method must only contain valid characters (matching\n ^[A-Za-z_][A-Za-z_0-9]*$)\n rule: '(!has(self.type) || self.type == ''Exact'') &&\n has(self.method) ? self.method.matches(r\"\"\"^[A-Za-z_][A-Za-z_0-9]*$\"\"\"):\n true'\n type: object\n maxItems: 64\n type: array\n x-kubernetes-list-type: atomic\n name:\n description: |-\n Name is the name of the route rule. This name MUST be unique within a Route if it is set.\n\n Support: Extended\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: While 16 rules and 64 matches per rule are allowed, the\n total number of matches across all rules in a route must be less\n than 128\n rule: \"(self.size() > 0 ? (has(self[0].matches) ? self[0].matches.size()\n : 0) : 0) + (self.size() > 1 ? (has(self[1].matches) ? self[1].matches.size()\n : 0) : 0) + (self.size() > 2 ? (has(self[2].matches) ? self[2].matches.size()\n : 0) : 0) + (self.size() > 3 ? (has(self[3].matches) ? self[3].matches.size()\n : 0) : 0) + (self.size() > 4 ? (has(self[4].matches) ? self[4].matches.size()\n : 0) : 0) + (self.size() > 5 ? (has(self[5].matches) ? self[5].matches.size()\n : 0) : 0) + (self.size() > 6 ? (has(self[6].matches) ? self[6].matches.size()\n : 0) : 0) + (self.size() > 7 ? (has(self[7].matches) ? self[7].matches.size()\n : 0) : 0) + (self.size() > 8 ? (has(self[8].matches) ? self[8].matches.size()\n : 0) : 0) + (self.size() > 9 ? (has(self[9].matches) ? self[9].matches.size()\n : 0) : 0) + (self.size() > 10 ? (has(self[10].matches) ? self[10].matches.size()\n : 0) : 0) + (self.size() > 11 ? (has(self[11].matches) ? self[11].matches.size()\n : 0) : 0) + (self.size() > 12 ? (has(self[12].matches) ? self[12].matches.size()\n : 0) : 0) + (self.size() > 13 ? (has(self[13].matches) ? self[13].matches.size()\n : 0) : 0) + (self.size() > 14 ? (has(self[14].matches) ? self[14].matches.size()\n : 0) : 0) + (self.size() > 15 ? (has(self[15].matches) ? self[15].matches.size()\n : 0) : 0) <= 128\"\n type: object\n status:\n description: Status defines the current state of GRPCRoute.\n properties:\n parents:\n description: |-\n Parents is a list of parent resources (usually Gateways) that are\n associated with the route, and the status of the route with respect to\n each parent. When this route attaches to a parent, the controller that\n manages the parent must add an entry to this list when the controller\n first sees the route and should update the entry as appropriate when the\n route or gateway is modified.\n\n Note that parent references that cannot be resolved by an implementation\n of this API will not be added to this list. Implementations of this API\n can only populate Route status for the Gateways/parent resources they are\n responsible for.\n\n A maximum of 32 Gateways will be represented in this list. An empty list\n means the route has not been attached to any Gateway.\n items:\n description: |-\n RouteParentStatus describes the status of a route with respect to an\n associated Parent.\n properties:\n conditions:\n description: |-\n Conditions describes the status of the route with respect to the Gateway.\n Note that the route's availability is also subject to the Gateway's own\n status conditions and listener status.\n\n If the Route's ParentRef specifies an existing Gateway that supports\n Routes of this kind AND that Gateway's controller has sufficient access,\n then that Gateway's controller MUST set the \"Accepted\" condition on the\n Route, to indicate whether the route has been accepted or rejected by the\n Gateway, and why.\n\n A Route MUST be considered \"Accepted\" if at least one of the Route's\n rules is implemented by the Gateway.\n\n There are a number of cases where the \"Accepted\" condition may not be set\n due to lack of controller visibility, that includes when:\n\n * The Route refers to a nonexistent parent.\n * The Route is of a type that the controller does not support.\n * The Route is in a namespace the controller does not have access to.\n items:\n description: Condition contains details for one aspect of\n the current state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False,\n Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n maxItems: 8\n minItems: 1\n type: array\n x-kubernetes-list-map-keys:\n - type\n x-kubernetes-list-type: map\n controllerName:\n description: |-\n ControllerName is a domain/path string that indicates the name of the\n controller that wrote this status. This corresponds with the\n controllerName field on GatewayClass.\n\n Example: \"example.net/gateway-controller\".\n\n The format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\n valid Kubernetes names\n (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\n Controllers MUST populate this field when writing status. Controllers should ensure that\n entries to status populated with their ControllerName are cleaned up when they are no\n longer necessary.\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$\n type: string\n parentRef:\n description: |-\n ParentRef corresponds with a ParentRef in the spec that this\n RouteParentStatus struct describes the status of.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: |-\n Group is the group of the referent.\n When unspecified, \"gateway.networking.k8s.io\" is inferred.\n To set the core API group (such as for a \"Service\" kind referent),\n Group must be explicitly set to \"\" (empty string).\n\n Support: Core\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Gateway\n description: |-\n Kind is kind of the referent.\n\n There are two kinds of parent resources with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n Support for other resources is Implementation-Specific.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: |-\n Name is the name of the referent.\n\n Support: Core\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referent. When unspecified, this refers\n to the local namespace of the Route.\n\n Note that there are specific rules for ParentRefs which cross namespace\n boundaries. Cross-namespace references are only valid if they are explicitly\n allowed by something in the namespace they are referring to. For example:\n Gateway has the AllowedRoutes field, and ReferenceGrant provides a\n generic way to enable any other kind of cross-namespace reference.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port is the network port this Route targets. It can be interpreted\n differently based on the type of parent resource.\n\n When the parent resource is a Gateway, this targets all listeners\n listening on the specified port that also support this kind of Route(and\n select this Route). It's not recommended to set `Port` unless the\n networking behaviors specified in a Route must apply to a specific port\n as opposed to a listener(s) whose port(s) may be changed. When both Port\n and SectionName are specified, the name and port of the selected listener\n must match both specified values.\n\n Implementations MAY choose to support other parent resources.\n Implementations supporting other types of parent resources MUST clearly\n document how/if Port is interpreted.\n\n For the purpose of status, an attachment is considered successful as\n long as the parent resource accepts it partially. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment\n from the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route,\n the Route MUST be considered detached from the Gateway.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n sectionName:\n description: |-\n SectionName is the name of a section within the target resource. In the\n following resources, SectionName is interpreted as the following:\n\n * Gateway: Listener name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n * Service: Port name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n\n Implementations MAY choose to support attaching Routes to other resources.\n If that is the case, they MUST clearly document how SectionName is\n interpreted.\n\n When unspecified (empty string), this will reference the entire resource.\n For the purpose of status, an attachment is considered successful if at\n least one section in the parent resource accepts it. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\n the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route, the\n Route MUST be considered detached from the Gateway.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n required:\n - name\n type: object\n required:\n - conditions\n - controllerName\n - parentRef\n type: object\n maxItems: 32\n type: array\n x-kubernetes-list-type: atomic\n required:\n - parents\n type: object\n required:\n - spec\n type: object\n served: true\n storage: true\n subresources:\n status: {}\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: null\n storedVersions: null\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328\n gateway.networking.k8s.io/bundle-version: v1.4.0\n gateway.networking.k8s.io/channel: standard\n name: httproutes.gateway.networking.k8s.io\nspec:\n group: gateway.networking.k8s.io\n names:\n categories:\n - gateway-api\n kind: HTTPRoute\n listKind: HTTPRouteList\n plural: httproutes\n singular: httproute\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .spec.hostnames\n name: Hostnames\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1\n schema:\n openAPIV3Schema:\n description: |-\n HTTPRoute provides a way to route HTTP requests. This includes the capability\n to match requests by hostname, path, header, or query param. Filters can be\n used to specify additional processing steps. Backends specify where matching\n requests should be routed.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: Spec defines the desired state of HTTPRoute.\n properties:\n hostnames:\n description: |-\n Hostnames defines a set of hostnames that should match against the HTTP Host\n header to select a HTTPRoute used to process the request. Implementations\n MUST ignore any port value specified in the HTTP Host header while\n performing a match and (absent of any applicable header modification\n configuration) MUST forward this header unmodified to the backend.\n\n Valid values for Hostnames are determined by RFC 1123 definition of a\n hostname with 2 notable exceptions:\n\n 1. IPs are not allowed.\n 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label must appear by itself as the first label.\n\n If a hostname is specified by both the Listener and HTTPRoute, there\n must be at least one intersecting hostname for the HTTPRoute to be\n attached to the Listener. For example:\n\n * A Listener with `test.example.com` as the hostname matches HTTPRoutes\n that have either not specified any hostnames, or have specified at\n least one of `test.example.com` or `*.example.com`.\n * A Listener with `*.example.com` as the hostname matches HTTPRoutes\n that have either not specified any hostnames or have specified at least\n one hostname that matches the Listener hostname. For example,\n `*.example.com`, `test.example.com`, and `foo.test.example.com` would\n all match. On the other hand, `example.com` and `test.example.net` would\n not match.\n\n Hostnames that are prefixed with a wildcard label (`*.`) are interpreted\n as a suffix match. That means that a match for `*.example.com` would match\n both `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\n If both the Listener and HTTPRoute have specified hostnames, any\n HTTPRoute hostnames that do not match the Listener hostname MUST be\n ignored. For example, if a Listener specified `*.example.com`, and the\n HTTPRoute specified `test.example.com` and `test.example.net`,\n `test.example.net` must not be considered for a match.\n\n If both the Listener and HTTPRoute have specified hostnames, and none\n match with the criteria above, then the HTTPRoute is not accepted. The\n implementation must raise an 'Accepted' Condition with a status of\n `False` in the corresponding RouteParentStatus.\n\n In the event that multiple HTTPRoutes specify intersecting hostnames (e.g.\n overlapping wildcard matching and exact matching hostnames), precedence must\n be given to rules from the HTTPRoute with the largest number of:\n\n * Characters in a matching non-wildcard hostname.\n * Characters in a matching hostname.\n\n If ties exist across multiple Routes, the matching precedence rules for\n HTTPRouteMatches takes over.\n\n Support: Core\n items:\n description: |-\n Hostname is the fully qualified domain name of a network host. This matches\n the RFC 1123 definition of a hostname with 2 notable exceptions:\n\n 1. IPs are not allowed.\n 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label must appear by itself as the first label.\n\n Hostname can be \"precise\" which is a domain name without the terminating\n dot of a network host (e.g. \"foo.example.com\") or \"wildcard\", which is a\n domain name prefixed with a single wildcard label (e.g. `*.example.com`).\n\n Note that as per RFC1035 and RFC1123, a *label* must consist of lower case\n alphanumeric characters or '-', and must start and end with an alphanumeric\n character. No other punctuation is allowed.\n maxLength: 253\n minLength: 1\n pattern: ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n parentRefs:\n description: |-\n ParentRefs references the resources (usually Gateways) that a Route wants\n to be attached to. Note that the referenced parent resource needs to\n allow this for the attachment to be complete. For Gateways, that means\n the Gateway needs to allow attachment from Routes of this kind and\n namespace. For Services, that means the Service must either be in the same\n namespace for a \"producer\" route, or the mesh implementation must support\n and allow \"consumer\" routes for the referenced Service. ReferenceGrant is\n not applicable for governing ParentRefs to Services - it is not possible to\n create a \"producer\" route for a Service in a different namespace from the\n Route.\n\n There are two kinds of parent resources with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n This API may be extended in the future to support additional kinds of parent\n resources.\n\n ParentRefs must be _distinct_. This means either that:\n\n * They select different objects. If this is the case, then parentRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, `namespace`, and `name` must\n be unique across all parentRef entries in the Route.\n * They do not select different objects, but for each optional field used,\n each ParentRef that selects the same object must set the same set of\n optional fields to different values. If one ParentRef sets a\n combination of optional fields, all must set the same combination.\n\n Some examples:\n\n * If one ParentRef sets `sectionName`, all ParentRefs referencing the\n same object must also set `sectionName`.\n * If one ParentRef sets `port`, all ParentRefs referencing the same\n object must also set `port`.\n * If one ParentRef sets `sectionName` and `port`, all ParentRefs\n referencing the same object must also set `sectionName` and `port`.\n\n It is possible to separately reference multiple distinct objects that may\n be collapsed by an implementation. For example, some implementations may\n choose to merge compatible Gateway Listeners together. If that is the\n case, the list of routes attached to those resources should also be\n merged.\n\n Note that for ParentRefs that cross namespace boundaries, there are specific\n rules. Cross-namespace references are only valid if they are explicitly\n allowed by something in the namespace they are referring to. For example,\n Gateway has the AllowedRoutes field, and ReferenceGrant provides a\n generic way to enable other kinds of cross-namespace reference.\n items:\n description: |-\n ParentReference identifies an API object (usually a Gateway) that can be considered\n a parent of this resource (usually a route). There are two kinds of parent resources\n with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n This API may be extended in the future to support additional kinds of parent\n resources.\n\n The API object must be valid in the cluster; the Group and Kind must\n be registered in the cluster for this reference to be valid.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: |-\n Group is the group of the referent.\n When unspecified, \"gateway.networking.k8s.io\" is inferred.\n To set the core API group (such as for a \"Service\" kind referent),\n Group must be explicitly set to \"\" (empty string).\n\n Support: Core\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Gateway\n description: |-\n Kind is kind of the referent.\n\n There are two kinds of parent resources with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n Support for other resources is Implementation-Specific.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: |-\n Name is the name of the referent.\n\n Support: Core\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referent. When unspecified, this refers\n to the local namespace of the Route.\n\n Note that there are specific rules for ParentRefs which cross namespace\n boundaries. Cross-namespace references are only valid if they are explicitly\n allowed by something in the namespace they are referring to. For example:\n Gateway has the AllowedRoutes field, and ReferenceGrant provides a\n generic way to enable any other kind of cross-namespace reference.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port is the network port this Route targets. It can be interpreted\n differently based on the type of parent resource.\n\n When the parent resource is a Gateway, this targets all listeners\n listening on the specified port that also support this kind of Route(and\n select this Route). It's not recommended to set `Port` unless the\n networking behaviors specified in a Route must apply to a specific port\n as opposed to a listener(s) whose port(s) may be changed. When both Port\n and SectionName are specified, the name and port of the selected listener\n must match both specified values.\n\n Implementations MAY choose to support other parent resources.\n Implementations supporting other types of parent resources MUST clearly\n document how/if Port is interpreted.\n\n For the purpose of status, an attachment is considered successful as\n long as the parent resource accepts it partially. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment\n from the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route,\n the Route MUST be considered detached from the Gateway.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n sectionName:\n description: |-\n SectionName is the name of a section within the target resource. In the\n following resources, SectionName is interpreted as the following:\n\n * Gateway: Listener name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n * Service: Port name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n\n Implementations MAY choose to support attaching Routes to other resources.\n If that is the case, they MUST clearly document how SectionName is\n interpreted.\n\n When unspecified (empty string), this will reference the entire resource.\n For the purpose of status, an attachment is considered successful if at\n least one section in the parent resource accepts it. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\n the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route, the\n Route MUST be considered detached from the Gateway.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n required:\n - name\n type: object\n maxItems: 32\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: sectionName must be specified when parentRefs includes\n 2 or more references to the same parent\n rule: \"self.all(p1, self.all(p2, p1.group == p2.group && p1.kind\n == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)\n || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__\n == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&\n p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName)\n || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName\n == '')) : true))\"\n - message: sectionName must be unique when parentRefs includes 2 or\n more references to the same parent\n rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind\n == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)\n || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__\n == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&\n p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)\n || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName\n == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName\n == p2.sectionName))))\n rules:\n default:\n - matches:\n - path:\n type: PathPrefix\n value: /\n description: Rules are a list of HTTP matchers, filters and actions.\n items:\n description: |-\n HTTPRouteRule defines semantics for matching an HTTP request based on\n conditions (matches), processing it (filters), and forwarding the request to\n an API object (backendRefs).\n properties:\n backendRefs:\n description: |-\n BackendRefs defines the backend(s) where matching requests should be\n sent.\n\n Failure behavior here depends on how many BackendRefs are specified and\n how many are invalid.\n\n If *all* entries in BackendRefs are invalid, and there are also no filters\n specified in this route rule, *all* traffic which matches this rule MUST\n receive a 500 status code.\n\n See the HTTPBackendRef definition for the rules about what makes a single\n HTTPBackendRef invalid.\n\n When a HTTPBackendRef is invalid, 500 status codes MUST be returned for\n requests that would have otherwise been routed to an invalid backend. If\n multiple backends are specified, and some are invalid, the proportion of\n requests that would otherwise have been routed to an invalid backend\n MUST receive a 500 status code.\n\n For example, if two backends are specified with equal weights, and one is\n invalid, 50 percent of traffic must receive a 500. Implementations may\n choose how that 50 percent is determined.\n\n When a HTTPBackendRef refers to a Service that has no ready endpoints,\n implementations SHOULD return a 503 for requests to that backend instead.\n If an implementation chooses to do this, all of the above rules for 500 responses\n MUST also apply for responses that return a 503.\n\n Support: Core for Kubernetes Service\n\n Support: Extended for Kubernetes ServiceImport\n\n Support: Implementation-specific for any other resource\n\n Support for weight: Core\n items:\n description: |-\n HTTPBackendRef defines how a HTTPRoute forwards a HTTP request.\n\n Note that when a namespace different than the local namespace is specified, a\n ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n properties:\n filters:\n description: |-\n Filters defined at this level should be executed if and only if the\n request is being forwarded to the backend defined here.\n\n Support: Implementation-specific (For broader support of filters, use the\n Filters field in HTTPRouteRule.)\n items:\n description: |-\n HTTPRouteFilter defines processing steps that must be completed during the\n request or response lifecycle. HTTPRouteFilters are meant as an extension\n point to express processing that may be done in Gateway implementations. Some\n examples include request or response modification, implementing\n authentication strategies, rate-limiting, and traffic shaping. API\n guarantee/conformance is defined based on the type of the filter.\n properties:\n extensionRef:\n description: |-\n ExtensionRef is an optional, implementation-specific extension to the\n \"filter\" behavior. For example, resource \"myroutefilter\" in group\n \"networking.example.net\"). ExtensionRef MUST NOT be used for core and\n extended filters.\n\n This filter can be used multiple times within the same rule.\n\n Support: Implementation-specific\n properties:\n group:\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent. For\n example \"HTTPRoute\" or \"Service\".\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - group\n - kind\n - name\n type: object\n requestHeaderModifier:\n description: |-\n RequestHeaderModifier defines a schema for a filter that modifies request\n headers.\n\n Support: Core\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n requestMirror:\n description: |-\n RequestMirror defines a schema for a filter that mirrors requests.\n Requests are sent to the specified destination, but responses from\n that destination are ignored.\n\n This filter can be used multiple times within the same rule. Note that\n not all implementations will be able to support mirroring to multiple\n backends.\n\n Support: Extended\n properties:\n backendRef:\n description: |-\n BackendRef references a resource where mirrored requests are sent.\n\n Mirrored requests must be sent only to a single destination endpoint\n within this BackendRef, irrespective of how many endpoints are present\n within this BackendRef.\n\n If the referent cannot be found, this BackendRef is invalid and must be\n dropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\n condition on the Route status is set to `status: False` and not configure\n this backend in the underlying implementation.\n\n If there is a cross-namespace reference to an *existing* object\n that is not allowed by a ReferenceGrant, the controller must ensure the\n \"ResolvedRefs\" condition on the Route is set to `status: False`,\n with the \"RefNotPermitted\" reason and not configure this backend in the\n underlying implementation.\n\n In either error case, the Message of the `ResolvedRefs` Condition\n should be used to provide more detail about the problem.\n\n Support: Extended for Kubernetes Service\n\n Support: Implementation-specific for any other resource\n properties:\n group:\n default: \"\"\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Service\n description: |-\n Kind is the Kubernetes resource kind of the referent. For example\n \"Service\".\n\n Defaults to \"Service\" when not specified.\n\n ExternalName services can refer to CNAME DNS records that may live\n outside of the cluster and as such are difficult to reason about in\n terms of conformance. They also may not be safe to forward to (see\n CVE-2021-25740 for more information). Implementations SHOULD NOT\n support ExternalName Services.\n\n Support: Core (Services with a type other than ExternalName)\n\n Support: Implementation-specific (Services with type ExternalName)\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the backend. When unspecified, the local\n namespace is inferred.\n\n Note that when a namespace different than the local namespace is specified,\n a ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port specifies the destination port number to use for this resource.\n Port is required when the referent is a Kubernetes Service. In this\n case, the port number is the service port number, not the target port.\n For other resources, destination port might be derived from the referent\n resource or this field.\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n required:\n - name\n type: object\n x-kubernetes-validations:\n - message: Must have port for Service reference\n rule: \"(size(self.group) == 0 && self.kind\n == 'Service') ? has(self.port) : true\"\n fraction:\n description: |-\n Fraction represents the fraction of requests that should be\n mirrored to BackendRef.\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n properties:\n denominator:\n default: 100\n format: int32\n minimum: 1\n type: integer\n numerator:\n format: int32\n minimum: 0\n type: integer\n required:\n - numerator\n type: object\n x-kubernetes-validations:\n - message: numerator must be less than or equal\n to denominator\n rule: self.numerator <= self.denominator\n percent:\n description: |-\n Percent represents the percentage of requests that should be\n mirrored to BackendRef. Its minimum value is 0 (indicating 0% of\n requests) and its maximum value is 100 (indicating 100% of requests).\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n format: int32\n maximum: 100\n minimum: 0\n type: integer\n required:\n - backendRef\n type: object\n x-kubernetes-validations:\n - message: Only one of percent or fraction may be\n specified in HTTPRequestMirrorFilter\n rule: \"!(has(self.percent) && has(self.fraction))\"\n requestRedirect:\n description: |-\n RequestRedirect defines a schema for a filter that responds to the\n request with an HTTP redirection.\n\n Support: Core\n properties:\n hostname:\n description: |-\n Hostname is the hostname to be used in the value of the `Location`\n header in the response.\n When empty, the hostname in the `Host` header of the request is used.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n path:\n description: |-\n Path defines parameters used to modify the path of the incoming request.\n The modified path is then used to construct the `Location` header. When\n empty, the request path is used as-is.\n\n Support: Extended\n properties:\n replaceFullPath:\n description: |-\n ReplaceFullPath specifies the value with which to replace the full path\n of a request during a rewrite or redirect.\n maxLength: 1024\n type: string\n replacePrefixMatch:\n description: |-\n ReplacePrefixMatch specifies the value with which to replace the prefix\n match of a request during a rewrite or redirect. For example, a request\n to \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\n of \"/xyz\" would be modified to \"/xyz/bar\".\n\n Note that this matches the behavior of the PathPrefix match type. This\n matches full path elements. A path element refers to the list of labels\n in the path split by the `/` separator. When specified, a trailing `/` is\n ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\n match the prefix `/abc`, but the path `/abcd` would not.\n\n ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\n Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in\n the implementation setting the Accepted Condition for the Route to `status: False`.\n\n Request Path | Prefix Match | Replace Prefix | Modified Path\n maxLength: 1024\n type: string\n type:\n description: |-\n Type defines the type of path modifier. Additional types may be\n added in a future release of the API.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - ReplaceFullPath\n - ReplacePrefixMatch\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: replaceFullPath must be specified\n when type is set to 'ReplaceFullPath'\n rule: \"self.type == 'ReplaceFullPath' ?\n has(self.replaceFullPath) : true\"\n - message: type must be 'ReplaceFullPath' when\n replaceFullPath is set\n rule: \"has(self.replaceFullPath) ? self.type\n == 'ReplaceFullPath' : true\"\n - message: replacePrefixMatch must be specified\n when type is set to 'ReplacePrefixMatch'\n rule: \"self.type == 'ReplacePrefixMatch'\n ? has(self.replacePrefixMatch) : true\"\n - message: type must be 'ReplacePrefixMatch'\n when replacePrefixMatch is set\n rule: \"has(self.replacePrefixMatch) ? self.type\n == 'ReplacePrefixMatch' : true\"\n port:\n description: |-\n Port is the port to be used in the value of the `Location`\n header in the response.\n\n If no port is specified, the redirect port MUST be derived using the\n following rules:\n\n * If redirect scheme is not-empty, the redirect port MUST be the well-known\n port associated with the redirect scheme. Specifically \"http\" to port 80\n and \"https\" to port 443. If the redirect scheme does not have a\n well-known port, the listener port of the Gateway SHOULD be used.\n * If redirect scheme is empty, the redirect port MUST be the Gateway\n Listener port.\n\n Implementations SHOULD NOT add the port number in the 'Location'\n header in the following cases:\n\n * A Location header that will use HTTP (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 80.\n * A Location header that will use HTTPS (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 443.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n scheme:\n description: |-\n Scheme is the scheme to be used in the value of the `Location` header in\n the response. When empty, the scheme of the request is used.\n\n Scheme redirects can affect the port of the redirect, for more information,\n refer to the documentation for the port field of this filter.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n\n Support: Extended\n enum:\n - http\n - https\n type: string\n statusCode:\n default: 302\n description: |-\n StatusCode is the HTTP status code to be used in response.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n\n Support: Core\n enum:\n - 301\n - 302\n type: integer\n type: object\n responseHeaderModifier:\n description: |-\n ResponseHeaderModifier defines a schema for a filter that modifies response\n headers.\n\n Support: Extended\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n type:\n description: |-\n Type identifies the type of filter to apply. As with other API fields,\n types are classified into three conformance levels:\n\n - Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations must support core filters.\n\n - Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n - Implementation-specific: Filters that are defined and supported by\n specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` should be set to\n \"ExtensionRef\" for custom filters.\n\n Implementers are encouraged to define custom implementation types to\n extend the core API with implementation-specific behavior.\n\n If a reference to a custom filter type cannot be resolved, the filter\n MUST NOT be skipped. Instead, requests that would have been processed by\n that filter MUST receive a HTTP error response.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - RequestHeaderModifier\n - ResponseHeaderModifier\n - RequestMirror\n - RequestRedirect\n - URLRewrite\n - ExtensionRef\n type: string\n urlRewrite:\n description: |-\n URLRewrite defines a schema for a filter that modifies a request during forwarding.\n\n Support: Extended\n properties:\n hostname:\n description: |-\n Hostname is the value to be used to replace the Host header value during\n forwarding.\n\n Support: Extended\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n path:\n description: |-\n Path defines a path rewrite.\n\n Support: Extended\n properties:\n replaceFullPath:\n description: |-\n ReplaceFullPath specifies the value with which to replace the full path\n of a request during a rewrite or redirect.\n maxLength: 1024\n type: string\n replacePrefixMatch:\n description: |-\n ReplacePrefixMatch specifies the value with which to replace the prefix\n match of a request during a rewrite or redirect. For example, a request\n to \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\n of \"/xyz\" would be modified to \"/xyz/bar\".\n\n Note that this matches the behavior of the PathPrefix match type. This\n matches full path elements. A path element refers to the list of labels\n in the path split by the `/` separator. When specified, a trailing `/` is\n ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\n match the prefix `/abc`, but the path `/abcd` would not.\n\n ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\n Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in\n the implementation setting the Accepted Condition for the Route to `status: False`.\n\n Request Path | Prefix Match | Replace Prefix | Modified Path\n maxLength: 1024\n type: string\n type:\n description: |-\n Type defines the type of path modifier. Additional types may be\n added in a future release of the API.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - ReplaceFullPath\n - ReplacePrefixMatch\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: replaceFullPath must be specified\n when type is set to 'ReplaceFullPath'\n rule: \"self.type == 'ReplaceFullPath' ?\n has(self.replaceFullPath) : true\"\n - message: type must be 'ReplaceFullPath' when\n replaceFullPath is set\n rule: \"has(self.replaceFullPath) ? self.type\n == 'ReplaceFullPath' : true\"\n - message: replacePrefixMatch must be specified\n when type is set to 'ReplacePrefixMatch'\n rule: \"self.type == 'ReplacePrefixMatch'\n ? has(self.replacePrefixMatch) : true\"\n - message: type must be 'ReplacePrefixMatch'\n when replacePrefixMatch is set\n rule: \"has(self.replacePrefixMatch) ? self.type\n == 'ReplacePrefixMatch' : true\"\n type: object\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: filter.requestHeaderModifier must be nil\n if the filter.type is not RequestHeaderModifier\n rule: \"!(has(self.requestHeaderModifier) && self.type\n != 'RequestHeaderModifier')\"\n - message: filter.requestHeaderModifier must be specified\n for RequestHeaderModifier filter.type\n rule: \"!(!has(self.requestHeaderModifier) && self.type\n == 'RequestHeaderModifier')\"\n - message: filter.responseHeaderModifier must be nil\n if the filter.type is not ResponseHeaderModifier\n rule: \"!(has(self.responseHeaderModifier) && self.type\n != 'ResponseHeaderModifier')\"\n - message: filter.responseHeaderModifier must be specified\n for ResponseHeaderModifier filter.type\n rule: \"!(!has(self.responseHeaderModifier) && self.type\n == 'ResponseHeaderModifier')\"\n - message: filter.requestMirror must be nil if the filter.type\n is not RequestMirror\n rule: \"!(has(self.requestMirror) && self.type != 'RequestMirror')\"\n - message: filter.requestMirror must be specified for\n RequestMirror filter.type\n rule: \"!(!has(self.requestMirror) && self.type ==\n 'RequestMirror')\"\n - message: filter.requestRedirect must be nil if the\n filter.type is not RequestRedirect\n rule: \"!(has(self.requestRedirect) && self.type !=\n 'RequestRedirect')\"\n - message: filter.requestRedirect must be specified\n for RequestRedirect filter.type\n rule: \"!(!has(self.requestRedirect) && self.type ==\n 'RequestRedirect')\"\n - message: filter.urlRewrite must be nil if the filter.type\n is not URLRewrite\n rule: \"!(has(self.urlRewrite) && self.type != 'URLRewrite')\"\n - message: filter.urlRewrite must be specified for URLRewrite\n filter.type\n rule: \"!(!has(self.urlRewrite) && self.type == 'URLRewrite')\"\n - message: filter.extensionRef must be nil if the filter.type\n is not ExtensionRef\n rule: \"!(has(self.extensionRef) && self.type != 'ExtensionRef')\"\n - message: filter.extensionRef must be specified for\n ExtensionRef filter.type\n rule: \"!(!has(self.extensionRef) && self.type == 'ExtensionRef')\"\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: May specify either httpRouteFilterRequestRedirect\n or httpRouteFilterRequestRewrite, but not both\n rule: \"!(self.exists(f, f.type == 'RequestRedirect')\n && self.exists(f, f.type == 'URLRewrite'))\"\n - message: RequestHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'RequestHeaderModifier').size()\n <= 1\n - message: ResponseHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()\n <= 1\n - message: RequestRedirect filter cannot be repeated\n rule: self.filter(f, f.type == 'RequestRedirect').size()\n <= 1\n - message: URLRewrite filter cannot be repeated\n rule: self.filter(f, f.type == 'URLRewrite').size()\n <= 1\n group:\n default: \"\"\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Service\n description: |-\n Kind is the Kubernetes resource kind of the referent. For example\n \"Service\".\n\n Defaults to \"Service\" when not specified.\n\n ExternalName services can refer to CNAME DNS records that may live\n outside of the cluster and as such are difficult to reason about in\n terms of conformance. They also may not be safe to forward to (see\n CVE-2021-25740 for more information). Implementations SHOULD NOT\n support ExternalName Services.\n\n Support: Core (Services with a type other than ExternalName)\n\n Support: Implementation-specific (Services with type ExternalName)\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the backend. When unspecified, the local\n namespace is inferred.\n\n Note that when a namespace different than the local namespace is specified,\n a ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port specifies the destination port number to use for this resource.\n Port is required when the referent is a Kubernetes Service. In this\n case, the port number is the service port number, not the target port.\n For other resources, destination port might be derived from the referent\n resource or this field.\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n weight:\n default: 1\n description: |-\n Weight specifies the proportion of requests forwarded to the referenced\n backend. This is computed as weight/(sum of all weights in this\n BackendRefs list). For non-zero values, there may be some epsilon from\n the exact proportion defined here depending on the precision an\n implementation supports. Weight is not a percentage and the sum of\n weights does not need to equal 100.\n\n If only one backend is specified and it has a weight greater than 0, 100%\n of the traffic is forwarded to that backend. If weight is set to 0, no\n traffic should be forwarded for this entry. If unspecified, weight\n defaults to 1.\n\n Support for this field varies based on the context where used.\n format: int32\n maximum: 1000000\n minimum: 0\n type: integer\n required:\n - name\n type: object\n x-kubernetes-validations:\n - message: Must have port for Service reference\n rule: \"(size(self.group) == 0 && self.kind == 'Service')\n ? has(self.port) : true\"\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n filters:\n description: |-\n Filters define the filters that are applied to requests that match\n this rule.\n\n Wherever possible, implementations SHOULD implement filters in the order\n they are specified.\n\n Implementations MAY choose to implement this ordering strictly, rejecting\n any combination or order of filters that cannot be supported. If implementations\n choose a strict interpretation of filter ordering, they MUST clearly document\n that behavior.\n\n To reject an invalid combination or order of filters, implementations SHOULD\n consider the Route Rules with this configuration invalid. If all Route Rules\n in a Route are invalid, the entire Route would be considered invalid. If only\n a portion of Route Rules are invalid, implementations MUST set the\n \"PartiallyInvalid\" condition for the Route.\n\n Conformance-levels at this level are defined based on the type of filter:\n\n - ALL core filters MUST be supported by all implementations.\n - Implementers are encouraged to support extended filters.\n - Implementation-specific custom filters have no API guarantees across\n implementations.\n\n Specifying the same filter multiple times is not supported unless explicitly\n indicated in the filter.\n\n All filters are expected to be compatible with each other except for the\n URLRewrite and RequestRedirect filters, which may not be combined. If an\n implementation cannot support other combinations of filters, they must clearly\n document that limitation. In cases where incompatible or unsupported\n filters are specified and cause the `Accepted` condition to be set to status\n `False`, implementations may use the `IncompatibleFilters` reason to specify\n this configuration error.\n\n Support: Core\n items:\n description: |-\n HTTPRouteFilter defines processing steps that must be completed during the\n request or response lifecycle. HTTPRouteFilters are meant as an extension\n point to express processing that may be done in Gateway implementations. Some\n examples include request or response modification, implementing\n authentication strategies, rate-limiting, and traffic shaping. API\n guarantee/conformance is defined based on the type of the filter.\n properties:\n extensionRef:\n description: |-\n ExtensionRef is an optional, implementation-specific extension to the\n \"filter\" behavior. For example, resource \"myroutefilter\" in group\n \"networking.example.net\"). ExtensionRef MUST NOT be used for core and\n extended filters.\n\n This filter can be used multiple times within the same rule.\n\n Support: Implementation-specific\n properties:\n group:\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent. For example\n \"HTTPRoute\" or \"Service\".\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - group\n - kind\n - name\n type: object\n requestHeaderModifier:\n description: |-\n RequestHeaderModifier defines a schema for a filter that modifies request\n headers.\n\n Support: Core\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n requestMirror:\n description: |-\n RequestMirror defines a schema for a filter that mirrors requests.\n Requests are sent to the specified destination, but responses from\n that destination are ignored.\n\n This filter can be used multiple times within the same rule. Note that\n not all implementations will be able to support mirroring to multiple\n backends.\n\n Support: Extended\n properties:\n backendRef:\n description: |-\n BackendRef references a resource where mirrored requests are sent.\n\n Mirrored requests must be sent only to a single destination endpoint\n within this BackendRef, irrespective of how many endpoints are present\n within this BackendRef.\n\n If the referent cannot be found, this BackendRef is invalid and must be\n dropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\n condition on the Route status is set to `status: False` and not configure\n this backend in the underlying implementation.\n\n If there is a cross-namespace reference to an *existing* object\n that is not allowed by a ReferenceGrant, the controller must ensure the\n \"ResolvedRefs\" condition on the Route is set to `status: False`,\n with the \"RefNotPermitted\" reason and not configure this backend in the\n underlying implementation.\n\n In either error case, the Message of the `ResolvedRefs` Condition\n should be used to provide more detail about the problem.\n\n Support: Extended for Kubernetes Service\n\n Support: Implementation-specific for any other resource\n properties:\n group:\n default: \"\"\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Service\n description: |-\n Kind is the Kubernetes resource kind of the referent. For example\n \"Service\".\n\n Defaults to \"Service\" when not specified.\n\n ExternalName services can refer to CNAME DNS records that may live\n outside of the cluster and as such are difficult to reason about in\n terms of conformance. They also may not be safe to forward to (see\n CVE-2021-25740 for more information). Implementations SHOULD NOT\n support ExternalName Services.\n\n Support: Core (Services with a type other than ExternalName)\n\n Support: Implementation-specific (Services with type ExternalName)\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the backend. When unspecified, the local\n namespace is inferred.\n\n Note that when a namespace different than the local namespace is specified,\n a ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port specifies the destination port number to use for this resource.\n Port is required when the referent is a Kubernetes Service. In this\n case, the port number is the service port number, not the target port.\n For other resources, destination port might be derived from the referent\n resource or this field.\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n required:\n - name\n type: object\n x-kubernetes-validations:\n - message: Must have port for Service reference\n rule: \"(size(self.group) == 0 && self.kind == 'Service')\n ? has(self.port) : true\"\n fraction:\n description: |-\n Fraction represents the fraction of requests that should be\n mirrored to BackendRef.\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n properties:\n denominator:\n default: 100\n format: int32\n minimum: 1\n type: integer\n numerator:\n format: int32\n minimum: 0\n type: integer\n required:\n - numerator\n type: object\n x-kubernetes-validations:\n - message: numerator must be less than or equal to\n denominator\n rule: self.numerator <= self.denominator\n percent:\n description: |-\n Percent represents the percentage of requests that should be\n mirrored to BackendRef. Its minimum value is 0 (indicating 0% of\n requests) and its maximum value is 100 (indicating 100% of requests).\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n format: int32\n maximum: 100\n minimum: 0\n type: integer\n required:\n - backendRef\n type: object\n x-kubernetes-validations:\n - message: Only one of percent or fraction may be specified\n in HTTPRequestMirrorFilter\n rule: \"!(has(self.percent) && has(self.fraction))\"\n requestRedirect:\n description: |-\n RequestRedirect defines a schema for a filter that responds to the\n request with an HTTP redirection.\n\n Support: Core\n properties:\n hostname:\n description: |-\n Hostname is the hostname to be used in the value of the `Location`\n header in the response.\n When empty, the hostname in the `Host` header of the request is used.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n path:\n description: |-\n Path defines parameters used to modify the path of the incoming request.\n The modified path is then used to construct the `Location` header. When\n empty, the request path is used as-is.\n\n Support: Extended\n properties:\n replaceFullPath:\n description: |-\n ReplaceFullPath specifies the value with which to replace the full path\n of a request during a rewrite or redirect.\n maxLength: 1024\n type: string\n replacePrefixMatch:\n description: |-\n ReplacePrefixMatch specifies the value with which to replace the prefix\n match of a request during a rewrite or redirect. For example, a request\n to \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\n of \"/xyz\" would be modified to \"/xyz/bar\".\n\n Note that this matches the behavior of the PathPrefix match type. This\n matches full path elements. A path element refers to the list of labels\n in the path split by the `/` separator. When specified, a trailing `/` is\n ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\n match the prefix `/abc`, but the path `/abcd` would not.\n\n ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\n Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in\n the implementation setting the Accepted Condition for the Route to `status: False`.\n\n Request Path | Prefix Match | Replace Prefix | Modified Path\n maxLength: 1024\n type: string\n type:\n description: |-\n Type defines the type of path modifier. Additional types may be\n added in a future release of the API.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - ReplaceFullPath\n - ReplacePrefixMatch\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: replaceFullPath must be specified when\n type is set to 'ReplaceFullPath'\n rule: \"self.type == 'ReplaceFullPath' ? has(self.replaceFullPath)\n : true\"\n - message: type must be 'ReplaceFullPath' when replaceFullPath\n is set\n rule: \"has(self.replaceFullPath) ? self.type ==\n 'ReplaceFullPath' : true\"\n - message: replacePrefixMatch must be specified when\n type is set to 'ReplacePrefixMatch'\n rule: \"self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch)\n : true\"\n - message: type must be 'ReplacePrefixMatch' when\n replacePrefixMatch is set\n rule: \"has(self.replacePrefixMatch) ? self.type\n == 'ReplacePrefixMatch' : true\"\n port:\n description: |-\n Port is the port to be used in the value of the `Location`\n header in the response.\n\n If no port is specified, the redirect port MUST be derived using the\n following rules:\n\n * If redirect scheme is not-empty, the redirect port MUST be the well-known\n port associated with the redirect scheme. Specifically \"http\" to port 80\n and \"https\" to port 443. If the redirect scheme does not have a\n well-known port, the listener port of the Gateway SHOULD be used.\n * If redirect scheme is empty, the redirect port MUST be the Gateway\n Listener port.\n\n Implementations SHOULD NOT add the port number in the 'Location'\n header in the following cases:\n\n * A Location header that will use HTTP (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 80.\n * A Location header that will use HTTPS (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 443.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n scheme:\n description: |-\n Scheme is the scheme to be used in the value of the `Location` header in\n the response. When empty, the scheme of the request is used.\n\n Scheme redirects can affect the port of the redirect, for more information,\n refer to the documentation for the port field of this filter.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n\n Support: Extended\n enum:\n - http\n - https\n type: string\n statusCode:\n default: 302\n description: |-\n StatusCode is the HTTP status code to be used in response.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n\n Support: Core\n enum:\n - 301\n - 302\n type: integer\n type: object\n responseHeaderModifier:\n description: |-\n ResponseHeaderModifier defines a schema for a filter that modifies response\n headers.\n\n Support: Extended\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n type:\n description: |-\n Type identifies the type of filter to apply. As with other API fields,\n types are classified into three conformance levels:\n\n - Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations must support core filters.\n\n - Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n - Implementation-specific: Filters that are defined and supported by\n specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` should be set to\n \"ExtensionRef\" for custom filters.\n\n Implementers are encouraged to define custom implementation types to\n extend the core API with implementation-specific behavior.\n\n If a reference to a custom filter type cannot be resolved, the filter\n MUST NOT be skipped. Instead, requests that would have been processed by\n that filter MUST receive a HTTP error response.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - RequestHeaderModifier\n - ResponseHeaderModifier\n - RequestMirror\n - RequestRedirect\n - URLRewrite\n - ExtensionRef\n type: string\n urlRewrite:\n description: |-\n URLRewrite defines a schema for a filter that modifies a request during forwarding.\n\n Support: Extended\n properties:\n hostname:\n description: |-\n Hostname is the value to be used to replace the Host header value during\n forwarding.\n\n Support: Extended\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n path:\n description: |-\n Path defines a path rewrite.\n\n Support: Extended\n properties:\n replaceFullPath:\n description: |-\n ReplaceFullPath specifies the value with which to replace the full path\n of a request during a rewrite or redirect.\n maxLength: 1024\n type: string\n replacePrefixMatch:\n description: |-\n ReplacePrefixMatch specifies the value with which to replace the prefix\n match of a request during a rewrite or redirect. For example, a request\n to \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\n of \"/xyz\" would be modified to \"/xyz/bar\".\n\n Note that this matches the behavior of the PathPrefix match type. This\n matches full path elements. A path element refers to the list of labels\n in the path split by the `/` separator. When specified, a trailing `/` is\n ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\n match the prefix `/abc`, but the path `/abcd` would not.\n\n ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\n Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in\n the implementation setting the Accepted Condition for the Route to `status: False`.\n\n Request Path | Prefix Match | Replace Prefix | Modified Path\n maxLength: 1024\n type: string\n type:\n description: |-\n Type defines the type of path modifier. Additional types may be\n added in a future release of the API.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - ReplaceFullPath\n - ReplacePrefixMatch\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: replaceFullPath must be specified when\n type is set to 'ReplaceFullPath'\n rule: \"self.type == 'ReplaceFullPath' ? has(self.replaceFullPath)\n : true\"\n - message: type must be 'ReplaceFullPath' when replaceFullPath\n is set\n rule: \"has(self.replaceFullPath) ? self.type ==\n 'ReplaceFullPath' : true\"\n - message: replacePrefixMatch must be specified when\n type is set to 'ReplacePrefixMatch'\n rule: \"self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch)\n : true\"\n - message: type must be 'ReplacePrefixMatch' when\n replacePrefixMatch is set\n rule: \"has(self.replacePrefixMatch) ? self.type\n == 'ReplacePrefixMatch' : true\"\n type: object\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: filter.requestHeaderModifier must be nil if the\n filter.type is not RequestHeaderModifier\n rule: \"!(has(self.requestHeaderModifier) && self.type !=\n 'RequestHeaderModifier')\"\n - message: filter.requestHeaderModifier must be specified\n for RequestHeaderModifier filter.type\n rule: \"!(!has(self.requestHeaderModifier) && self.type ==\n 'RequestHeaderModifier')\"\n - message: filter.responseHeaderModifier must be nil if the\n filter.type is not ResponseHeaderModifier\n rule: \"!(has(self.responseHeaderModifier) && self.type !=\n 'ResponseHeaderModifier')\"\n - message: filter.responseHeaderModifier must be specified\n for ResponseHeaderModifier filter.type\n rule: \"!(!has(self.responseHeaderModifier) && self.type\n == 'ResponseHeaderModifier')\"\n - message: filter.requestMirror must be nil if the filter.type\n is not RequestMirror\n rule: \"!(has(self.requestMirror) && self.type != 'RequestMirror')\"\n - message: filter.requestMirror must be specified for RequestMirror\n filter.type\n rule: \"!(!has(self.requestMirror) && self.type == 'RequestMirror')\"\n - message: filter.requestRedirect must be nil if the filter.type\n is not RequestRedirect\n rule: \"!(has(self.requestRedirect) && self.type != 'RequestRedirect')\"\n - message: filter.requestRedirect must be specified for RequestRedirect\n filter.type\n rule: \"!(!has(self.requestRedirect) && self.type == 'RequestRedirect')\"\n - message: filter.urlRewrite must be nil if the filter.type\n is not URLRewrite\n rule: \"!(has(self.urlRewrite) && self.type != 'URLRewrite')\"\n - message: filter.urlRewrite must be specified for URLRewrite\n filter.type\n rule: \"!(!has(self.urlRewrite) && self.type == 'URLRewrite')\"\n - message: filter.extensionRef must be nil if the filter.type\n is not ExtensionRef\n rule: \"!(has(self.extensionRef) && self.type != 'ExtensionRef')\"\n - message: filter.extensionRef must be specified for ExtensionRef\n filter.type\n rule: \"!(!has(self.extensionRef) && self.type == 'ExtensionRef')\"\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: May specify either httpRouteFilterRequestRedirect\n or httpRouteFilterRequestRewrite, but not both\n rule: \"!(self.exists(f, f.type == 'RequestRedirect') &&\n self.exists(f, f.type == 'URLRewrite'))\"\n - message: RequestHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'RequestHeaderModifier').size()\n <= 1\n - message: ResponseHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()\n <= 1\n - message: RequestRedirect filter cannot be repeated\n rule: self.filter(f, f.type == 'RequestRedirect').size() <=\n 1\n - message: URLRewrite filter cannot be repeated\n rule: self.filter(f, f.type == 'URLRewrite').size() <= 1\n matches:\n default:\n - path:\n type: PathPrefix\n value: /\n description: |-\n Matches define conditions used for matching the rule against incoming\n HTTP requests. Each match is independent, i.e. this rule will be matched\n if **any** one of the matches is satisfied.\n\n For example, take the following matches configuration:\n\n ```\n matches:\n - path:\n value: \"/foo\"\n headers:\n - name: \"version\"\n value: \"v2\"\n - path:\n value: \"/v2/foo\"\n ```\n\n For a request to match against this rule, a request must satisfy\n EITHER of the two conditions:\n\n - path prefixed with `/foo` AND contains the header `version: v2`\n - path prefix of `/v2/foo`\n\n See the documentation for HTTPRouteMatch on how to specify multiple\n match conditions that should be ANDed together.\n\n If no matches are specified, the default is a prefix\n path match on \"/\", which has the effect of matching every\n HTTP request.\n\n Proxy or Load Balancer routing configuration generated from HTTPRoutes\n MUST prioritize matches based on the following criteria, continuing on\n ties. Across all rules specified on applicable Routes, precedence must be\n given to the match having:\n\n * \"Exact\" path match.\n * \"Prefix\" path match with largest number of characters.\n * Method match.\n * Largest number of header matches.\n * Largest number of query param matches.\n\n Note: The precedence of RegularExpression path matches are implementation-specific.\n\n If ties still exist across multiple Routes, matching precedence MUST be\n determined in order of the following criteria, continuing on ties:\n\n * The oldest Route based on creation timestamp.\n * The Route appearing first in alphabetical order by\n \"{namespace}/{name}\".\n\n If ties still exist within an HTTPRoute, matching precedence MUST be granted\n to the FIRST matching rule (in list order) with a match meeting the above\n criteria.\n\n When no rules matching a request have been successfully attached to the\n parent a request is coming from, a HTTP 404 status code MUST be returned.\n items:\n description: \"HTTPRouteMatch defines the predicate used to\n match requests to a given\\naction. Multiple match types\n are ANDed together, i.e. the match will\\nevaluate to true\n only if all conditions are satisfied.\\n\\nFor example, the\n match below will match a HTTP request only if its path\\nstarts\n with `/foo` AND it contains the `version: v1` header:\\n\\n```\\nmatch:\\n\\n\\tpath:\\n\\t\n \\ value: \\\"/foo\\\"\\n\\theaders:\\n\\t- name: \\\"version\\\"\\n\\t\n \\ value \\\"v1\\\"\\n\\n```\"\n properties:\n headers:\n description: |-\n Headers specifies HTTP request header matchers. Multiple match values are\n ANDed together, meaning, a request must match all the specified headers\n to select the route.\n items:\n description: |-\n HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request\n headers.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, only the first\n entry with an equivalent name MUST be considered for a match. Subsequent\n entries with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n\n When a header is repeated in an HTTP request, it is\n implementation-specific behavior as to how this is represented.\n Generally, proxies should follow the guidance from the RFC:\n https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding\n processing a repeated header, with special handling for \"Set-Cookie\".\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n type:\n default: Exact\n description: |-\n Type specifies how to match against the value of the header.\n\n Support: Core (Exact)\n\n Support: Implementation-specific (RegularExpression)\n\n Since RegularExpression HeaderMatchType has implementation-specific\n conformance, implementations can support POSIX, PCRE or any other dialects\n of regular expressions. Please read the implementation's documentation to\n determine the supported dialect.\n enum:\n - Exact\n - RegularExpression\n type: string\n value:\n description: Value is the value of HTTP Header to\n be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n method:\n description: |-\n Method specifies HTTP method matcher.\n When specified, this route will be matched only if the request has the\n specified method.\n\n Support: Extended\n enum:\n - GET\n - HEAD\n - POST\n - PUT\n - DELETE\n - CONNECT\n - OPTIONS\n - TRACE\n - PATCH\n type: string\n path:\n default:\n type: PathPrefix\n value: /\n description: |-\n Path specifies a HTTP request path matcher. If this field is not\n specified, a default prefix match on the \"/\" path is provided.\n properties:\n type:\n default: PathPrefix\n description: |-\n Type specifies how to match against the path Value.\n\n Support: Core (Exact, PathPrefix)\n\n Support: Implementation-specific (RegularExpression)\n enum:\n - Exact\n - PathPrefix\n - RegularExpression\n type: string\n value:\n default: /\n description: Value of the HTTP path to match against.\n maxLength: 1024\n type: string\n type: object\n x-kubernetes-validations:\n - message: value must be an absolute path and start with\n '/' when type one of ['Exact', 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? self.value.startsWith('/')\n : true\"\n - message: must not contain '//' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('//')\n : true\"\n - message: must not contain '/./' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('/./')\n : true\"\n - message: must not contain '/../' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('/../')\n : true\"\n - message: must not contain '%2f' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('%2f')\n : true\"\n - message: must not contain '%2F' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('%2F')\n : true\"\n - message: must not contain '#' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('#')\n : true\"\n - message: must not end with '/..' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.endsWith('/..')\n : true\"\n - message: must not end with '/.' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.endsWith('/.')\n : true\"\n - message: type must be one of ['Exact', 'PathPrefix',\n 'RegularExpression']\n rule: self.type in ['Exact','PathPrefix'] || self.type\n == 'RegularExpression'\n - message: must only contain valid characters (matching\n ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$)\n for types ['Exact', 'PathPrefix']\n rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r\"\"\"^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$\"\"\")\n : true'\n queryParams:\n description: |-\n QueryParams specifies HTTP query parameter matchers. Multiple match\n values are ANDed together, meaning, a request must match all the\n specified query parameters to select the route.\n\n Support: Extended\n items:\n description: |-\n HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP\n query parameters.\n properties:\n name:\n description: |-\n Name is the name of the HTTP query param to be matched. This must be an\n exact string match. (See\n https://tools.ietf.org/html/rfc7230#section-2.7.3).\n\n If multiple entries specify equivalent query param names, only the first\n entry with an equivalent name MUST be considered for a match. Subsequent\n entries with an equivalent query param name MUST be ignored.\n\n If a query param is repeated in an HTTP request, the behavior is\n purposely left undefined, since different data planes have different\n capabilities. However, it is *recommended* that implementations should\n match against the first value of the param if the data plane supports it,\n as this behavior is expected in other load balancing contexts outside of\n the Gateway API.\n\n Users SHOULD NOT route traffic based on repeated query params to guard\n themselves against potential differences in the implementations.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n type:\n default: Exact\n description: |-\n Type specifies how to match against the value of the query parameter.\n\n Support: Extended (Exact)\n\n Support: Implementation-specific (RegularExpression)\n\n Since RegularExpression QueryParamMatchType has Implementation-specific\n conformance, implementations can support POSIX, PCRE or any other\n dialects of regular expressions. Please read the implementation's\n documentation to determine the supported dialect.\n enum:\n - Exact\n - RegularExpression\n type: string\n value:\n description: Value is the value of HTTP query param\n to be matched.\n maxLength: 1024\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n maxItems: 64\n type: array\n x-kubernetes-list-type: atomic\n name:\n description: |-\n Name is the name of the route rule. This name MUST be unique within a Route if it is set.\n\n Support: Extended\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n timeouts:\n description: |-\n Timeouts defines the timeouts that can be configured for an HTTP request.\n\n Support: Extended\n properties:\n backendRequest:\n description: |-\n BackendRequest specifies a timeout for an individual request from the gateway\n to a backend. This covers the time from when the request first starts being\n sent from the gateway to when the full response has been received from the backend.\n\n Setting a timeout to the zero duration (e.g. \"0s\") SHOULD disable the timeout\n completely. Implementations that cannot completely disable the timeout MUST\n instead interpret the zero duration as the longest possible value to which\n the timeout can be set.\n\n An entire client HTTP transaction with a gateway, covered by the Request timeout,\n may result in more than one call from the gateway to the destination backend,\n for example, if automatic retries are supported.\n\n The value of BackendRequest must be a Gateway API Duration string as defined by\n GEP-2257. When this field is unspecified, its behavior is implementation-specific;\n when specified, the value of BackendRequest must be no more than the value of the\n Request timeout (since the Request timeout encompasses the BackendRequest timeout).\n\n Support: Extended\n pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$\n type: string\n request:\n description: |-\n Request specifies the maximum duration for a gateway to respond to an HTTP request.\n If the gateway has not been able to respond before this deadline is met, the gateway\n MUST return a timeout error.\n\n For example, setting the `rules.timeouts.request` field to the value `10s` in an\n `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds\n to complete.\n\n Setting a timeout to the zero duration (e.g. \"0s\") SHOULD disable the timeout\n completely. Implementations that cannot completely disable the timeout MUST\n instead interpret the zero duration as the longest possible value to which\n the timeout can be set.\n\n This timeout is intended to cover as close to the whole request-response transaction\n as possible although an implementation MAY choose to start the timeout after the entire\n request stream has been received instead of immediately after the transaction is\n initiated by the client.\n\n The value of Request is a Gateway API Duration string as defined by GEP-2257. When this\n field is unspecified, request timeout behavior is implementation-specific.\n\n Support: Extended\n pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$\n type: string\n type: object\n x-kubernetes-validations:\n - message: backendRequest timeout cannot be longer than request\n timeout\n rule: \"!(has(self.request) && has(self.backendRequest) &&\n duration(self.request) != duration('0s') && duration(self.backendRequest)\n > duration(self.request))\"\n type: object\n x-kubernetes-validations:\n - message: RequestRedirect filter must not be used together with\n backendRefs\n rule: \"(has(self.backendRefs) && size(self.backendRefs) > 0) ?\n (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))):\n true\"\n - message: When using RequestRedirect filter with path.replacePrefixMatch,\n exactly one PathPrefix match must be specified\n rule: \"(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect)\n && has(f.requestRedirect.path) && f.requestRedirect.path.type\n == 'ReplacePrefixMatch' && has(f.requestRedirect.path.replacePrefixMatch)))\n ? ((size(self.matches) != 1 || !has(self.matches[0].path) ||\n self.matches[0].path.type != 'PathPrefix') ? false : true)\n : true\"\n - message: When using URLRewrite filter with path.replacePrefixMatch,\n exactly one PathPrefix match must be specified\n rule: \"(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite)\n && has(f.urlRewrite.path) && f.urlRewrite.path.type == 'ReplacePrefixMatch'\n && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches)\n != 1 || !has(self.matches[0].path) || self.matches[0].path.type\n != 'PathPrefix') ? false : true) : true\"\n - message: Within backendRefs, when using RequestRedirect filter\n with path.replacePrefixMatch, exactly one PathPrefix match must\n be specified\n rule: \"(has(self.backendRefs) && self.backendRefs.exists_one(b,\n (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect)\n && has(f.requestRedirect.path) && f.requestRedirect.path.type\n == 'ReplacePrefixMatch' && has(f.requestRedirect.path.replacePrefixMatch)))\n )) ? ((size(self.matches) != 1 || !has(self.matches[0].path)\n || self.matches[0].path.type != 'PathPrefix') ? false : true)\n : true\"\n - message: Within backendRefs, When using URLRewrite filter with\n path.replacePrefixMatch, exactly one PathPrefix match must be\n specified\n rule: \"(has(self.backendRefs) && self.backendRefs.exists_one(b,\n (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite)\n && has(f.urlRewrite.path) && f.urlRewrite.path.type == 'ReplacePrefixMatch'\n && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches)\n != 1 || !has(self.matches[0].path) || self.matches[0].path.type\n != 'PathPrefix') ? false : true) : true\"\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: While 16 rules and 64 matches per rule are allowed, the\n total number of matches across all rules in a route must be less\n than 128\n rule: \"(self.size() > 0 ? self[0].matches.size() : 0) + (self.size()\n > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size()\n : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size()\n > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size()\n : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size()\n > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size()\n : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size()\n > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size()\n : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size()\n > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size()\n : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128\"\n type: object\n status:\n description: Status defines the current state of HTTPRoute.\n properties:\n parents:\n description: |-\n Parents is a list of parent resources (usually Gateways) that are\n associated with the route, and the status of the route with respect to\n each parent. When this route attaches to a parent, the controller that\n manages the parent must add an entry to this list when the controller\n first sees the route and should update the entry as appropriate when the\n route or gateway is modified.\n\n Note that parent references that cannot be resolved by an implementation\n of this API will not be added to this list. Implementations of this API\n can only populate Route status for the Gateways/parent resources they are\n responsible for.\n\n A maximum of 32 Gateways will be represented in this list. An empty list\n means the route has not been attached to any Gateway.\n items:\n description: |-\n RouteParentStatus describes the status of a route with respect to an\n associated Parent.\n properties:\n conditions:\n description: |-\n Conditions describes the status of the route with respect to the Gateway.\n Note that the route's availability is also subject to the Gateway's own\n status conditions and listener status.\n\n If the Route's ParentRef specifies an existing Gateway that supports\n Routes of this kind AND that Gateway's controller has sufficient access,\n then that Gateway's controller MUST set the \"Accepted\" condition on the\n Route, to indicate whether the route has been accepted or rejected by the\n Gateway, and why.\n\n A Route MUST be considered \"Accepted\" if at least one of the Route's\n rules is implemented by the Gateway.\n\n There are a number of cases where the \"Accepted\" condition may not be set\n due to lack of controller visibility, that includes when:\n\n * The Route refers to a nonexistent parent.\n * The Route is of a type that the controller does not support.\n * The Route is in a namespace the controller does not have access to.\n items:\n description: Condition contains details for one aspect of\n the current state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False,\n Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n maxItems: 8\n minItems: 1\n type: array\n x-kubernetes-list-map-keys:\n - type\n x-kubernetes-list-type: map\n controllerName:\n description: |-\n ControllerName is a domain/path string that indicates the name of the\n controller that wrote this status. This corresponds with the\n controllerName field on GatewayClass.\n\n Example: \"example.net/gateway-controller\".\n\n The format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\n valid Kubernetes names\n (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\n Controllers MUST populate this field when writing status. Controllers should ensure that\n entries to status populated with their ControllerName are cleaned up when they are no\n longer necessary.\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$\n type: string\n parentRef:\n description: |-\n ParentRef corresponds with a ParentRef in the spec that this\n RouteParentStatus struct describes the status of.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: |-\n Group is the group of the referent.\n When unspecified, \"gateway.networking.k8s.io\" is inferred.\n To set the core API group (such as for a \"Service\" kind referent),\n Group must be explicitly set to \"\" (empty string).\n\n Support: Core\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Gateway\n description: |-\n Kind is kind of the referent.\n\n There are two kinds of parent resources with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n Support for other resources is Implementation-Specific.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: |-\n Name is the name of the referent.\n\n Support: Core\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referent. When unspecified, this refers\n to the local namespace of the Route.\n\n Note that there are specific rules for ParentRefs which cross namespace\n boundaries. Cross-namespace references are only valid if they are explicitly\n allowed by something in the namespace they are referring to. For example:\n Gateway has the AllowedRoutes field, and ReferenceGrant provides a\n generic way to enable any other kind of cross-namespace reference.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port is the network port this Route targets. It can be interpreted\n differently based on the type of parent resource.\n\n When the parent resource is a Gateway, this targets all listeners\n listening on the specified port that also support this kind of Route(and\n select this Route). It's not recommended to set `Port` unless the\n networking behaviors specified in a Route must apply to a specific port\n as opposed to a listener(s) whose port(s) may be changed. When both Port\n and SectionName are specified, the name and port of the selected listener\n must match both specified values.\n\n Implementations MAY choose to support other parent resources.\n Implementations supporting other types of parent resources MUST clearly\n document how/if Port is interpreted.\n\n For the purpose of status, an attachment is considered successful as\n long as the parent resource accepts it partially. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment\n from the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route,\n the Route MUST be considered detached from the Gateway.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n sectionName:\n description: |-\n SectionName is the name of a section within the target resource. In the\n following resources, SectionName is interpreted as the following:\n\n * Gateway: Listener name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n * Service: Port name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n\n Implementations MAY choose to support attaching Routes to other resources.\n If that is the case, they MUST clearly document how SectionName is\n interpreted.\n\n When unspecified (empty string), this will reference the entire resource.\n For the purpose of status, an attachment is considered successful if at\n least one section in the parent resource accepts it. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\n the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route, the\n Route MUST be considered detached from the Gateway.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n required:\n - name\n type: object\n required:\n - conditions\n - controllerName\n - parentRef\n type: object\n maxItems: 32\n type: array\n x-kubernetes-list-type: atomic\n required:\n - parents\n type: object\n required:\n - spec\n type: object\n served: true\n storage: true\n subresources:\n status: {}\n - additionalPrinterColumns:\n - jsonPath: .spec.hostnames\n name: Hostnames\n type: string\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1beta1\n schema:\n openAPIV3Schema:\n description: |-\n HTTPRoute provides a way to route HTTP requests. This includes the capability\n to match requests by hostname, path, header, or query param. Filters can be\n used to specify additional processing steps. Backends specify where matching\n requests should be routed.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: Spec defines the desired state of HTTPRoute.\n properties:\n hostnames:\n description: |-\n Hostnames defines a set of hostnames that should match against the HTTP Host\n header to select a HTTPRoute used to process the request. Implementations\n MUST ignore any port value specified in the HTTP Host header while\n performing a match and (absent of any applicable header modification\n configuration) MUST forward this header unmodified to the backend.\n\n Valid values for Hostnames are determined by RFC 1123 definition of a\n hostname with 2 notable exceptions:\n\n 1. IPs are not allowed.\n 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label must appear by itself as the first label.\n\n If a hostname is specified by both the Listener and HTTPRoute, there\n must be at least one intersecting hostname for the HTTPRoute to be\n attached to the Listener. For example:\n\n * A Listener with `test.example.com` as the hostname matches HTTPRoutes\n that have either not specified any hostnames, or have specified at\n least one of `test.example.com` or `*.example.com`.\n * A Listener with `*.example.com` as the hostname matches HTTPRoutes\n that have either not specified any hostnames or have specified at least\n one hostname that matches the Listener hostname. For example,\n `*.example.com`, `test.example.com`, and `foo.test.example.com` would\n all match. On the other hand, `example.com` and `test.example.net` would\n not match.\n\n Hostnames that are prefixed with a wildcard label (`*.`) are interpreted\n as a suffix match. That means that a match for `*.example.com` would match\n both `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\n If both the Listener and HTTPRoute have specified hostnames, any\n HTTPRoute hostnames that do not match the Listener hostname MUST be\n ignored. For example, if a Listener specified `*.example.com`, and the\n HTTPRoute specified `test.example.com` and `test.example.net`,\n `test.example.net` must not be considered for a match.\n\n If both the Listener and HTTPRoute have specified hostnames, and none\n match with the criteria above, then the HTTPRoute is not accepted. The\n implementation must raise an 'Accepted' Condition with a status of\n `False` in the corresponding RouteParentStatus.\n\n In the event that multiple HTTPRoutes specify intersecting hostnames (e.g.\n overlapping wildcard matching and exact matching hostnames), precedence must\n be given to rules from the HTTPRoute with the largest number of:\n\n * Characters in a matching non-wildcard hostname.\n * Characters in a matching hostname.\n\n If ties exist across multiple Routes, the matching precedence rules for\n HTTPRouteMatches takes over.\n\n Support: Core\n items:\n description: |-\n Hostname is the fully qualified domain name of a network host. This matches\n the RFC 1123 definition of a hostname with 2 notable exceptions:\n\n 1. IPs are not allowed.\n 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label must appear by itself as the first label.\n\n Hostname can be \"precise\" which is a domain name without the terminating\n dot of a network host (e.g. \"foo.example.com\") or \"wildcard\", which is a\n domain name prefixed with a single wildcard label (e.g. `*.example.com`).\n\n Note that as per RFC1035 and RFC1123, a *label* must consist of lower case\n alphanumeric characters or '-', and must start and end with an alphanumeric\n character. No other punctuation is allowed.\n maxLength: 253\n minLength: 1\n pattern: ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n parentRefs:\n description: |-\n ParentRefs references the resources (usually Gateways) that a Route wants\n to be attached to. Note that the referenced parent resource needs to\n allow this for the attachment to be complete. For Gateways, that means\n the Gateway needs to allow attachment from Routes of this kind and\n namespace. For Services, that means the Service must either be in the same\n namespace for a \"producer\" route, or the mesh implementation must support\n and allow \"consumer\" routes for the referenced Service. ReferenceGrant is\n not applicable for governing ParentRefs to Services - it is not possible to\n create a \"producer\" route for a Service in a different namespace from the\n Route.\n\n There are two kinds of parent resources with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n This API may be extended in the future to support additional kinds of parent\n resources.\n\n ParentRefs must be _distinct_. This means either that:\n\n * They select different objects. If this is the case, then parentRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, `namespace`, and `name` must\n be unique across all parentRef entries in the Route.\n * They do not select different objects, but for each optional field used,\n each ParentRef that selects the same object must set the same set of\n optional fields to different values. If one ParentRef sets a\n combination of optional fields, all must set the same combination.\n\n Some examples:\n\n * If one ParentRef sets `sectionName`, all ParentRefs referencing the\n same object must also set `sectionName`.\n * If one ParentRef sets `port`, all ParentRefs referencing the same\n object must also set `port`.\n * If one ParentRef sets `sectionName` and `port`, all ParentRefs\n referencing the same object must also set `sectionName` and `port`.\n\n It is possible to separately reference multiple distinct objects that may\n be collapsed by an implementation. For example, some implementations may\n choose to merge compatible Gateway Listeners together. If that is the\n case, the list of routes attached to those resources should also be\n merged.\n\n Note that for ParentRefs that cross namespace boundaries, there are specific\n rules. Cross-namespace references are only valid if they are explicitly\n allowed by something in the namespace they are referring to. For example,\n Gateway has the AllowedRoutes field, and ReferenceGrant provides a\n generic way to enable other kinds of cross-namespace reference.\n items:\n description: |-\n ParentReference identifies an API object (usually a Gateway) that can be considered\n a parent of this resource (usually a route). There are two kinds of parent resources\n with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n This API may be extended in the future to support additional kinds of parent\n resources.\n\n The API object must be valid in the cluster; the Group and Kind must\n be registered in the cluster for this reference to be valid.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: |-\n Group is the group of the referent.\n When unspecified, \"gateway.networking.k8s.io\" is inferred.\n To set the core API group (such as for a \"Service\" kind referent),\n Group must be explicitly set to \"\" (empty string).\n\n Support: Core\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Gateway\n description: |-\n Kind is kind of the referent.\n\n There are two kinds of parent resources with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n Support for other resources is Implementation-Specific.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: |-\n Name is the name of the referent.\n\n Support: Core\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referent. When unspecified, this refers\n to the local namespace of the Route.\n\n Note that there are specific rules for ParentRefs which cross namespace\n boundaries. Cross-namespace references are only valid if they are explicitly\n allowed by something in the namespace they are referring to. For example:\n Gateway has the AllowedRoutes field, and ReferenceGrant provides a\n generic way to enable any other kind of cross-namespace reference.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port is the network port this Route targets. It can be interpreted\n differently based on the type of parent resource.\n\n When the parent resource is a Gateway, this targets all listeners\n listening on the specified port that also support this kind of Route(and\n select this Route). It's not recommended to set `Port` unless the\n networking behaviors specified in a Route must apply to a specific port\n as opposed to a listener(s) whose port(s) may be changed. When both Port\n and SectionName are specified, the name and port of the selected listener\n must match both specified values.\n\n Implementations MAY choose to support other parent resources.\n Implementations supporting other types of parent resources MUST clearly\n document how/if Port is interpreted.\n\n For the purpose of status, an attachment is considered successful as\n long as the parent resource accepts it partially. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment\n from the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route,\n the Route MUST be considered detached from the Gateway.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n sectionName:\n description: |-\n SectionName is the name of a section within the target resource. In the\n following resources, SectionName is interpreted as the following:\n\n * Gateway: Listener name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n * Service: Port name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n\n Implementations MAY choose to support attaching Routes to other resources.\n If that is the case, they MUST clearly document how SectionName is\n interpreted.\n\n When unspecified (empty string), this will reference the entire resource.\n For the purpose of status, an attachment is considered successful if at\n least one section in the parent resource accepts it. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\n the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route, the\n Route MUST be considered detached from the Gateway.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n required:\n - name\n type: object\n maxItems: 32\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: sectionName must be specified when parentRefs includes\n 2 or more references to the same parent\n rule: \"self.all(p1, self.all(p2, p1.group == p2.group && p1.kind\n == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)\n || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__\n == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&\n p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName)\n || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName\n == '')) : true))\"\n - message: sectionName must be unique when parentRefs includes 2 or\n more references to the same parent\n rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind\n == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)\n || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__\n == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&\n p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)\n || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName\n == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName\n == p2.sectionName))))\n rules:\n default:\n - matches:\n - path:\n type: PathPrefix\n value: /\n description: Rules are a list of HTTP matchers, filters and actions.\n items:\n description: |-\n HTTPRouteRule defines semantics for matching an HTTP request based on\n conditions (matches), processing it (filters), and forwarding the request to\n an API object (backendRefs).\n properties:\n backendRefs:\n description: |-\n BackendRefs defines the backend(s) where matching requests should be\n sent.\n\n Failure behavior here depends on how many BackendRefs are specified and\n how many are invalid.\n\n If *all* entries in BackendRefs are invalid, and there are also no filters\n specified in this route rule, *all* traffic which matches this rule MUST\n receive a 500 status code.\n\n See the HTTPBackendRef definition for the rules about what makes a single\n HTTPBackendRef invalid.\n\n When a HTTPBackendRef is invalid, 500 status codes MUST be returned for\n requests that would have otherwise been routed to an invalid backend. If\n multiple backends are specified, and some are invalid, the proportion of\n requests that would otherwise have been routed to an invalid backend\n MUST receive a 500 status code.\n\n For example, if two backends are specified with equal weights, and one is\n invalid, 50 percent of traffic must receive a 500. Implementations may\n choose how that 50 percent is determined.\n\n When a HTTPBackendRef refers to a Service that has no ready endpoints,\n implementations SHOULD return a 503 for requests to that backend instead.\n If an implementation chooses to do this, all of the above rules for 500 responses\n MUST also apply for responses that return a 503.\n\n Support: Core for Kubernetes Service\n\n Support: Extended for Kubernetes ServiceImport\n\n Support: Implementation-specific for any other resource\n\n Support for weight: Core\n items:\n description: |-\n HTTPBackendRef defines how a HTTPRoute forwards a HTTP request.\n\n Note that when a namespace different than the local namespace is specified, a\n ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n properties:\n filters:\n description: |-\n Filters defined at this level should be executed if and only if the\n request is being forwarded to the backend defined here.\n\n Support: Implementation-specific (For broader support of filters, use the\n Filters field in HTTPRouteRule.)\n items:\n description: |-\n HTTPRouteFilter defines processing steps that must be completed during the\n request or response lifecycle. HTTPRouteFilters are meant as an extension\n point to express processing that may be done in Gateway implementations. Some\n examples include request or response modification, implementing\n authentication strategies, rate-limiting, and traffic shaping. API\n guarantee/conformance is defined based on the type of the filter.\n properties:\n extensionRef:\n description: |-\n ExtensionRef is an optional, implementation-specific extension to the\n \"filter\" behavior. For example, resource \"myroutefilter\" in group\n \"networking.example.net\"). ExtensionRef MUST NOT be used for core and\n extended filters.\n\n This filter can be used multiple times within the same rule.\n\n Support: Implementation-specific\n properties:\n group:\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent. For\n example \"HTTPRoute\" or \"Service\".\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - group\n - kind\n - name\n type: object\n requestHeaderModifier:\n description: |-\n RequestHeaderModifier defines a schema for a filter that modifies request\n headers.\n\n Support: Core\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n requestMirror:\n description: |-\n RequestMirror defines a schema for a filter that mirrors requests.\n Requests are sent to the specified destination, but responses from\n that destination are ignored.\n\n This filter can be used multiple times within the same rule. Note that\n not all implementations will be able to support mirroring to multiple\n backends.\n\n Support: Extended\n properties:\n backendRef:\n description: |-\n BackendRef references a resource where mirrored requests are sent.\n\n Mirrored requests must be sent only to a single destination endpoint\n within this BackendRef, irrespective of how many endpoints are present\n within this BackendRef.\n\n If the referent cannot be found, this BackendRef is invalid and must be\n dropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\n condition on the Route status is set to `status: False` and not configure\n this backend in the underlying implementation.\n\n If there is a cross-namespace reference to an *existing* object\n that is not allowed by a ReferenceGrant, the controller must ensure the\n \"ResolvedRefs\" condition on the Route is set to `status: False`,\n with the \"RefNotPermitted\" reason and not configure this backend in the\n underlying implementation.\n\n In either error case, the Message of the `ResolvedRefs` Condition\n should be used to provide more detail about the problem.\n\n Support: Extended for Kubernetes Service\n\n Support: Implementation-specific for any other resource\n properties:\n group:\n default: \"\"\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Service\n description: |-\n Kind is the Kubernetes resource kind of the referent. For example\n \"Service\".\n\n Defaults to \"Service\" when not specified.\n\n ExternalName services can refer to CNAME DNS records that may live\n outside of the cluster and as such are difficult to reason about in\n terms of conformance. They also may not be safe to forward to (see\n CVE-2021-25740 for more information). Implementations SHOULD NOT\n support ExternalName Services.\n\n Support: Core (Services with a type other than ExternalName)\n\n Support: Implementation-specific (Services with type ExternalName)\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the backend. When unspecified, the local\n namespace is inferred.\n\n Note that when a namespace different than the local namespace is specified,\n a ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port specifies the destination port number to use for this resource.\n Port is required when the referent is a Kubernetes Service. In this\n case, the port number is the service port number, not the target port.\n For other resources, destination port might be derived from the referent\n resource or this field.\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n required:\n - name\n type: object\n x-kubernetes-validations:\n - message: Must have port for Service reference\n rule: \"(size(self.group) == 0 && self.kind\n == 'Service') ? has(self.port) : true\"\n fraction:\n description: |-\n Fraction represents the fraction of requests that should be\n mirrored to BackendRef.\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n properties:\n denominator:\n default: 100\n format: int32\n minimum: 1\n type: integer\n numerator:\n format: int32\n minimum: 0\n type: integer\n required:\n - numerator\n type: object\n x-kubernetes-validations:\n - message: numerator must be less than or equal\n to denominator\n rule: self.numerator <= self.denominator\n percent:\n description: |-\n Percent represents the percentage of requests that should be\n mirrored to BackendRef. Its minimum value is 0 (indicating 0% of\n requests) and its maximum value is 100 (indicating 100% of requests).\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n format: int32\n maximum: 100\n minimum: 0\n type: integer\n required:\n - backendRef\n type: object\n x-kubernetes-validations:\n - message: Only one of percent or fraction may be\n specified in HTTPRequestMirrorFilter\n rule: \"!(has(self.percent) && has(self.fraction))\"\n requestRedirect:\n description: |-\n RequestRedirect defines a schema for a filter that responds to the\n request with an HTTP redirection.\n\n Support: Core\n properties:\n hostname:\n description: |-\n Hostname is the hostname to be used in the value of the `Location`\n header in the response.\n When empty, the hostname in the `Host` header of the request is used.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n path:\n description: |-\n Path defines parameters used to modify the path of the incoming request.\n The modified path is then used to construct the `Location` header. When\n empty, the request path is used as-is.\n\n Support: Extended\n properties:\n replaceFullPath:\n description: |-\n ReplaceFullPath specifies the value with which to replace the full path\n of a request during a rewrite or redirect.\n maxLength: 1024\n type: string\n replacePrefixMatch:\n description: |-\n ReplacePrefixMatch specifies the value with which to replace the prefix\n match of a request during a rewrite or redirect. For example, a request\n to \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\n of \"/xyz\" would be modified to \"/xyz/bar\".\n\n Note that this matches the behavior of the PathPrefix match type. This\n matches full path elements. A path element refers to the list of labels\n in the path split by the `/` separator. When specified, a trailing `/` is\n ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\n match the prefix `/abc`, but the path `/abcd` would not.\n\n ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\n Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in\n the implementation setting the Accepted Condition for the Route to `status: False`.\n\n Request Path | Prefix Match | Replace Prefix | Modified Path\n maxLength: 1024\n type: string\n type:\n description: |-\n Type defines the type of path modifier. Additional types may be\n added in a future release of the API.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - ReplaceFullPath\n - ReplacePrefixMatch\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: replaceFullPath must be specified\n when type is set to 'ReplaceFullPath'\n rule: \"self.type == 'ReplaceFullPath' ?\n has(self.replaceFullPath) : true\"\n - message: type must be 'ReplaceFullPath' when\n replaceFullPath is set\n rule: \"has(self.replaceFullPath) ? self.type\n == 'ReplaceFullPath' : true\"\n - message: replacePrefixMatch must be specified\n when type is set to 'ReplacePrefixMatch'\n rule: \"self.type == 'ReplacePrefixMatch'\n ? has(self.replacePrefixMatch) : true\"\n - message: type must be 'ReplacePrefixMatch'\n when replacePrefixMatch is set\n rule: \"has(self.replacePrefixMatch) ? self.type\n == 'ReplacePrefixMatch' : true\"\n port:\n description: |-\n Port is the port to be used in the value of the `Location`\n header in the response.\n\n If no port is specified, the redirect port MUST be derived using the\n following rules:\n\n * If redirect scheme is not-empty, the redirect port MUST be the well-known\n port associated with the redirect scheme. Specifically \"http\" to port 80\n and \"https\" to port 443. If the redirect scheme does not have a\n well-known port, the listener port of the Gateway SHOULD be used.\n * If redirect scheme is empty, the redirect port MUST be the Gateway\n Listener port.\n\n Implementations SHOULD NOT add the port number in the 'Location'\n header in the following cases:\n\n * A Location header that will use HTTP (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 80.\n * A Location header that will use HTTPS (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 443.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n scheme:\n description: |-\n Scheme is the scheme to be used in the value of the `Location` header in\n the response. When empty, the scheme of the request is used.\n\n Scheme redirects can affect the port of the redirect, for more information,\n refer to the documentation for the port field of this filter.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n\n Support: Extended\n enum:\n - http\n - https\n type: string\n statusCode:\n default: 302\n description: |-\n StatusCode is the HTTP status code to be used in response.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n\n Support: Core\n enum:\n - 301\n - 302\n type: integer\n type: object\n responseHeaderModifier:\n description: |-\n ResponseHeaderModifier defines a schema for a filter that modifies response\n headers.\n\n Support: Extended\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP\n Header name and value as defined by RFC\n 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP\n Header to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n type:\n description: |-\n Type identifies the type of filter to apply. As with other API fields,\n types are classified into three conformance levels:\n\n - Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations must support core filters.\n\n - Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n - Implementation-specific: Filters that are defined and supported by\n specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` should be set to\n \"ExtensionRef\" for custom filters.\n\n Implementers are encouraged to define custom implementation types to\n extend the core API with implementation-specific behavior.\n\n If a reference to a custom filter type cannot be resolved, the filter\n MUST NOT be skipped. Instead, requests that would have been processed by\n that filter MUST receive a HTTP error response.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - RequestHeaderModifier\n - ResponseHeaderModifier\n - RequestMirror\n - RequestRedirect\n - URLRewrite\n - ExtensionRef\n type: string\n urlRewrite:\n description: |-\n URLRewrite defines a schema for a filter that modifies a request during forwarding.\n\n Support: Extended\n properties:\n hostname:\n description: |-\n Hostname is the value to be used to replace the Host header value during\n forwarding.\n\n Support: Extended\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n path:\n description: |-\n Path defines a path rewrite.\n\n Support: Extended\n properties:\n replaceFullPath:\n description: |-\n ReplaceFullPath specifies the value with which to replace the full path\n of a request during a rewrite or redirect.\n maxLength: 1024\n type: string\n replacePrefixMatch:\n description: |-\n ReplacePrefixMatch specifies the value with which to replace the prefix\n match of a request during a rewrite or redirect. For example, a request\n to \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\n of \"/xyz\" would be modified to \"/xyz/bar\".\n\n Note that this matches the behavior of the PathPrefix match type. This\n matches full path elements. A path element refers to the list of labels\n in the path split by the `/` separator. When specified, a trailing `/` is\n ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\n match the prefix `/abc`, but the path `/abcd` would not.\n\n ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\n Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in\n the implementation setting the Accepted Condition for the Route to `status: False`.\n\n Request Path | Prefix Match | Replace Prefix | Modified Path\n maxLength: 1024\n type: string\n type:\n description: |-\n Type defines the type of path modifier. Additional types may be\n added in a future release of the API.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - ReplaceFullPath\n - ReplacePrefixMatch\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: replaceFullPath must be specified\n when type is set to 'ReplaceFullPath'\n rule: \"self.type == 'ReplaceFullPath' ?\n has(self.replaceFullPath) : true\"\n - message: type must be 'ReplaceFullPath' when\n replaceFullPath is set\n rule: \"has(self.replaceFullPath) ? self.type\n == 'ReplaceFullPath' : true\"\n - message: replacePrefixMatch must be specified\n when type is set to 'ReplacePrefixMatch'\n rule: \"self.type == 'ReplacePrefixMatch'\n ? has(self.replacePrefixMatch) : true\"\n - message: type must be 'ReplacePrefixMatch'\n when replacePrefixMatch is set\n rule: \"has(self.replacePrefixMatch) ? self.type\n == 'ReplacePrefixMatch' : true\"\n type: object\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: filter.requestHeaderModifier must be nil\n if the filter.type is not RequestHeaderModifier\n rule: \"!(has(self.requestHeaderModifier) && self.type\n != 'RequestHeaderModifier')\"\n - message: filter.requestHeaderModifier must be specified\n for RequestHeaderModifier filter.type\n rule: \"!(!has(self.requestHeaderModifier) && self.type\n == 'RequestHeaderModifier')\"\n - message: filter.responseHeaderModifier must be nil\n if the filter.type is not ResponseHeaderModifier\n rule: \"!(has(self.responseHeaderModifier) && self.type\n != 'ResponseHeaderModifier')\"\n - message: filter.responseHeaderModifier must be specified\n for ResponseHeaderModifier filter.type\n rule: \"!(!has(self.responseHeaderModifier) && self.type\n == 'ResponseHeaderModifier')\"\n - message: filter.requestMirror must be nil if the filter.type\n is not RequestMirror\n rule: \"!(has(self.requestMirror) && self.type != 'RequestMirror')\"\n - message: filter.requestMirror must be specified for\n RequestMirror filter.type\n rule: \"!(!has(self.requestMirror) && self.type ==\n 'RequestMirror')\"\n - message: filter.requestRedirect must be nil if the\n filter.type is not RequestRedirect\n rule: \"!(has(self.requestRedirect) && self.type !=\n 'RequestRedirect')\"\n - message: filter.requestRedirect must be specified\n for RequestRedirect filter.type\n rule: \"!(!has(self.requestRedirect) && self.type ==\n 'RequestRedirect')\"\n - message: filter.urlRewrite must be nil if the filter.type\n is not URLRewrite\n rule: \"!(has(self.urlRewrite) && self.type != 'URLRewrite')\"\n - message: filter.urlRewrite must be specified for URLRewrite\n filter.type\n rule: \"!(!has(self.urlRewrite) && self.type == 'URLRewrite')\"\n - message: filter.extensionRef must be nil if the filter.type\n is not ExtensionRef\n rule: \"!(has(self.extensionRef) && self.type != 'ExtensionRef')\"\n - message: filter.extensionRef must be specified for\n ExtensionRef filter.type\n rule: \"!(!has(self.extensionRef) && self.type == 'ExtensionRef')\"\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: May specify either httpRouteFilterRequestRedirect\n or httpRouteFilterRequestRewrite, but not both\n rule: \"!(self.exists(f, f.type == 'RequestRedirect')\n && self.exists(f, f.type == 'URLRewrite'))\"\n - message: RequestHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'RequestHeaderModifier').size()\n <= 1\n - message: ResponseHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()\n <= 1\n - message: RequestRedirect filter cannot be repeated\n rule: self.filter(f, f.type == 'RequestRedirect').size()\n <= 1\n - message: URLRewrite filter cannot be repeated\n rule: self.filter(f, f.type == 'URLRewrite').size()\n <= 1\n group:\n default: \"\"\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Service\n description: |-\n Kind is the Kubernetes resource kind of the referent. For example\n \"Service\".\n\n Defaults to \"Service\" when not specified.\n\n ExternalName services can refer to CNAME DNS records that may live\n outside of the cluster and as such are difficult to reason about in\n terms of conformance. They also may not be safe to forward to (see\n CVE-2021-25740 for more information). Implementations SHOULD NOT\n support ExternalName Services.\n\n Support: Core (Services with a type other than ExternalName)\n\n Support: Implementation-specific (Services with type ExternalName)\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the backend. When unspecified, the local\n namespace is inferred.\n\n Note that when a namespace different than the local namespace is specified,\n a ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port specifies the destination port number to use for this resource.\n Port is required when the referent is a Kubernetes Service. In this\n case, the port number is the service port number, not the target port.\n For other resources, destination port might be derived from the referent\n resource or this field.\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n weight:\n default: 1\n description: |-\n Weight specifies the proportion of requests forwarded to the referenced\n backend. This is computed as weight/(sum of all weights in this\n BackendRefs list). For non-zero values, there may be some epsilon from\n the exact proportion defined here depending on the precision an\n implementation supports. Weight is not a percentage and the sum of\n weights does not need to equal 100.\n\n If only one backend is specified and it has a weight greater than 0, 100%\n of the traffic is forwarded to that backend. If weight is set to 0, no\n traffic should be forwarded for this entry. If unspecified, weight\n defaults to 1.\n\n Support for this field varies based on the context where used.\n format: int32\n maximum: 1000000\n minimum: 0\n type: integer\n required:\n - name\n type: object\n x-kubernetes-validations:\n - message: Must have port for Service reference\n rule: \"(size(self.group) == 0 && self.kind == 'Service')\n ? has(self.port) : true\"\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n filters:\n description: |-\n Filters define the filters that are applied to requests that match\n this rule.\n\n Wherever possible, implementations SHOULD implement filters in the order\n they are specified.\n\n Implementations MAY choose to implement this ordering strictly, rejecting\n any combination or order of filters that cannot be supported. If implementations\n choose a strict interpretation of filter ordering, they MUST clearly document\n that behavior.\n\n To reject an invalid combination or order of filters, implementations SHOULD\n consider the Route Rules with this configuration invalid. If all Route Rules\n in a Route are invalid, the entire Route would be considered invalid. If only\n a portion of Route Rules are invalid, implementations MUST set the\n \"PartiallyInvalid\" condition for the Route.\n\n Conformance-levels at this level are defined based on the type of filter:\n\n - ALL core filters MUST be supported by all implementations.\n - Implementers are encouraged to support extended filters.\n - Implementation-specific custom filters have no API guarantees across\n implementations.\n\n Specifying the same filter multiple times is not supported unless explicitly\n indicated in the filter.\n\n All filters are expected to be compatible with each other except for the\n URLRewrite and RequestRedirect filters, which may not be combined. If an\n implementation cannot support other combinations of filters, they must clearly\n document that limitation. In cases where incompatible or unsupported\n filters are specified and cause the `Accepted` condition to be set to status\n `False`, implementations may use the `IncompatibleFilters` reason to specify\n this configuration error.\n\n Support: Core\n items:\n description: |-\n HTTPRouteFilter defines processing steps that must be completed during the\n request or response lifecycle. HTTPRouteFilters are meant as an extension\n point to express processing that may be done in Gateway implementations. Some\n examples include request or response modification, implementing\n authentication strategies, rate-limiting, and traffic shaping. API\n guarantee/conformance is defined based on the type of the filter.\n properties:\n extensionRef:\n description: |-\n ExtensionRef is an optional, implementation-specific extension to the\n \"filter\" behavior. For example, resource \"myroutefilter\" in group\n \"networking.example.net\"). ExtensionRef MUST NOT be used for core and\n extended filters.\n\n This filter can be used multiple times within the same rule.\n\n Support: Implementation-specific\n properties:\n group:\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: Kind is kind of the referent. For example\n \"HTTPRoute\" or \"Service\".\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - group\n - kind\n - name\n type: object\n requestHeaderModifier:\n description: |-\n RequestHeaderModifier defines a schema for a filter that modifies request\n headers.\n\n Support: Core\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n requestMirror:\n description: |-\n RequestMirror defines a schema for a filter that mirrors requests.\n Requests are sent to the specified destination, but responses from\n that destination are ignored.\n\n This filter can be used multiple times within the same rule. Note that\n not all implementations will be able to support mirroring to multiple\n backends.\n\n Support: Extended\n properties:\n backendRef:\n description: |-\n BackendRef references a resource where mirrored requests are sent.\n\n Mirrored requests must be sent only to a single destination endpoint\n within this BackendRef, irrespective of how many endpoints are present\n within this BackendRef.\n\n If the referent cannot be found, this BackendRef is invalid and must be\n dropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\n condition on the Route status is set to `status: False` and not configure\n this backend in the underlying implementation.\n\n If there is a cross-namespace reference to an *existing* object\n that is not allowed by a ReferenceGrant, the controller must ensure the\n \"ResolvedRefs\" condition on the Route is set to `status: False`,\n with the \"RefNotPermitted\" reason and not configure this backend in the\n underlying implementation.\n\n In either error case, the Message of the `ResolvedRefs` Condition\n should be used to provide more detail about the problem.\n\n Support: Extended for Kubernetes Service\n\n Support: Implementation-specific for any other resource\n properties:\n group:\n default: \"\"\n description: |-\n Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\n When unspecified or empty string, core API group is inferred.\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Service\n description: |-\n Kind is the Kubernetes resource kind of the referent. For example\n \"Service\".\n\n Defaults to \"Service\" when not specified.\n\n ExternalName services can refer to CNAME DNS records that may live\n outside of the cluster and as such are difficult to reason about in\n terms of conformance. They also may not be safe to forward to (see\n CVE-2021-25740 for more information). Implementations SHOULD NOT\n support ExternalName Services.\n\n Support: Core (Services with a type other than ExternalName)\n\n Support: Implementation-specific (Services with type ExternalName)\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: Name is the name of the referent.\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the backend. When unspecified, the local\n namespace is inferred.\n\n Note that when a namespace different than the local namespace is specified,\n a ReferenceGrant object is required in the referent namespace to allow that\n namespace's owner to accept the reference. See the ReferenceGrant\n documentation for details.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port specifies the destination port number to use for this resource.\n Port is required when the referent is a Kubernetes Service. In this\n case, the port number is the service port number, not the target port.\n For other resources, destination port might be derived from the referent\n resource or this field.\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n required:\n - name\n type: object\n x-kubernetes-validations:\n - message: Must have port for Service reference\n rule: \"(size(self.group) == 0 && self.kind == 'Service')\n ? has(self.port) : true\"\n fraction:\n description: |-\n Fraction represents the fraction of requests that should be\n mirrored to BackendRef.\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n properties:\n denominator:\n default: 100\n format: int32\n minimum: 1\n type: integer\n numerator:\n format: int32\n minimum: 0\n type: integer\n required:\n - numerator\n type: object\n x-kubernetes-validations:\n - message: numerator must be less than or equal to\n denominator\n rule: self.numerator <= self.denominator\n percent:\n description: |-\n Percent represents the percentage of requests that should be\n mirrored to BackendRef. Its minimum value is 0 (indicating 0% of\n requests) and its maximum value is 100 (indicating 100% of requests).\n\n Only one of Fraction or Percent may be specified. If neither field\n is specified, 100% of requests will be mirrored.\n format: int32\n maximum: 100\n minimum: 0\n type: integer\n required:\n - backendRef\n type: object\n x-kubernetes-validations:\n - message: Only one of percent or fraction may be specified\n in HTTPRequestMirrorFilter\n rule: \"!(has(self.percent) && has(self.fraction))\"\n requestRedirect:\n description: |-\n RequestRedirect defines a schema for a filter that responds to the\n request with an HTTP redirection.\n\n Support: Core\n properties:\n hostname:\n description: |-\n Hostname is the hostname to be used in the value of the `Location`\n header in the response.\n When empty, the hostname in the `Host` header of the request is used.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n path:\n description: |-\n Path defines parameters used to modify the path of the incoming request.\n The modified path is then used to construct the `Location` header. When\n empty, the request path is used as-is.\n\n Support: Extended\n properties:\n replaceFullPath:\n description: |-\n ReplaceFullPath specifies the value with which to replace the full path\n of a request during a rewrite or redirect.\n maxLength: 1024\n type: string\n replacePrefixMatch:\n description: |-\n ReplacePrefixMatch specifies the value with which to replace the prefix\n match of a request during a rewrite or redirect. For example, a request\n to \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\n of \"/xyz\" would be modified to \"/xyz/bar\".\n\n Note that this matches the behavior of the PathPrefix match type. This\n matches full path elements. A path element refers to the list of labels\n in the path split by the `/` separator. When specified, a trailing `/` is\n ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\n match the prefix `/abc`, but the path `/abcd` would not.\n\n ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\n Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in\n the implementation setting the Accepted Condition for the Route to `status: False`.\n\n Request Path | Prefix Match | Replace Prefix | Modified Path\n maxLength: 1024\n type: string\n type:\n description: |-\n Type defines the type of path modifier. Additional types may be\n added in a future release of the API.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - ReplaceFullPath\n - ReplacePrefixMatch\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: replaceFullPath must be specified when\n type is set to 'ReplaceFullPath'\n rule: \"self.type == 'ReplaceFullPath' ? has(self.replaceFullPath)\n : true\"\n - message: type must be 'ReplaceFullPath' when replaceFullPath\n is set\n rule: \"has(self.replaceFullPath) ? self.type ==\n 'ReplaceFullPath' : true\"\n - message: replacePrefixMatch must be specified when\n type is set to 'ReplacePrefixMatch'\n rule: \"self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch)\n : true\"\n - message: type must be 'ReplacePrefixMatch' when\n replacePrefixMatch is set\n rule: \"has(self.replacePrefixMatch) ? self.type\n == 'ReplacePrefixMatch' : true\"\n port:\n description: |-\n Port is the port to be used in the value of the `Location`\n header in the response.\n\n If no port is specified, the redirect port MUST be derived using the\n following rules:\n\n * If redirect scheme is not-empty, the redirect port MUST be the well-known\n port associated with the redirect scheme. Specifically \"http\" to port 80\n and \"https\" to port 443. If the redirect scheme does not have a\n well-known port, the listener port of the Gateway SHOULD be used.\n * If redirect scheme is empty, the redirect port MUST be the Gateway\n Listener port.\n\n Implementations SHOULD NOT add the port number in the 'Location'\n header in the following cases:\n\n * A Location header that will use HTTP (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 80.\n * A Location header that will use HTTPS (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 443.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n scheme:\n description: |-\n Scheme is the scheme to be used in the value of the `Location` header in\n the response. When empty, the scheme of the request is used.\n\n Scheme redirects can affect the port of the redirect, for more information,\n refer to the documentation for the port field of this filter.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n\n Support: Extended\n enum:\n - http\n - https\n type: string\n statusCode:\n default: 302\n description: |-\n StatusCode is the HTTP status code to be used in response.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n\n Support: Core\n enum:\n - 301\n - 302\n type: integer\n type: object\n responseHeaderModifier:\n description: |-\n ResponseHeaderModifier defines a schema for a filter that modifies response\n headers.\n\n Support: Extended\n properties:\n add:\n description: |-\n Add adds the given header(s) (name, value) to the request\n before the action. It appends to any existing values associated\n with the header name.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n remove:\n description: |-\n Remove the given header(s) from the HTTP request before the action. The\n value of Remove is a list of HTTP header names. Note that the header\n names are case-insensitive (see\n https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\n Input:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\n Config:\n remove: [\"my-header1\", \"my-header3\"]\n\n Output:\n GET /foo HTTP/1.1\n my-header2: bar\n items:\n type: string\n maxItems: 16\n type: array\n x-kubernetes-list-type: set\n set:\n description: |-\n Set overwrites the request with the given header (name, value)\n before the action.\n\n Input:\n GET /foo HTTP/1.1\n my-header: foo\n\n Config:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\n Output:\n GET /foo HTTP/1.1\n my-header: bar\n items:\n description: HTTPHeader represents an HTTP Header\n name and value as defined by RFC 7230.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, the first entry with\n an equivalent name MUST be considered for a match. Subsequent entries\n with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n value:\n description: Value is the value of HTTP Header\n to be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n type:\n description: |-\n Type identifies the type of filter to apply. As with other API fields,\n types are classified into three conformance levels:\n\n - Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations must support core filters.\n\n - Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n - Implementation-specific: Filters that are defined and supported by\n specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` should be set to\n \"ExtensionRef\" for custom filters.\n\n Implementers are encouraged to define custom implementation types to\n extend the core API with implementation-specific behavior.\n\n If a reference to a custom filter type cannot be resolved, the filter\n MUST NOT be skipped. Instead, requests that would have been processed by\n that filter MUST receive a HTTP error response.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - RequestHeaderModifier\n - ResponseHeaderModifier\n - RequestMirror\n - RequestRedirect\n - URLRewrite\n - ExtensionRef\n type: string\n urlRewrite:\n description: |-\n URLRewrite defines a schema for a filter that modifies a request during forwarding.\n\n Support: Extended\n properties:\n hostname:\n description: |-\n Hostname is the value to be used to replace the Host header value during\n forwarding.\n\n Support: Extended\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n path:\n description: |-\n Path defines a path rewrite.\n\n Support: Extended\n properties:\n replaceFullPath:\n description: |-\n ReplaceFullPath specifies the value with which to replace the full path\n of a request during a rewrite or redirect.\n maxLength: 1024\n type: string\n replacePrefixMatch:\n description: |-\n ReplacePrefixMatch specifies the value with which to replace the prefix\n match of a request during a rewrite or redirect. For example, a request\n to \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\n of \"/xyz\" would be modified to \"/xyz/bar\".\n\n Note that this matches the behavior of the PathPrefix match type. This\n matches full path elements. A path element refers to the list of labels\n in the path split by the `/` separator. When specified, a trailing `/` is\n ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\n match the prefix `/abc`, but the path `/abcd` would not.\n\n ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\n Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in\n the implementation setting the Accepted Condition for the Route to `status: False`.\n\n Request Path | Prefix Match | Replace Prefix | Modified Path\n maxLength: 1024\n type: string\n type:\n description: |-\n Type defines the type of path modifier. Additional types may be\n added in a future release of the API.\n\n Note that values may be added to this enum, implementations\n must ensure that unknown values will not cause a crash.\n\n Unknown values here must result in the implementation setting the\n Accepted Condition for the Route to `status: False`, with a\n Reason of `UnsupportedValue`.\n enum:\n - ReplaceFullPath\n - ReplacePrefixMatch\n type: string\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: replaceFullPath must be specified when\n type is set to 'ReplaceFullPath'\n rule: \"self.type == 'ReplaceFullPath' ? has(self.replaceFullPath)\n : true\"\n - message: type must be 'ReplaceFullPath' when replaceFullPath\n is set\n rule: \"has(self.replaceFullPath) ? self.type ==\n 'ReplaceFullPath' : true\"\n - message: replacePrefixMatch must be specified when\n type is set to 'ReplacePrefixMatch'\n rule: \"self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch)\n : true\"\n - message: type must be 'ReplacePrefixMatch' when\n replacePrefixMatch is set\n rule: \"has(self.replacePrefixMatch) ? self.type\n == 'ReplacePrefixMatch' : true\"\n type: object\n required:\n - type\n type: object\n x-kubernetes-validations:\n - message: filter.requestHeaderModifier must be nil if the\n filter.type is not RequestHeaderModifier\n rule: \"!(has(self.requestHeaderModifier) && self.type !=\n 'RequestHeaderModifier')\"\n - message: filter.requestHeaderModifier must be specified\n for RequestHeaderModifier filter.type\n rule: \"!(!has(self.requestHeaderModifier) && self.type ==\n 'RequestHeaderModifier')\"\n - message: filter.responseHeaderModifier must be nil if the\n filter.type is not ResponseHeaderModifier\n rule: \"!(has(self.responseHeaderModifier) && self.type !=\n 'ResponseHeaderModifier')\"\n - message: filter.responseHeaderModifier must be specified\n for ResponseHeaderModifier filter.type\n rule: \"!(!has(self.responseHeaderModifier) && self.type\n == 'ResponseHeaderModifier')\"\n - message: filter.requestMirror must be nil if the filter.type\n is not RequestMirror\n rule: \"!(has(self.requestMirror) && self.type != 'RequestMirror')\"\n - message: filter.requestMirror must be specified for RequestMirror\n filter.type\n rule: \"!(!has(self.requestMirror) && self.type == 'RequestMirror')\"\n - message: filter.requestRedirect must be nil if the filter.type\n is not RequestRedirect\n rule: \"!(has(self.requestRedirect) && self.type != 'RequestRedirect')\"\n - message: filter.requestRedirect must be specified for RequestRedirect\n filter.type\n rule: \"!(!has(self.requestRedirect) && self.type == 'RequestRedirect')\"\n - message: filter.urlRewrite must be nil if the filter.type\n is not URLRewrite\n rule: \"!(has(self.urlRewrite) && self.type != 'URLRewrite')\"\n - message: filter.urlRewrite must be specified for URLRewrite\n filter.type\n rule: \"!(!has(self.urlRewrite) && self.type == 'URLRewrite')\"\n - message: filter.extensionRef must be nil if the filter.type\n is not ExtensionRef\n rule: \"!(has(self.extensionRef) && self.type != 'ExtensionRef')\"\n - message: filter.extensionRef must be specified for ExtensionRef\n filter.type\n rule: \"!(!has(self.extensionRef) && self.type == 'ExtensionRef')\"\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: May specify either httpRouteFilterRequestRedirect\n or httpRouteFilterRequestRewrite, but not both\n rule: \"!(self.exists(f, f.type == 'RequestRedirect') &&\n self.exists(f, f.type == 'URLRewrite'))\"\n - message: RequestHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'RequestHeaderModifier').size()\n <= 1\n - message: ResponseHeaderModifier filter cannot be repeated\n rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()\n <= 1\n - message: RequestRedirect filter cannot be repeated\n rule: self.filter(f, f.type == 'RequestRedirect').size() <=\n 1\n - message: URLRewrite filter cannot be repeated\n rule: self.filter(f, f.type == 'URLRewrite').size() <= 1\n matches:\n default:\n - path:\n type: PathPrefix\n value: /\n description: |-\n Matches define conditions used for matching the rule against incoming\n HTTP requests. Each match is independent, i.e. this rule will be matched\n if **any** one of the matches is satisfied.\n\n For example, take the following matches configuration:\n\n ```\n matches:\n - path:\n value: \"/foo\"\n headers:\n - name: \"version\"\n value: \"v2\"\n - path:\n value: \"/v2/foo\"\n ```\n\n For a request to match against this rule, a request must satisfy\n EITHER of the two conditions:\n\n - path prefixed with `/foo` AND contains the header `version: v2`\n - path prefix of `/v2/foo`\n\n See the documentation for HTTPRouteMatch on how to specify multiple\n match conditions that should be ANDed together.\n\n If no matches are specified, the default is a prefix\n path match on \"/\", which has the effect of matching every\n HTTP request.\n\n Proxy or Load Balancer routing configuration generated from HTTPRoutes\n MUST prioritize matches based on the following criteria, continuing on\n ties. Across all rules specified on applicable Routes, precedence must be\n given to the match having:\n\n * \"Exact\" path match.\n * \"Prefix\" path match with largest number of characters.\n * Method match.\n * Largest number of header matches.\n * Largest number of query param matches.\n\n Note: The precedence of RegularExpression path matches are implementation-specific.\n\n If ties still exist across multiple Routes, matching precedence MUST be\n determined in order of the following criteria, continuing on ties:\n\n * The oldest Route based on creation timestamp.\n * The Route appearing first in alphabetical order by\n \"{namespace}/{name}\".\n\n If ties still exist within an HTTPRoute, matching precedence MUST be granted\n to the FIRST matching rule (in list order) with a match meeting the above\n criteria.\n\n When no rules matching a request have been successfully attached to the\n parent a request is coming from, a HTTP 404 status code MUST be returned.\n items:\n description: \"HTTPRouteMatch defines the predicate used to\n match requests to a given\\naction. Multiple match types\n are ANDed together, i.e. the match will\\nevaluate to true\n only if all conditions are satisfied.\\n\\nFor example, the\n match below will match a HTTP request only if its path\\nstarts\n with `/foo` AND it contains the `version: v1` header:\\n\\n```\\nmatch:\\n\\n\\tpath:\\n\\t\n \\ value: \\\"/foo\\\"\\n\\theaders:\\n\\t- name: \\\"version\\\"\\n\\t\n \\ value \\\"v1\\\"\\n\\n```\"\n properties:\n headers:\n description: |-\n Headers specifies HTTP request header matchers. Multiple match values are\n ANDed together, meaning, a request must match all the specified headers\n to select the route.\n items:\n description: |-\n HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request\n headers.\n properties:\n name:\n description: |-\n Name is the name of the HTTP Header to be matched. Name matching MUST be\n case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\n If multiple entries specify equivalent header names, only the first\n entry with an equivalent name MUST be considered for a match. Subsequent\n entries with an equivalent header name MUST be ignored. Due to the\n case-insensitivity of header names, \"foo\" and \"Foo\" are considered\n equivalent.\n\n When a header is repeated in an HTTP request, it is\n implementation-specific behavior as to how this is represented.\n Generally, proxies should follow the guidance from the RFC:\n https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding\n processing a repeated header, with special handling for \"Set-Cookie\".\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n type:\n default: Exact\n description: |-\n Type specifies how to match against the value of the header.\n\n Support: Core (Exact)\n\n Support: Implementation-specific (RegularExpression)\n\n Since RegularExpression HeaderMatchType has implementation-specific\n conformance, implementations can support POSIX, PCRE or any other dialects\n of regular expressions. Please read the implementation's documentation to\n determine the supported dialect.\n enum:\n - Exact\n - RegularExpression\n type: string\n value:\n description: Value is the value of HTTP Header to\n be matched.\n maxLength: 4096\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n method:\n description: |-\n Method specifies HTTP method matcher.\n When specified, this route will be matched only if the request has the\n specified method.\n\n Support: Extended\n enum:\n - GET\n - HEAD\n - POST\n - PUT\n - DELETE\n - CONNECT\n - OPTIONS\n - TRACE\n - PATCH\n type: string\n path:\n default:\n type: PathPrefix\n value: /\n description: |-\n Path specifies a HTTP request path matcher. If this field is not\n specified, a default prefix match on the \"/\" path is provided.\n properties:\n type:\n default: PathPrefix\n description: |-\n Type specifies how to match against the path Value.\n\n Support: Core (Exact, PathPrefix)\n\n Support: Implementation-specific (RegularExpression)\n enum:\n - Exact\n - PathPrefix\n - RegularExpression\n type: string\n value:\n default: /\n description: Value of the HTTP path to match against.\n maxLength: 1024\n type: string\n type: object\n x-kubernetes-validations:\n - message: value must be an absolute path and start with\n '/' when type one of ['Exact', 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? self.value.startsWith('/')\n : true\"\n - message: must not contain '//' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('//')\n : true\"\n - message: must not contain '/./' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('/./')\n : true\"\n - message: must not contain '/../' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('/../')\n : true\"\n - message: must not contain '%2f' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('%2f')\n : true\"\n - message: must not contain '%2F' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('%2F')\n : true\"\n - message: must not contain '#' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.contains('#')\n : true\"\n - message: must not end with '/..' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.endsWith('/..')\n : true\"\n - message: must not end with '/.' when type one of ['Exact',\n 'PathPrefix']\n rule: \"(self.type in ['Exact','PathPrefix']) ? !self.value.endsWith('/.')\n : true\"\n - message: type must be one of ['Exact', 'PathPrefix',\n 'RegularExpression']\n rule: self.type in ['Exact','PathPrefix'] || self.type\n == 'RegularExpression'\n - message: must only contain valid characters (matching\n ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$)\n for types ['Exact', 'PathPrefix']\n rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r\"\"\"^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$\"\"\")\n : true'\n queryParams:\n description: |-\n QueryParams specifies HTTP query parameter matchers. Multiple match\n values are ANDed together, meaning, a request must match all the\n specified query parameters to select the route.\n\n Support: Extended\n items:\n description: |-\n HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP\n query parameters.\n properties:\n name:\n description: |-\n Name is the name of the HTTP query param to be matched. This must be an\n exact string match. (See\n https://tools.ietf.org/html/rfc7230#section-2.7.3).\n\n If multiple entries specify equivalent query param names, only the first\n entry with an equivalent name MUST be considered for a match. Subsequent\n entries with an equivalent query param name MUST be ignored.\n\n If a query param is repeated in an HTTP request, the behavior is\n purposely left undefined, since different data planes have different\n capabilities. However, it is *recommended* that implementations should\n match against the first value of the param if the data plane supports it,\n as this behavior is expected in other load balancing contexts outside of\n the Gateway API.\n\n Users SHOULD NOT route traffic based on repeated query params to guard\n themselves against potential differences in the implementations.\n maxLength: 256\n minLength: 1\n pattern: ^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$\n type: string\n type:\n default: Exact\n description: |-\n Type specifies how to match against the value of the query parameter.\n\n Support: Extended (Exact)\n\n Support: Implementation-specific (RegularExpression)\n\n Since RegularExpression QueryParamMatchType has Implementation-specific\n conformance, implementations can support POSIX, PCRE or any other\n dialects of regular expressions. Please read the implementation's\n documentation to determine the supported dialect.\n enum:\n - Exact\n - RegularExpression\n type: string\n value:\n description: Value is the value of HTTP query param\n to be matched.\n maxLength: 1024\n minLength: 1\n type: string\n required:\n - name\n - value\n type: object\n maxItems: 16\n type: array\n x-kubernetes-list-map-keys:\n - name\n x-kubernetes-list-type: map\n type: object\n maxItems: 64\n type: array\n x-kubernetes-list-type: atomic\n name:\n description: |-\n Name is the name of the route rule. This name MUST be unique within a Route if it is set.\n\n Support: Extended\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n timeouts:\n description: |-\n Timeouts defines the timeouts that can be configured for an HTTP request.\n\n Support: Extended\n properties:\n backendRequest:\n description: |-\n BackendRequest specifies a timeout for an individual request from the gateway\n to a backend. This covers the time from when the request first starts being\n sent from the gateway to when the full response has been received from the backend.\n\n Setting a timeout to the zero duration (e.g. \"0s\") SHOULD disable the timeout\n completely. Implementations that cannot completely disable the timeout MUST\n instead interpret the zero duration as the longest possible value to which\n the timeout can be set.\n\n An entire client HTTP transaction with a gateway, covered by the Request timeout,\n may result in more than one call from the gateway to the destination backend,\n for example, if automatic retries are supported.\n\n The value of BackendRequest must be a Gateway API Duration string as defined by\n GEP-2257. When this field is unspecified, its behavior is implementation-specific;\n when specified, the value of BackendRequest must be no more than the value of the\n Request timeout (since the Request timeout encompasses the BackendRequest timeout).\n\n Support: Extended\n pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$\n type: string\n request:\n description: |-\n Request specifies the maximum duration for a gateway to respond to an HTTP request.\n If the gateway has not been able to respond before this deadline is met, the gateway\n MUST return a timeout error.\n\n For example, setting the `rules.timeouts.request` field to the value `10s` in an\n `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds\n to complete.\n\n Setting a timeout to the zero duration (e.g. \"0s\") SHOULD disable the timeout\n completely. Implementations that cannot completely disable the timeout MUST\n instead interpret the zero duration as the longest possible value to which\n the timeout can be set.\n\n This timeout is intended to cover as close to the whole request-response transaction\n as possible although an implementation MAY choose to start the timeout after the entire\n request stream has been received instead of immediately after the transaction is\n initiated by the client.\n\n The value of Request is a Gateway API Duration string as defined by GEP-2257. When this\n field is unspecified, request timeout behavior is implementation-specific.\n\n Support: Extended\n pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$\n type: string\n type: object\n x-kubernetes-validations:\n - message: backendRequest timeout cannot be longer than request\n timeout\n rule: \"!(has(self.request) && has(self.backendRequest) &&\n duration(self.request) != duration('0s') && duration(self.backendRequest)\n > duration(self.request))\"\n type: object\n x-kubernetes-validations:\n - message: RequestRedirect filter must not be used together with\n backendRefs\n rule: \"(has(self.backendRefs) && size(self.backendRefs) > 0) ?\n (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))):\n true\"\n - message: When using RequestRedirect filter with path.replacePrefixMatch,\n exactly one PathPrefix match must be specified\n rule: \"(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect)\n && has(f.requestRedirect.path) && f.requestRedirect.path.type\n == 'ReplacePrefixMatch' && has(f.requestRedirect.path.replacePrefixMatch)))\n ? ((size(self.matches) != 1 || !has(self.matches[0].path) ||\n self.matches[0].path.type != 'PathPrefix') ? false : true)\n : true\"\n - message: When using URLRewrite filter with path.replacePrefixMatch,\n exactly one PathPrefix match must be specified\n rule: \"(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite)\n && has(f.urlRewrite.path) && f.urlRewrite.path.type == 'ReplacePrefixMatch'\n && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches)\n != 1 || !has(self.matches[0].path) || self.matches[0].path.type\n != 'PathPrefix') ? false : true) : true\"\n - message: Within backendRefs, when using RequestRedirect filter\n with path.replacePrefixMatch, exactly one PathPrefix match must\n be specified\n rule: \"(has(self.backendRefs) && self.backendRefs.exists_one(b,\n (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect)\n && has(f.requestRedirect.path) && f.requestRedirect.path.type\n == 'ReplacePrefixMatch' && has(f.requestRedirect.path.replacePrefixMatch)))\n )) ? ((size(self.matches) != 1 || !has(self.matches[0].path)\n || self.matches[0].path.type != 'PathPrefix') ? false : true)\n : true\"\n - message: Within backendRefs, When using URLRewrite filter with\n path.replacePrefixMatch, exactly one PathPrefix match must be\n specified\n rule: \"(has(self.backendRefs) && self.backendRefs.exists_one(b,\n (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite)\n && has(f.urlRewrite.path) && f.urlRewrite.path.type == 'ReplacePrefixMatch'\n && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches)\n != 1 || !has(self.matches[0].path) || self.matches[0].path.type\n != 'PathPrefix') ? false : true) : true\"\n maxItems: 16\n type: array\n x-kubernetes-list-type: atomic\n x-kubernetes-validations:\n - message: While 16 rules and 64 matches per rule are allowed, the\n total number of matches across all rules in a route must be less\n than 128\n rule: \"(self.size() > 0 ? self[0].matches.size() : 0) + (self.size()\n > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size()\n : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size()\n > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size()\n : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size()\n > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size()\n : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size()\n > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size()\n : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size()\n > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size()\n : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128\"\n type: object\n status:\n description: Status defines the current state of HTTPRoute.\n properties:\n parents:\n description: |-\n Parents is a list of parent resources (usually Gateways) that are\n associated with the route, and the status of the route with respect to\n each parent. When this route attaches to a parent, the controller that\n manages the parent must add an entry to this list when the controller\n first sees the route and should update the entry as appropriate when the\n route or gateway is modified.\n\n Note that parent references that cannot be resolved by an implementation\n of this API will not be added to this list. Implementations of this API\n can only populate Route status for the Gateways/parent resources they are\n responsible for.\n\n A maximum of 32 Gateways will be represented in this list. An empty list\n means the route has not been attached to any Gateway.\n items:\n description: |-\n RouteParentStatus describes the status of a route with respect to an\n associated Parent.\n properties:\n conditions:\n description: |-\n Conditions describes the status of the route with respect to the Gateway.\n Note that the route's availability is also subject to the Gateway's own\n status conditions and listener status.\n\n If the Route's ParentRef specifies an existing Gateway that supports\n Routes of this kind AND that Gateway's controller has sufficient access,\n then that Gateway's controller MUST set the \"Accepted\" condition on the\n Route, to indicate whether the route has been accepted or rejected by the\n Gateway, and why.\n\n A Route MUST be considered \"Accepted\" if at least one of the Route's\n rules is implemented by the Gateway.\n\n There are a number of cases where the \"Accepted\" condition may not be set\n due to lack of controller visibility, that includes when:\n\n * The Route refers to a nonexistent parent.\n * The Route is of a type that the controller does not support.\n * The Route is in a namespace the controller does not have access to.\n items:\n description: Condition contains details for one aspect of\n the current state of this API Resource.\n properties:\n lastTransitionTime:\n description: |-\n lastTransitionTime is the last time the condition transitioned from one status to another.\n This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.\n format: date-time\n type: string\n message:\n description: |-\n message is a human readable message indicating details about the transition.\n This may be an empty string.\n maxLength: 32768\n type: string\n observedGeneration:\n description: |-\n observedGeneration represents the .metadata.generation that the condition was set based upon.\n For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\n with respect to the current state of the instance.\n format: int64\n minimum: 0\n type: integer\n reason:\n description: |-\n reason contains a programmatic identifier indicating the reason for the condition's last transition.\n Producers of specific condition types may define expected values and meanings for this field,\n and whether the values are considered a guaranteed API.\n The value should be a CamelCase string.\n This field may not be empty.\n maxLength: 1024\n minLength: 1\n pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n type: string\n status:\n description: status of the condition, one of True, False,\n Unknown.\n enum:\n - \"True\"\n - \"False\"\n - Unknown\n type: string\n type:\n description: type of condition in CamelCase or in foo.example.com/CamelCase.\n maxLength: 316\n pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n type: string\n required:\n - lastTransitionTime\n - message\n - reason\n - status\n - type\n type: object\n maxItems: 8\n minItems: 1\n type: array\n x-kubernetes-list-map-keys:\n - type\n x-kubernetes-list-type: map\n controllerName:\n description: |-\n ControllerName is a domain/path string that indicates the name of the\n controller that wrote this status. This corresponds with the\n controllerName field on GatewayClass.\n\n Example: \"example.net/gateway-controller\".\n\n The format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\n valid Kubernetes names\n (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\n Controllers MUST populate this field when writing status. Controllers should ensure that\n entries to status populated with their ControllerName are cleaned up when they are no\n longer necessary.\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$\n type: string\n parentRef:\n description: |-\n ParentRef corresponds with a ParentRef in the spec that this\n RouteParentStatus struct describes the status of.\n properties:\n group:\n default: gateway.networking.k8s.io\n description: |-\n Group is the group of the referent.\n When unspecified, \"gateway.networking.k8s.io\" is inferred.\n To set the core API group (such as for a \"Service\" kind referent),\n Group must be explicitly set to \"\" (empty string).\n\n Support: Core\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n default: Gateway\n description: |-\n Kind is kind of the referent.\n\n There are two kinds of parent resources with \"Core\" support:\n\n * Gateway (Gateway conformance profile)\n * Service (Mesh conformance profile, ClusterIP Services only)\n\n Support for other resources is Implementation-Specific.\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: |-\n Name is the name of the referent.\n\n Support: Core\n maxLength: 253\n minLength: 1\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referent. When unspecified, this refers\n to the local namespace of the Route.\n\n Note that there are specific rules for ParentRefs which cross namespace\n boundaries. Cross-namespace references are only valid if they are explicitly\n allowed by something in the namespace they are referring to. For example:\n Gateway has the AllowedRoutes field, and ReferenceGrant provides a\n generic way to enable any other kind of cross-namespace reference.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n port:\n description: |-\n Port is the network port this Route targets. It can be interpreted\n differently based on the type of parent resource.\n\n When the parent resource is a Gateway, this targets all listeners\n listening on the specified port that also support this kind of Route(and\n select this Route). It's not recommended to set `Port` unless the\n networking behaviors specified in a Route must apply to a specific port\n as opposed to a listener(s) whose port(s) may be changed. When both Port\n and SectionName are specified, the name and port of the selected listener\n must match both specified values.\n\n Implementations MAY choose to support other parent resources.\n Implementations supporting other types of parent resources MUST clearly\n document how/if Port is interpreted.\n\n For the purpose of status, an attachment is considered successful as\n long as the parent resource accepts it partially. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment\n from the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route,\n the Route MUST be considered detached from the Gateway.\n\n Support: Extended\n format: int32\n maximum: 65535\n minimum: 1\n type: integer\n sectionName:\n description: |-\n SectionName is the name of a section within the target resource. In the\n following resources, SectionName is interpreted as the following:\n\n * Gateway: Listener name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n * Service: Port name. When both Port (experimental) and SectionName\n are specified, the name and port of the selected listener must match\n both specified values.\n\n Implementations MAY choose to support attaching Routes to other resources.\n If that is the case, they MUST clearly document how SectionName is\n interpreted.\n\n When unspecified (empty string), this will reference the entire resource.\n For the purpose of status, an attachment is considered successful if at\n least one section in the parent resource accepts it. For example, Gateway\n listeners can restrict which Routes can attach to them by Route kind,\n namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\n the referencing Route, the Route MUST be considered successfully\n attached. If no Gateway listeners accept attachment from this Route, the\n Route MUST be considered detached from the Gateway.\n\n Support: Core\n maxLength: 253\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n required:\n - name\n type: object\n required:\n - conditions\n - controllerName\n - parentRef\n type: object\n maxItems: 32\n type: array\n x-kubernetes-list-type: atomic\n required:\n - parents\n type: object\n required:\n - spec\n type: object\n served: true\n storage: false\n subresources:\n status: {}\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: null\n storedVersions: null\n---\napiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328\n gateway.networking.k8s.io/bundle-version: v1.4.0\n gateway.networking.k8s.io/channel: standard\n name: referencegrants.gateway.networking.k8s.io\nspec:\n group: gateway.networking.k8s.io\n names:\n categories:\n - gateway-api\n kind: ReferenceGrant\n listKind: ReferenceGrantList\n plural: referencegrants\n shortNames:\n - refgrant\n singular: referencegrant\n scope: Namespaced\n versions:\n - additionalPrinterColumns:\n - jsonPath: .metadata.creationTimestamp\n name: Age\n type: date\n name: v1beta1\n schema:\n openAPIV3Schema:\n description: |-\n ReferenceGrant identifies kinds of resources in other namespaces that are\n trusted to reference the specified kinds of resources in the same namespace\n as the policy.\n\n Each ReferenceGrant can be used to represent a unique trust relationship.\n Additional Reference Grants can be used to add to the set of trusted\n sources of inbound references for the namespace they are defined within.\n\n All cross-namespace references in Gateway API (with the exception of cross-namespace\n Gateway-route attachment) require a ReferenceGrant.\n\n ReferenceGrant is a form of runtime verification allowing users to assert\n which cross-namespace object references are permitted. Implementations that\n support ReferenceGrant MUST NOT permit cross-namespace references which have\n no grant, and MUST respond to the removal of a grant by revoking the access\n that the grant allowed.\n properties:\n apiVersion:\n description: |-\n APIVersion defines the versioned schema of this representation of an object.\n Servers should convert recognized schemas to the latest internal value, and\n may reject unrecognized values.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n type: string\n kind:\n description: |-\n Kind is a string value representing the REST resource this object represents.\n Servers may infer this from the endpoint the client submits requests to.\n Cannot be updated.\n In CamelCase.\n More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n type: string\n metadata:\n type: object\n spec:\n description: Spec defines the desired state of ReferenceGrant.\n properties:\n from:\n description: |-\n From describes the trusted namespaces and kinds that can reference the\n resources described in \"To\". Each entry in this list MUST be considered\n to be an additional place that references can be valid from, or to put\n this another way, entries MUST be combined using OR.\n\n Support: Core\n items:\n description: ReferenceGrantFrom describes trusted namespaces and\n kinds.\n properties:\n group:\n description: |-\n Group is the group of the referent.\n When empty, the Kubernetes core API group is inferred.\n\n Support: Core\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: |-\n Kind is the kind of the referent. Although implementations may support\n additional resources, the following types are part of the \"Core\"\n support level for this field.\n\n When used to permit a SecretObjectReference:\n\n * Gateway\n\n When used to permit a BackendObjectReference:\n\n * GRPCRoute\n * HTTPRoute\n * TCPRoute\n * TLSRoute\n * UDPRoute\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n namespace:\n description: |-\n Namespace is the namespace of the referent.\n\n Support: Core\n maxLength: 63\n minLength: 1\n pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$\n type: string\n required:\n - group\n - kind\n - namespace\n type: object\n maxItems: 16\n minItems: 1\n type: array\n x-kubernetes-list-type: atomic\n to:\n description: |-\n To describes the resources that may be referenced by the resources\n described in \"From\". Each entry in this list MUST be considered to be an\n additional place that references can be valid to, or to put this another\n way, entries MUST be combined using OR.\n\n Support: Core\n items:\n description: |-\n ReferenceGrantTo describes what Kinds are allowed as targets of the\n references.\n properties:\n group:\n description: |-\n Group is the group of the referent.\n When empty, the Kubernetes core API group is inferred.\n\n Support: Core\n maxLength: 253\n pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\n type: string\n kind:\n description: |-\n Kind is the kind of the referent. Although implementations may support\n additional resources, the following types are part of the \"Core\"\n support level for this field:\n\n * Secret when used to permit a SecretObjectReference\n * Service when used to permit a BackendObjectReference\n maxLength: 63\n minLength: 1\n pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$\n type: string\n name:\n description: |-\n Name is the name of the referent. When unspecified, this policy\n refers to all resources of the specified Group and Kind in the local\n namespace.\n maxLength: 253\n minLength: 1\n type: string\n required:\n - group\n - kind\n type: object\n maxItems: 16\n minItems: 1\n type: array\n x-kubernetes-list-type: atomic\n required:\n - from\n - to\n type: object\n type: object\n served: true\n storage: true\n subresources: {}\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: null\n storedVersions: null\n" }, { "path": "cluster/homelab/crds/gateway-api/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - crds.yaml\n" }, { "path": "cluster/homelab/crds/istio/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: istio-base\n namespace: istio-system\nspec:\n interval: 10m\n install:\n createNamespace: true\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: base\n version: 1.29.2\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: istio\n namespace: flux-system\n" }, { "path": "cluster/homelab/crds/istio/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/crds/istio/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: istio-system\n" }, { "path": "cluster/homelab/crds/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - gateway-api\n - external-snapshotter # Velero gives an error if VolumeSnapshotClasses is missing\n - istio\n - mariadb-operator\n" }, { "path": "cluster/homelab/crds/mariadb-operator/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: mariadb-operator-crds\n namespace: mariadb-operator\nspec:\n interval: 10m\n install:\n createNamespace: true\n upgrade:\n crds: CreateReplace\n remediation:\n retries: 3\n chart:\n spec:\n chart: mariadb-operator-crds\n version: \"26.3.0\"\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: mariadb-operator\n namespace: flux-system\n" }, { "path": "cluster/homelab/crds/mariadb-operator/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n - namespace.yaml\n" }, { "path": "cluster/homelab/crds/mariadb-operator/namespace.yaml", "content": "---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: mariadb-operator\n" }, { "path": "cluster/homelab/helm/aqua/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/aqua/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: aqua\n namespace: flux-system\nspec:\n url: https://aquasecurity.github.io/helm-charts\n interval: 5m\n" }, { "path": "cluster/homelab/helm/bjw-s/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/bjw-s/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: bjw-s\n namespace: flux-system\nspec:\n url: https://bjw-s-labs.github.io/helm-charts\n interval: 5m\n" }, { "path": "cluster/homelab/helm/cert-manager/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/cert-manager/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: cert-manager\n namespace: flux-system\nspec:\n url: https://charts.jetstack.io\n interval: 5m\n" }, { "path": "cluster/homelab/helm/cnpg/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/cnpg/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: cnpg\n namespace: flux-system\nspec:\n url: https://cloudnative-pg.github.io/charts\n interval: 10m\n" }, { "path": "cluster/homelab/helm/descheduler/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/descheduler/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: descheduler\n namespace: flux-system\nspec:\n url: https://kubernetes-sigs.github.io/descheduler/\n interval: 5m\n" }, { "path": "cluster/homelab/helm/gabe565/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/gabe565/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: gabe565\n namespace: flux-system\nspec:\n url: https://charts.gabe565.com\n interval: 5m\n" }, { "path": "cluster/homelab/helm/go-ddns-controller/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/go-ddns-controller/repo.yaml", "content": "apiVersion: source.toolkit.fluxcd.io/v1\nkind: GitRepository\nmetadata:\n name: go-ddns-controller\n namespace: flux-system\nspec:\n interval: 10m\n url: https://github.com/Michaelpalacce/go-ddns-controller\n ref:\n branch: master\n" }, { "path": "cluster/homelab/helm/istio/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/istio/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: istio\n namespace: flux-system\nspec:\n url: https://istio-release.storage.googleapis.com/charts\n interval: 5m\n" }, { "path": "cluster/homelab/helm/k8s-at-home/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/k8s-at-home/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: k8s-at-home\n namespace: flux-system\nspec:\n url: https://k8s-at-home.com/charts\n interval: 5m\n" }, { "path": "cluster/homelab/helm/kube-vip/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/kube-vip/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: kube-vip\n namespace: flux-system\nspec:\n url: https://kube-vip.github.io/helm-charts\n interval: 5m\n" }, { "path": "cluster/homelab/helm/kubereboot/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/kubereboot/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: kubereboot\n namespace: flux-system\nspec:\n url: https://kubereboot.github.io/charts\n interval: 10m\n" }, { "path": "cluster/homelab/helm/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - aqua\n - cnpg\n - observability\n - k8s-at-home\n - metrics-server\n - unofficial\n - longhorn-system\n - cert-manager\n - reflector\n - velero\n - kube-vip\n - kyverno\n - kubereboot\n - descheduler\n - gabe565\n - go-ddns-controller\n - metallb\n - tika\n - maikumori\n - mariadb-operator\n - bjw-s\n - wger\n - istio\n - tofu-controller\n" }, { "path": "cluster/homelab/helm/kyverno/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/kyverno/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: kyverno\n namespace: flux-system\nspec:\n url: https://kyverno.github.io/kyverno\n interval: 10m\n" }, { "path": "cluster/homelab/helm/longhorn-system/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - longhorn-repo.yaml\n" }, { "path": "cluster/homelab/helm/longhorn-system/longhorn-repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: longhorn-system\n namespace: flux-system\nspec:\n url: https://charts.longhorn.io\n interval: 5m\n" }, { "path": "cluster/homelab/helm/maikumori/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/maikumori/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: maikumori\n namespace: flux-system\nspec:\n url: https://maikumori.github.io/helm-charts\n interval: 5m\n" }, { "path": "cluster/homelab/helm/mariadb-operator/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/mariadb-operator/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: mariadb-operator\n namespace: flux-system\nspec:\n url: https://helm.mariadb.com/mariadb-operator\n interval: 5m\n" }, { "path": "cluster/homelab/helm/metallb/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/metallb/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: metallb\n namespace: flux-system\nspec:\n url: https://metallb.github.io/metallb\n interval: 10m\n" }, { "path": "cluster/homelab/helm/metrics-server/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/metrics-server/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: metrics-server\n namespace: flux-system\nspec:\n url: https://kubernetes-sigs.github.io/metrics-server/\n interval: 5m\n" }, { "path": "cluster/homelab/helm/observability/kube-prometheus-stack.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: kube-prometheus-stack\n namespace: flux-system\nspec:\n url: https://prometheus-community.github.io/helm-charts\n interval: 5m\n" }, { "path": "cluster/homelab/helm/observability/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - kube-prometheus-stack.yaml\n - loki-stack.yaml\n" }, { "path": "cluster/homelab/helm/observability/loki-stack.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: grafana\n namespace: flux-system\nspec:\n url: https://grafana.github.io/helm-charts\n interval: 5m\n" }, { "path": "cluster/homelab/helm/reflector/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/reflector/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: reflector\n namespace: flux-system\nspec:\n url: https://emberstack.github.io/helm-charts\n interval: 5m\n" }, { "path": "cluster/homelab/helm/rook/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/rook/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: rook-release\n namespace: flux-system\nspec:\n url: https://charts.rook.io/release\n interval: 5m\n" }, { "path": "cluster/homelab/helm/tika/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/tika/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: tika\n namespace: flux-system\nspec:\n url: https://apache.jfrog.io/artifactory/tika\n interval: 5m\n" }, { "path": "cluster/homelab/helm/tofu-controller/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/tofu-controller/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: tofu-controller\n namespace: flux-system\nspec:\n interval: 10m\n url: https://flux-iac.github.io/tofu-controller\n" }, { "path": "cluster/homelab/helm/unofficial/jameswynn.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: homepage\n namespace: flux-system\nspec:\n url: https://jameswynn.github.io/helm-charts\n interval: 5m\n" }, { "path": "cluster/homelab/helm/unofficial/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - jameswynn.yaml\n" }, { "path": "cluster/homelab/helm/velero/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/velero/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: velero\n namespace: flux-system\nspec:\n url: https://vmware-tanzu.github.io/helm-charts\n interval: 5m\n" }, { "path": "cluster/homelab/helm/wger/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - repo.yaml\n" }, { "path": "cluster/homelab/helm/wger/repo.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: HelmRepository\nmetadata:\n name: wger\n namespace: flux-system\nspec:\n url: https://wger-project.github.io/helm-charts\n interval: 5m\n" }, { "path": "cluster/homelab/storage/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - rook-ceph-cluster\n" }, { "path": "cluster/homelab/storage/rook-ceph-cluster/helm-release.yaml", "content": "---\napiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n name: rook-ceph-cluster\n namespace: rook-ceph\nspec:\n interval: 10m\n timeout: 15m\n install:\n createNamespace: true\n crds: CreateReplace\n remediation:\n retries: -1\n upgrade:\n cleanupOnFail: true\n remediation:\n retries: 3\n chart:\n spec:\n chart: rook-ceph-cluster\n version: v1.19.5\n interval: 10m\n sourceRef:\n kind: HelmRepository\n name: rook-release\n namespace: flux-system\n values:\n cephClusterSpec:\n cephVersion:\n image: quay.io/ceph/ceph:v20.2.1\n dataDirHostPath: /var/lib/rook\n mon:\n count: 3\n allowMultiplePerNode: false\n # enable the ceph dashboard for viewing cluster status\n dashboard:\n enabled: true\n # serve the dashboard under a subpath (useful when you are accessing the dashboard via a reverse proxy)\n urlPrefix: /\n # serve the dashboard at the given port.\n # port: 8443\n # Serve the dashboard using SSL (if using ingress to expose the dashboard and `ssl: true` you need to set\n # the corresponding \"backend protocol\" annotation(s) for your ingress controller of choice)\n ssl: true\n # cluster level storage configuration and selection\n storage:\n useAllNodes: true\n useAllDevices: true\n # Only create OSDs on devices that match the regular expression filter, \"sdb\" in this example\n # @WARN: THIS WILL TAKE OVER `sdb` ENTIRELY, MAKE SURE IT'S RESERVED ONLY FOR CEPH\n deviceFilter: sdb\n # To control where various services will be scheduled by kubernetes, use the placement configuration sections below.\n # The example under 'all' would have all services scheduled on kubernetes nodes labeled with 'role=rook-node' and\n # the OSDs would specifically only be created on nodes labeled with 'role=rook-osd-node'.\n placement:\n all:\n nodeAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n nodeSelectorTerms:\n - matchExpressions:\n - key: role\n operator: In\n values:\n - rook-node\n osd:\n nodeAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n nodeSelectorTerms:\n - matchExpressions:\n - key: role\n operator: In\n values:\n - rook-osd-node\n resources:\n prepareosd:\n requests:\n cpu: \"200m\"\n memory: \"200Mi\"\n priorityClassNames:\n # If there are multiple nodes available in a failure domain (e.g. zones), the\n # mons and osds can be portable and set the system-cluster-critical priority class.\n mon: system-node-critical\n osd: system-node-critical\n mgr: system-cluster-critical\n disruptionManagement:\n managePodBudgets: true\n osdMaintenanceTimeout: 30\n" }, { "path": "cluster/homelab/storage/rook-ceph-cluster/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - helm-release.yaml\n" }, { "path": "cluster/homelab/template.secret.yaml", "content": "kind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: template\n namespace: default\ndata:\n BOT_TOKEN: aHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g/dj1kUXc0dzlXZ1hjU\n" }, { "path": "cluster/homelab/terraform/homelab-iac-secrets.sops.yaml", "content": "kind: Secret\napiVersion: v1\ntype: Opaque\nmetadata:\n name: homelab-iac-secrets\n namespace: flux-system\nstringData:\n proxmox_api_token: ENC[AES256_GCM,data:k1OPPtkCNJnFovB18MgziczSUbx1RXtwzXjzHWN+NsQTiwScI61KLXY7Qm9DUq7rypftBrp0oc++YqY=,iv:s98g+wEYC9Ic+XHhXLUbDxBUDjxOBRJy5PuELJK+o2Q=,tag:QAJHuev0cgCy6FUrthaLKQ==,type:str]\n proxmox_ssh_password: ENC[AES256_GCM,data:LYfJhr9X0TSN9bdTl4k=,iv:NrVNh0jqy9h0CJgCrUI9mAr33tlMGhFYgff1RTlj81s=,tag:nzA+WqOvwBga7BHPOv/tcA==,type:str]\n cloudflare_api_key: ENC[AES256_GCM,data:wSnkNHBPrZoJlN3ews545xACAujn6taN7KlSxYDzvvYOJhjURg==,iv:oHuSVDE8pGfwfU5dljymOwKXrk5JzNuGBTSst+wAdTI=,tag:YZ3dMY8RiiLaD3o6mvi0gw==,type:str]\nsops:\n age:\n - recipient: age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn\n enc: |\n -----BEGIN AGE ENCRYPTED FILE-----\n YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5RThCRFRjcXdBYnlLQVRO\n VFB2R3NWU0kxZWFtVkw3ZUt3VEZMbjdVM1NvCldLMzhML2FrUVk0TkVxSEI5NXRt\n Z2h1RndnalJyeHF0cUNSNUt2WHBoSkUKLS0tIDRvZXk4ZWdOQ2UyM3liYmpMeFdE\n Yit1ZmttWlN4MEFLcWJZb2tTOXlFdWMK+Zl+dJC6znE9IkTYfhZx+lhv9hLyQZBm\n bm+5PXtQ+a6VYd1QwZptFrKHHeAI/XlE3hUHwzTDpNDqzl9VeRpbMw==\n -----END AGE ENCRYPTED FILE-----\n lastmodified: \"2026-01-14T23:17:40Z\"\n mac: ENC[AES256_GCM,data:RjyRmbflStWU0zrwUWRcnzv6/Pse9I1GEEoNJaw/C0a7zpoLfuFQNMVwHiWvymxSufUYWWGpRwCasDL1BDNBvBvfPleTagACFoKJJ6Yv0Y3mf9fARMEHMj0iRidxCBj2I1YbD0YIVkb+XUAuN5GVrxwAL5KvEs1qSnkYAQ2xvcY=,iv:OBcEIf3sNBQqUhIoIqxIQwWkx3IOQeaJ043nWOd5Us0=,tag:Th8MicA4tye8JO5wSiIUOA==,type:str]\n encrypted_regex: (?i)password|webhook_url|token|key\n version: 3.11.0\n" }, { "path": "cluster/homelab/terraform/homelab-iac.yaml", "content": "---\napiVersion: source.toolkit.fluxcd.io/v1\nkind: GitRepository\nmetadata:\n name: homelab-iac\n namespace: flux-system\nspec:\n interval: 30s\n url: https://github.com/Michaelpalacce/HomeLab-IaC\n ref:\n branch: master\n---\napiVersion: infra.contrib.fluxcd.io/v1alpha2\nkind: Terraform\nmetadata:\n name: homelab-iac\n namespace: flux-system\nspec:\n interval: 10m\n approvePlan: auto\n path: ./\n sourceRef:\n kind: GitRepository\n name: homelab-iac\n namespace: flux-system\n varsFrom:\n - kind: Secret\n name: homelab-iac-secrets\n storeReadablePlan: human\n" }, { "path": "cluster/homelab/terraform/kustomization.yaml", "content": "---\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n - homelab-iac.yaml\n - homelab-iac-secrets.sops.yaml\n" }, { "path": "docs/Backups.md", "content": "# Backups\n\nBackups are done via [Velero](https://github.com/vmware-tanzu/velero).\n\nCurrently, my backups are done using the Velero helm chart. \nA Velero Schedule Custom resource is created for every day at 5 in the morning that backups a bunch of my services.\n\n\n# Manual steps and General Knowledge :\n\n## Installation:\n\n1. Create a bucket in AWS S3 ( Mine is called `sgenov-backup` )\n2. Create a IAM user with the correct policy for S3\n3. Get the IAM user's credentials\n4. Create a new file: `velero-credentials` in the root of the folder ( see how it should look down below )\n5. In the project root, run: `velero install --use-restic --provider aws --plugins velero/velero-plugin-for-aws --bucket sgenov-velero-backup --secret-file ./velero-credentials --backup-location-config region=eu-west-1 --snapshot-location-config region=eu-west-1`\n 1. Make sure the bucket is empty!\n 2. --use-restic is used to back up PVCs\n\n`velero-credentials`:\n~~~\n[default]\naws_access_key_id=\naws_secret_access_key=\n~~~\n\n## Creating backups:\n\n### Manual:\n\n`velero backup create uptimekuma --include-namespaces uptimekuma --snapshot-volumes=true` Will backup the namespace uptimekuma\n\n### From Schedule:\n\n`velero create backup --from-schedule general`\n\n## Restoring backups:\n\nWhen restoring backups Velero will not restore objects that are already existing, so whatever you need to restore must be deleted first.\nIf you are restoring pods from a deployment/statefulset/daemonsets/etc make sure to delete them too. \n\n**NOTE:** Velero will hang up if it can't restore all the restic volumes, so you may need to remove the restore or it will be stuck in `In progress`\n\n### Manual:\n\n1. Clear up namespace\n2. Run `velero restore create uptimekuma1 --from-backup uptimekuma --restore-volumes=true`. Optionally add: `--include-namespaces postgresql`\n\n### From Schedule:\n\n1. Clear up any resources you wish to restore\n2. Run: `velero restore create --from-schedule general --restore-volumes=true`. Optionally add: `--include-namespaces postgresql`\n\n" }, { "path": "docs/Flux.md", "content": "# Flux\n\n## Flux bootstrap\n1. Add env variable GITHUB_TOKEN\n2. Run: `flux bootstrap github --owner=Michaelpalacce --repository=HomeLab --branch=master --path=./cluster/homelab/base --personal`\n3. Flux needs to run a reconciliation after which it will bootstrap the cluster with all apps in order. \n 1. Note: **This will take a while**\n\n## How does it work?\n`cluster/homelab/base` is the entrypoint. It holds Kustomizations for all the other 3 modules as well as the flux-system ( which is the flux installation )\nEach Kustomization is a separate file with dependencies of one another.\n\n### Steps of import:\n1. `helm.yaml` - Holds all the helm charts needed.\n2. `core.yaml` - Depends on helm Kustomization and holds core functionality for the cluster to function like storage, certificates, ingress, etc.\n3. `apps.yaml` - Depends on both `core.yaml` and `helm.yaml` and holds all the apps currently installed on my cluster.\n4. `configs.yaml` - Depends on `core.yaml` and holds all the configurations for the cluster\n\n" }, { "path": "docs/Getting Started.md", "content": "# Installing Kubernetes\n\n## K3S and why are we using it\n- For raspberry pis who have limited resources we need something more minimalistic. k3s was made to run with limited resources in mind, so it seems like a good fit\n- We will not be using traefik, instead we are using istio\n\n## Before installing anything\nIt is highly advisory to go to each helm chart values.yaml file and check the different options and modify them as you wish.\nThings like ports, storage size etc. are good to be checked out. You may also want to check out the variables for the ansible scripts\n\n## Setting up the cluster\n- First thing we are going to do is navigate to the `./ansible` folder\n- Set up your inventory file ( use mine as an example, the only thing different will probably be the IPs, \nbut if you chose a different ansible user, make sure to modify accordingly ) **Note: This is not secure. \nIdeally you should either pass in your password every time or setup passwordless authentication**\n- **If you did not fix the iptables**, ( when it comes to raspberry pis ) do it now: `ansible -i hosts/inventory -b -m shell -a \"iptables -F && update-alternatives --set iptables /usr/sbin/iptables-legacy && update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy && reboot\" all -k`\n- Run `ansible-galaxy install -r playbooks/install/requirements.yml` to install all the needed ansible roles from Ansible Galaxy\n- Run `ansible-playbook -i hosts/inventory playbooks/install/main.yml `\n- You should check the Troubleshooting options regarding svclb and enable container ip forwarding.\n\nNext Steps: - [Flux](./Flux.md)\n" }, { "path": "docs/Longhorn.md", "content": "# Increasing PVC/volume Size\nLonghorn requires a few manual steps to achieve this.\n\n## Steps:\n1. Stop all pods the volume is attached to\n2. Increase size of volume\n3. Go to Longhorn UI\n4. Attach the volume in maintenance mode\n5. Wait for the resizing to finish\n6. Start all pods\n" }, { "path": "docs/SettingUpCertManager.md", "content": "# Resource to read:\nhttps://blog.darkedges.com/2020/05/04/cert-manager-kubernetes-cloudflare-dns-update/\n\nIt describes how to generate the API token from cloudflare." }, { "path": "docs/SettingUpRenovate.md", "content": "# Setting up Renovate\n\nRenovate is installed as a Github App and periodically checks my repository for new versions of docker images / helm charts / etc \nand creates Pull Requests with the update.\n\n## Steps:\n1. Initial Renovate setup by following the official documentation\n2. Follow instructions [here](https://github.com/renovatebot/github-action#special-token-requirements-when-using-the-github-actions-manager)\n" }, { "path": "docs/Sops.md", "content": "# SOPS\n\nMozilla SOPS is a tool that allows you to commit encrypted secrets/data to git, without having to worry.\n\nNote to self: the agekey is stored in Vaultwarden!\n\nGuide: https://fluxcd.io/flux/guides/mozilla-sops/#encrypting-secrets-using-age\n\n1. Generate an agekey\n2. age-keygen -o age.agekey\n3. cat age.agekey |\n kubectl create secret generic sops-age \\\n --namespace=flux-system \\\n --from-file=age.agekey=/dev/stdin\n\n\n## Encrypting:\n\n```bash\nsops --age age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn --encrypt --encrypted-regex '^(data|stringData|annotations|host)$' --in-place \n```\n\n## Decrypting\n\n```bash\nsops --age age1mq6usjzvvxvcp7tl03yjdqd0kgjhhvhz48kmg86p43nhx0jc75jssw0kfn --decrypt --encrypted-regex '^(data|stringData|annotations|host)$' --in-place \n```\n\n\n## Troubleshooting\n\n### Mac mismatch\n\nYou can ignore the MAC mismatch:\n\nhttps://github.com/getsops/sops/discussions/942\n```\n--ignore-mac\n```\n" }, { "path": "docs/Troubleshooting.md", "content": "# Troubleshooting\n\n## Cluster creation failed (or everything has gone to heck and I want to re-do it)\n- Run the k3s uninstall script https://rancher.com/docs/k3s/latest/en/installation/uninstall/\n- Rerun `ansible-playbook -i inventory playbooks/install/main.yml --tags setup -k`\n\n## Grafana is giving an error\n- Try deleting the prometheus data source and re-adding it ( there may be 2 data sources, grafana makes a mistake sometimes )\n\n## Ansible is not connection/is slow/hangs\n- God have mercy on your soul cause ain't nobody gonna help you ;(\n\n## Longhorn storage has an issue\n- Check if it's dns, if it's not dns, I suggest you redo the entire cluster\n\n## Clearing up containerd\n- Go to `./ansible`\n- Run: `ansible -i hosts/inventory -m shell -a \"k3s crictl rmp -a\" -b all` To remove all pods that are not up and running\n- Run: `ansible -i hosts/inventory -m shell -a \"k3s crictl rmi --prune\" -b all` To remove all images\n- Run: `ansible -i hosts/inventory -m shell -a \"k3s crictl rm -a\" -b all`\n\n## Wallabag doesn't want to work correctly, it's giving me a wallabag_internal_settings table is not created\nRestarting the deployment helps. No idea why?\n\n## Issues with Longhorn volumes mounting\n* Check out: https://longhorn.io/kb/troubleshooting-volume-with-multipath/\n\n## cgroup-gc\nThis is a helm chart that installs a daemonset that will be deployed on all nodes with the purpose of clearing up cgroups.\nFor more information: `https://serverfault.com/questions/976233/context-deadline-exceeded-preventing-pods-from-being-created-in-aks`\n\n" }, { "path": "docs/tofu.md", "content": "# Tofu Controller\n\nThe tofu controller allows me to apply my terraform config in a gitops way.\n\n## Getting the tfstate\n\nRef: https://flux-iac.github.io/tofu-controller/use-tf-controller/backup-and-restore-a-Terraform-state/\n\n```sh\nWORKSPACE=default\nNAME=homelab-iac\n\nkubectl get secret tfstate-${WORKSPACE}-${NAME} \\\n -ojsonpath='{.data.tfstate}' \\\n | base64 -d | gzip -d > terraform.tfstate\n```\n\n## Restoring the tfstate\n\n```sh\ngzip terraform.tfstate\n\nWORKSPACE=default\nNAME=my-stack\n\nkubectl create secret \\\n generic tfstate-${WORKSPACE}-${NAME} \\\n --from-file=tfstate=terraform.tfstate.gz \\\n --dry-run=client -o=yaml \\\n | yq e '.metadata.annotations[\"encoding\"]=\"gzip\"' - \\\n > tfstate-${WORKSPACE}-${NAME}.yaml\n\nkubectl apply -f tfstate-${WORKSPACE}-${NAME}.yaml\n```\n\n## Viewing the plan\n\nYou must set first\n\n```diff\napiVersion: infra.contrib.fluxcd.io/v1alpha2\nkind: Terraform\nmetadata:\n name: homelab-iac\n namespace: flux-system\nspec:\n interval: 1m\n # approvePlan: auto\n path: ./\n sourceRef:\n kind: GitRepository\n name: homelab-iac\n namespace: flux-system\n varsFrom:\n - kind: Secret\n name: homelab-iac-secrets\n+ storeReadablePlan: human\n```\n\nAnd then you can do:\n\n```sh\ntfctl show plan homelab-iac\n```\n" }, { "path": "local/docker-compose.yaml", "content": "services:\n tdarr:\n container_name: tdarr\n image: ghcr.io/haveagitgat/tdarr:latest\n restart: unless-stopped\n privileged: true\n network_mode: bridge\n deploy:\n resources:\n reservations:\n cpus: \"0.00\"\n devices:\n - driver: nvidia\n count: 1\n capabilities: [gpu]\n limits:\n memory: 32G\n ports:\n - 8265:8265 # webUI port\n - 8266:8266 # server port\n - 8267:8267 # Internal node port\n environment:\n - TZ=Europe/Sofia\n - UMASK_SET=002\n - serverIP=0.0.0.0\n - serverPort=8266\n - webUIPort=8265\n - internalNode=true\n - nodeName=MyInternalNode\n volumes:\n - ./docker-data/tdarr/server:/app/server\n - ./docker-data/tdarr/configs:/app/configs\n - ./docker-data/tdarr/logs:/app/logs\n - media:/media\n - ./docker-data/tdarr/transcode_cache:/temp\nvolumes:\n media:\n driver_opts:\n type: \"nfs\"\n o: \"addr=192.168.1.39,nolock,rw,soft,nfsvers=4\"\n device: \":/volume1/k3s/media\"\n" }, { "path": "upgrades/v1.35.0+k3s1.yaml", "content": "---\n# Server plan\napiVersion: upgrade.cattle.io/v1\nkind: Plan\nmetadata:\n name: server-plan\n namespace: system-upgrade\nspec:\n concurrency: 1\n cordon: true\n nodeSelector:\n matchExpressions:\n - key: node-role.kubernetes.io/master\n operator: In\n values:\n - \"true\"\n serviceAccountName: system-upgrade\n upgrade:\n image: rancher/k3s-upgrade\n version: v1.35.0+k3s1\n---\n# Agent plan\napiVersion: upgrade.cattle.io/v1\nkind: Plan\nmetadata:\n name: agent-plan\n namespace: system-upgrade\nspec:\n concurrency: 1\n cordon: true\n nodeSelector:\n matchExpressions:\n - key: node-role.kubernetes.io/master\n operator: DoesNotExist\n prepare:\n args:\n - prepare\n - server-plan\n image: rancher/k3s-upgrade\n serviceAccountName: system-upgrade\n upgrade:\n image: rancher/k3s-upgrade\n version: v1.35.0+k3s1\n" } ]